When businesses think about personal data protection, many think first of customer data. They overlook a large source of data inside the business: their employees. CVs, payroll, facial recognition attendance, cameras, and data sent to HRM software vendors or to a parent company abroad all pass through HR. The HR department may be the largest centre of personal data processing in the business. From 1 January 2026, the Law on Personal Data Protection (Law No. 91/2025/QH15) has a specific article on recruitment, management and use of employees, plus specific rules on biometric data and video recording. This article helps HR Directors and CEOs understand the main rules, spot the risk points at each stage of the employee lifecycle, and know where to start a review.
- The Law on Personal Data Protection (Law No. 91/2025/QH15, in force from 1 January 2026) has a specific article, Article 25, on personal data protection in the recruitment, management and use of employees.
- If a candidate is not hired, the information they provided must be deleted or destroyed, unless otherwise agreed with the candidate.
- When the employment contract ends, employee data must be deleted or destroyed, unless otherwise agreed or provided by law. A clear retention schedule is needed.
- Biometric data (face, fingerprints) is sensitive personal data and has specific protection rules in Article 31 of Law No. 91/2025/QH15.
- Cameras, monitoring software and other technology used to manage employees must comply with the law.
- HR data that passes through HRM, payroll and cloud vendors or a parent company abroad should be mapped and controlled by contract.
1. Why does employee data need a separate review?
Follow one employee from application to departure:
CV → interview → personnel file → contract → bank, tax, insurance → attendance, cameras → performance review → leaving.
Each step creates personal data, and some of it goes to banks, insurers, payroll providers, HRM vendors, recruitment agencies or the parent company. The right question is not “Does HR keep files confidential?” but “How does the business manage the lifecycle of employee data?”
Article 25, Law No. 91/2025/QH15
The Law on Personal Data Protection (Law No. 91/2025/QH15) was passed by the National Assembly on 26 June 2025 and takes effect on 1 January 2026. Article 25 deals specifically with personal data protection in the recruitment, management and use of employees. Decree No. 356/2025/ND-CP (in force from 1 January 2026, replacing Decree No. 13/2023/ND-CP) gives detailed rules and measures to implement the Law.
2. Candidate data: what to watch in recruitment
The data lifecycle starts before the contract is signed. CVs with photos, dates of birth, addresses, experience and referees arrive through the website, HR email, recruitment platforms, headhunters, or directly to managers.
Clause 1, Article 25, Law No. 91/2025/QH15
In recruitment, the employer may only ask for information that serves the recruitment purpose and complies with the law. The information provided may only be used for recruitment or for other purposes as agreed. If the candidate is not hired, the information they provided must be deleted or destroyed, unless otherwise agreed with the candidate.
Analysis: The risk usually lies in scattered copies: CVs on a manager’s personal computer, files sent through messaging apps, copies held by headhunters. If the business wants to keep CVs for future rounds (a “talent pool”), it needs an agreement with the candidate. It should not keep them by default.
Remove unnecessary fields from the application form; give candidates a data processing notice; offer a separate consent option if you want to keep their file; schedule deletion of unsuccessful candidates’ files on every channel, including personal inboxes and headhunters.
3. What data does HR hold during employment?
Once a candidate becomes an employee, the data grows quickly. HR may be one of the largest centres of personal data processing in the business.
| Data group | Examples |
|---|---|
| Identification | Full name, address, photo of ID card (CCCD) or passport |
| Financial | Bank account, income |
| Family | Dependants, emergency contacts |
| Employment and performance | Contract, job title, KPIs, rewards, discipline |
| Systems | Accounts, email, access logs |
| Attendance and monitoring | Fingerprints, face, cameras |
List of sensitive personal data
Article 4 of Decree No. 356/2025/ND-CP lists sensitive personal data. It includes health status; biometric data and genetic characteristics; an individual’s location identified through location services; images of ID cards (thẻ căn cước, căn cước công dân, chứng minh nhân dân); and certain bank account and card information.
Analysis: “Employee files are kept in HR” is usually not true. The same data may sit in filing cabinets, laptops, email, HRM, payroll, cloud, ERP and group systems. It also sits in Excel payroll files and staff lists that are emailed, copied to USB drives and exist in many versions. A locked filing cabinet does not mean the data is under control. Ask: how is data being downloaded out of the software?
