When an employment contract ends, businesses must delete the employee’s personal data

When an employment contract ends, businesses must delete the employee’s personal data

At its 9th session, the 15th National Assembly passed the Law on Personal Data Protection. The Law takes effect on 1 January 2026.

The Law on Personal Data Protection sets out the responsibilities of agencies, organisations and individuals for protecting personal data when they manage and use employees, as follows:

• Comply with this Law, the law on labour and employment, the law on data and other relevant laws.
• Employees’ personal data must be stored for the period provided by law or as agreed.

Notably, the Law requires employees’ personal data to be deleted or destroyed when the contract ends, unless otherwise agreed or provided by law.

Employee data in day-to-day management

When an employer processes employees’ personal data collected through technological and technical measures used to manage employees, it may only use technological and technical measures that comply with the law and protect the rights and interests of the data subject, and only where the employee clearly knows about those measures. It must not process or use personal data collected through technological or technical measures in breach of the law.

Candidate data in recruitment

In recruitment, agencies, organisations and individuals may only ask for information that serves their recruitment purpose and complies with the law. The information provided may only be used for recruitment and for other purposes agreed in line with the law.

The information provided must be processed in accordance with the law and with the candidate’s consent. The information a candidate has provided must also be deleted or destroyed if the candidate is not hired, unless otherwise agreed with the candidate.

Prohibited acts and liability

The Law on Personal Data Protection strictly prohibits the following 7 acts:

1. Processing personal data to oppose the State of the Socialist Republic of Vietnam, or in a way that affects national defence, national security, social order and safety, or the lawful rights and interests of agencies, organisations and individuals.
2. Obstructing personal data protection activities.
3. Abusing personal data protection activities to commit violations of the law.
4. Processing personal data in breach of the law.
5. Using another person’s personal data, or letting another person use one’s own personal data, to commit unlawful acts.
6. Buying or selling personal data, unless otherwise provided by law.
7. Appropriating, intentionally disclosing or losing personal data.

Under the Law, violations of personal data protection rules are dealt with according to the nature, seriousness and consequences of the violation. The violator may face an administrative penalty or criminal prosecution, and must pay compensation for any damage caused, as provided by law.

Source: Nhân Dân newspaper.