Personal data of employees’ family members: does your business need their consent?

1. Who is the data subject, and what type of data is it?

The data subject is the person the data relates to (Clause 5, Article 2 of the Law on Personal Data Protection 2025, Law No. 91/2025/QH15, the “PDP Law”). So when an employee provides information about a child, parent or spouse, the data subject is that family member. The employee is only the person providing it.

Decree No. 356/2025/ND-CP divides data into two groups, with different obligations:

A point many businesses miss: a copy of a family member’s ID card is sensitive data. So are medical documents showing that a parent is unable to work.

When processing sensitive data, the business must:

• set rules that limit access rights, a processing procedure and security measures (Clause 2, Article 4, Decree 356);
• tell the data subject that the data to be processed is sensitive when asking for consent (Clause 4, Article 6, Decree 356).

2. Valid consent and who can give it

The general rule: the data subject must consent before personal data is collected, unless the law provides otherwise (Clause 1, Article 11, PDP Law).

Consent is valid only when all of the following conditions are met (Article 9, PDP Law; Article 6, Decree 356):

• It is voluntary, and the data subject clearly knows the type of data, the purpose of processing, the data controller, and their own rights and obligations.
• It is given separately for each purpose.
• It is not made conditional on consent to other purposes outside what was agreed.
• Silence or no response does not count as consent.
• It is given in a way that can verify who consented, when, and to what. This can be in writing, a recorded call, a text message with a set syntax, an email, or a technical setting on a website or app.
• There is no pre-ticked “I agree” default and no misleading instructions.

The business must keep records of consent. In a dispute, the business has to prove that consent was given (Clause 2, Article 6, Decree 356).

Who can consent:

The legal representative of a minor child is normally the father or mother.

3. Is consent needed? Analysis by purpose

The answer depends on the purpose of processing. The table below gives a summary; sections 3.1 to 3.4 give the detail.

3.1. Registering dependants for family tax relief

The PDP Law allows processing without consent in “other cases as provided by law” (point (dd), Clause 1, Article 19). It also allows data protection rules in earlier laws to apply, as long as they do not conflict with the principles of Law 91 (Clause 2, Article 5).

When processing without consent, the business must still set up a monitoring mechanism (Clause 2, Article 19):

• a processing procedure and allocation of responsibilities;
• protection measures and regular risk assessment;
• periodic compliance checks;
• a channel for receiving complaints.

3.2. Health insurance and voluntary benefits for family members

No law requires the business to process this data. So the family member’s own consent is needed (Clause 1, Article 11, PDP Law). Three further rules apply:

• Health information and insurance business activities require the data subject’s consent during collection and processing, except in the cases in Clause 1, Article 19 (Clause 1, Article 26, PDP Law).
• Providing data to another organisation, such as an insurer, requires the data subject’s consent, unless the law provides otherwise (point (b), Clause 2, Article 15, PDP Law).
• Employees or family members must not be required to consent to unrelated purposes (for example marketing) as a condition of receiving a benefit (point (b), Clause 4, Article 9, PDP Law).

When transferring data to an insurer or benefits provider, the business must sign a data transfer agreement (Clause 1, Article 7, Decree 356). The agreement must state:

• the purpose of the transfer;
• the data subjects and types of data;
• the processing period and deletion requirements;
• the legal basis;
• responsibility for protecting the data and for honouring data subjects’ rights;
• responsibility for cooperating if a breach occurs.

Sensitive data must be physically secured, encrypted or anonymised when transferred (Clause 2, Article 7, Decree 356).

3.3. Posting photos and details of employees’ children on a fan page or internal newsletter

Posting is “making personal data public”. Data may only be made public with the data subject’s consent, as provided by law, in the case in point (b), Clause 1, Article 19, or to perform a contractual obligation (Clause 2, Article 16, PDP Law).

For children aged 7 or over, publishing their private life or personal secrets requires the consent of both the child and the parent (Clause 2, Article 24, PDP Law). Article 32 of the PDP Law allows filming without consent at “public activities” such as conferences, sports competitions and performances. However, internal events such as a Family Day or a scholarship ceremony are unlikely to count as public activities.

3.4. Emergency contact details

The exception for “protecting life and health… in an emergency” (point (a), Clause 1, Article 19) only applies when an actual emergency arises. Keeping a family member’s name and phone number on file in advance is data collection, so the nominated person must consent beforehand (Clause 1, Article 11). Collect only the minimum: full name, relationship and phone number.

4. Obligations that come with holding family members’ data

Getting consent is only the first step. The business has five further groups of obligations.