Set access rights on the principle: the right person → the right data → the right purpose. Example access matrix:
| Role | Data group | Access scope | Purpose |
|---|---|---|---|
| HR | Personnel files | As required by duties | HR management |
| Payroll / Accounting | Salary, bank account | Restricted | Paying salary, tax, insurance |
| Line manager | Performance, attendance | Only staff in their team | Managing work |
| IT | Accounts, system logs | As required by duties | System administration |
| Security / Administration | Cameras | View by shift; extraction must be approved | Security |
4. Facial and fingerprint attendance: why review it separately?
Article 31 and Clause 2, Article 25, Law No. 91/2025/QH15
Article 31: a party processing biometric data must physically secure the storage and transmission equipment, restrict access rights, have a system to detect intrusions, and notify the data subject if the processing causes harm.
Clause 2, Article 25: technological and technical measures used to manage employees must comply with the law. Data collected through unlawful measures must not be used.
Analysis: An attendance machine is bought to record check-in and check-out times. But if it uses faces or fingerprints, the business is processing sensitive data. A purchasing decision becomes a legal and IT issue. You need to answer: What data is created (photos, biometric templates, logs)? Is it stored on the device, a server or the vendor’s cloud? Who has access, including remote access? How long is it kept? When you change vendor, what happens to the old data? Is there an alternative, such as a swipe card or PIN code?
Before deploying or renewing: identify the purpose and legal basis for processing, notify employees, review the vendor contract, limit access, check how data is deleted when someone leaves, and include it in the impact assessment if one is required.
5. Workplace cameras: what should the business control?
Clause 2, Article 25 and Article 32, Law No. 91/2025/QH15
Cameras used to manage employees are a technological measure and must comply with the law (Clause 2, Article 25). Article 32 deals with audio and video recording in public places: people must be notified or informed in another way; the recording may only be processed for the right purpose; and it may only be kept as long as necessary and then deleted or destroyed, unless the law provides otherwise.
Analysis: An office or factory is not automatically a “public place”. Which rule applies to each area (lobby, gate, factory floor, office) needs a specific assessment. Even so, notice, correct purpose and limited retention are good standards to apply across the board. A useful question: who can download a piece of camera footage to their phone? If nobody can answer, access rights are not being managed.
List cameras by location and purpose; avoid private areas; put up notice signs; set rules on who may view and extract video; fix a retention period; control the vendor’s remote access.
An FC Legal lawyer will discuss it with you and propose a suitable approach.
6. How many vendors handle employee data, and does it go abroad?
HR uses many outside services, and the data flow is often longer than what HR can see.
A typical HR data flow:
- Employee
- The business (HR)
- HRM / payroll provider
- Cloud provider
- Further processor (sub-processor)
- Regional or parent company HR system
Analysis: A general clause such as “the parties undertake to keep all information confidential” is not enough. Vendor contracts should make clear: which data, the purpose and scope of processing, security, sub-processors, storage location, incident notification, and return or deletion of data on termination. For foreign-invested (FDI) companies, sending data to a regional HR system or head office is a cross-border personal data transfer.
Cross-border data transfers and maximum fines
The cross-border personal data transfer impact assessment dossier is prepared on Form No. 09 and sent to the Department of Cybersecurity and High-Tech Crime Prevention (A05), Ministry of Public Security, within 60 days from the date of transfer (Article 18, Decree No. 356/2025/ND-CP). Decree 356 lists cases where no dossier is required. One of them is transferring data for cross-border HR management under work rules, labour regulations or a collective labour agreement.
Article 8, Law No. 91/2025/QH15: the maximum fine for an organisation that breaches the rules on cross-border data transfers is 5% of its revenue in the preceding year (or VND 3 billion if it has no revenue or the revenue-based amount is lower). For other violations, the maximum is VND 3 billion. These are ceilings.
List your vendors and where the data is stored; add data protection clauses to the contracts; assess whether each flow to the parent company falls within an exception. An exception only removes the dossier requirement, not the other obligations.
7. How is data handled when an employee leaves?
Offboarding usually covers returning the laptop, closing the email account and handing over work. It often forgets the personal data of the person who is leaving.
Clause 2, Article 25, Law No. 91/2025/QH15
Employees’ personal data must be stored for the period required by law or agreed. Employees’ personal data must be deleted or destroyed when the employment contract ends, unless otherwise agreed or provided by law.
Analysis: “Delete everything when they leave” is not the right approach, because some records may have to be kept under sector-specific laws. Nor is “keep everything to be safe”. You need a retention schedule that links each data group to its legal basis and retention period, applied across every system, including attendance machines and accounts held with vendors.
Add a “personal data handling” step to the offboarding checklist: which data must be kept (and on what basis), which data must be deleted, in which systems, and who confirms it.
FC Legal can review recruitment data, personnel files, biometric attendance, cameras, vendors and data flows abroad to identify gaps and priorities.
8. Eight self-check questions for HR Directors and CEOs
Answer Yes / No / Not sure:
- Do you know which systems hold employee data, including Excel files?
- Do you have a process for deleting data of unsuccessful candidates?
- Have you reviewed cameras and biometrics separately?
- Do you know who has access to HR data?
- Do you have a list of vendors, and have you reviewed the data clauses in their contracts?
- Do you know which data is transferred outside Vietnam?
- Do you have a process for handling data when someone leaves?
- Do you have a schedule for periodic reviews?
Many “No” or “Not sure” answers are a sign that HR data is not being managed to the right standard.
9. Where should the business start?
You do not have to start with a new policy. Follow the employee lifecycle and at each step ask: What data → Purpose → System → Who has access → Vendor → Does it go abroad? → How long is it kept → Risk. The result is an Employee Data Map.
Suggested roadmap:
- Map HR data.
- Assess gaps against Law No. 91/2025/QH15 and Decree No. 356/2025/ND-CP.
- Set priorities: biometrics, cameras, vendors, transfers abroad.
- Finalise notices, contracts and procedures.
- Apply technical controls and access rights.
- Train staff and review periodically.
Exemptions and deferrals for small businesses
Article 41, Decree No. 356/2025/ND-CP: micro businesses and household businesses are exempt from certain obligations (impact assessment, appointing personal data protection staff). Small businesses and start-ups may choose to be exempt for 5 years from 1 January 2026. This does not apply if they provide data processing services, process sensitive data, or process data of a large number of data subjects.
Analysis: Small businesses that use biometric attendance should assess this carefully, because processing sensitive data may mean they are no longer exempt.
This is not a job for HR alone. Appoint a coordinator and set up an HR, Legal, IT and Procurement team. Start with three questions: where is the data, where are the gaps, and what should be done first.
Frequently asked questions
Can a business keep CVs of unsuccessful candidates?
Under Clause 1, Article 25 of Law No. 91/2025/QH15, if the candidate is not hired, the information they provided must be deleted or destroyed, unless otherwise agreed with the candidate. To keep CVs for future rounds, the business should get the candidate’s clear consent and set a retention period.
When an employee leaves, must all their data be deleted immediately?
Not necessarily. The law requires employee data to be deleted or destroyed when the employment contract ends, unless otherwise agreed or provided by law. Some records may have to be kept under sector-specific laws. The business needs a retention schedule for each data group.
Is facial or fingerprint attendance prohibited?
The law does not prohibit it. But biometric data is sensitive personal data (Article 4, Decree No. 356/2025/ND-CP) and must be protected under Article 31 of Law No. 91/2025/QH15: physical security, restricted access and a system to detect intrusions. Its use must comply with the law.
Do employees need to be notified about cameras in the office?
Cameras used to manage employees are a technological measure and must comply with the law (Clause 2, Article 25). For recording in public places, Article 32 requires notice. Good practice is to give clear notice of the location, purpose and retention period, and to control the extraction of video.
Does sending employee data to a parent company abroad require a dossier?
Decree No. 356/2025/ND-CP includes a case where no cross-border personal data transfer impact assessment dossier is required: transfers for HR management under work rules, labour regulations or a collective labour agreement. Each data flow needs to be assessed; flows through vendors or the cloud may not fall within the exception.
10. Legal basis and references
- Law on Personal Data Protection, Law No. 91/2025/QH15 (passed 26 June 2025, in force 1 January 2026): Articles 8, 20, 25, 31 and 32.
- Decree No. 356/2025/ND-CP dated 31 December 2025 detailing certain articles of and measures to implement the Law on Personal Data Protection: Articles 4, 18 and 41.
- Civil Code 2015: Article 38 (right to private life, personal secrets and family secrets).
- Ministry of Public Security: article “Protection of personal data in certain cases and activities” (bocongan.gov.vn).
- EY Vietnam: legal alert on Decree No. 356/2025/ND-CP.
Review your personal data compliance with an FC Legal lawyer
Find out what data your business processes, where it is, which risks to deal with first, and which documents you need to prepare.
- Data map and compliance gap assessment
- Impact assessment (DPIA) and cross-border transfer dossiers
- Policies, vendor contracts and incident response procedures
Please do not send confidential documents or personal data through the form.
This article is for reference and reflects the rules in force at the time of publication. For a legal opinion on a specific case, please contact an FC Legal lawyer.
Prepared by the FC Legal legal team and reviewed by FC Legal’s Managing Lawyer. Updated 4 October 2026.