4.1. Responding to family members’ requests on time (Article 5, Decree 356)

The business must have a clear procedure, process and forms so family members can exercise these rights (Clause 1, Article 5, Decree 356).

4.2. Storing and deleting data

Employee data must be stored for the period required by law or agreed. When the employment contract ends, the data must be deleted or destroyed, unless otherwise agreed or provided by law (Clause 2, Article 25, PDP Law).

4.3. Data processing impact assessment

• The data controller prepares the assessment and sends it to the competent authority within 60 days from the first day of processing (Clause 1, Article 21, PDP Law).
• Report Form No. 10 (Appendix to Decree 356) requires each group of data subjects to be listed with numbers, together with the consent process for each group. Employees’ family members should be listed as a separate group.
• The assessment is updated every 6 months when there is a new processing purpose or a change of processor. Some changes must be updated within 10 days (Article 20, Decree 356).

4.4. Data protection staff

An organisation must appoint a qualified department or person, or hire a data protection service (Clause 2, Article 33, PDP Law). Internal staff must meet three conditions (Clause 2, Article 13, Decree 356):

• a college degree or higher;
• at least 2 years of experience in fields such as legal, IT, cybersecurity, risk management, compliance or HR management;
• training in personal data protection.

This means an HR officer can be appointed if they have completed the training.

4.5. Internal controls and breach notification

• Sharing data between departments needs a control process that prevents staff from sharing it without authorisation (Clause 4, Article 7, Decree 356).
• When a breach is found that could harm a data subject’s life, health, honour, dignity or property, the business must notify the competent authority within 72 hours at the latest (Clause 1, Article 23, PDP Law).

5. Are small businesses exempt? What about data sent abroad?

5.1. Exemptions for small and micro businesses

• Small businesses and start-ups: may choose whether or not to carry out three obligations for 5 years from 1 January 2026. The three obligations are: preparing the impact assessment (Article 21), updating it (Article 22) and appointing data protection staff (Clause 2, Article 33) (Clause 2, Article 38, PDP Law).
• Household businesses and micro businesses: do not have to carry out these three obligations (Clause 3, Article 38, PDP Law).
• When the exemption is lost: the business provides data processing services, directly processes sensitive data, or processes data of 100,000 or more data subjects on a cumulative basis (Article 41, Decree 356).

The exemption does not cover the duty to obtain consent, the duty to honour data subjects’ rights, or the obligations on cross-border data transfers.

5.2. Cross-border data transfers

Putting data on servers or cloud services located abroad, or sending it to a parent company abroad, is a cross-border data transfer (Clause 1, Article 17, Decree 356). The business must prepare an impact assessment and send it to the competent authority within 60 days (Clause 2, Article 20, PDP Law).

Two HR-related cases do not require an assessment:

• storing data of the organisation’s employees on cloud computing services (point (b), Clause 6, Article 20, PDP Law);
• transferring data for cross-border HR management under work rules, labour regulations and the collective labour agreement (point (d), Clause 3, Article 17, Decree 356).

6. Penalties for violations

The fines for personal data protection violations in Decree No. 330/2026/ND-CP (in force from 19 August 2026) are set for organisations. Individuals committing the same act pay half (Clause 1, Article 7, Decree 330). The limitation period for penalties is 1 year (Article 3).

Maximum fines (Article 8, PDP Law; Clause 4, Article 7, Decree 330):

• buying or selling data: 10 times the revenue obtained;
• violations on cross-border data transfers: 5% of the previous year’s revenue;
• other violations: VND 3 billion.

Common violations when processing family members’ data (fines for a business):

Besides fines, the business may be ordered to delete or destroy data collected without valid consent so that it cannot be recovered (Clause 4, Article 43).

7. Checklist for businesses

You can start right away with the following steps:

• List every field of family member information you collect, by purpose; remove fields you do not need.
• Flag sensitive data (ID card photos, health documents); restrict access.
• Use a separate consent form for each purpose; no pre-ticked boxes; state clearly which data is sensitive.
• Have adult family members sign or confirm themselves (paper, email, text message, OTP) and keep a consent log.
• For children: the parent signs; if posting photos or details of a child aged 7 or over, the child signs too.
• Sign data transfer agreements with your insurer, payroll provider and HR software vendor.
• Issue a procedure and forms for requests to access, correct or delete data or withdraw consent; set a 2-working-day response deadline.
• Appoint data protection staff in writing, or hire a service.
• List family members as a separate group of data subjects in the impact assessment.
• Schedule deletion of data when an employee leaves.