From 1 January 2026, the 2025 Personal Data Protection Law will take effect in Vietnam, introducing a robust legal framework that places clear and binding obligations on organizations including employers to safeguard personal data.
A notable highlight is the requirement for employers to delete or destroy personal data of employees upon termination of their employment, unless otherwise agreed or legally required. This marks a significant step forward in aligning Vietnam’s data protection standards with international practices.
Key obligations for employers and businesses include:
- Recruitment: Employers may only collect personal data necessary for the hiring process and must use it solely for that purpose, unless the candidate agrees to additional uses. If the candidate is not hired, the data must be deleted or destroyed unless agreed otherwise.
- Employee data retention: Employers may retain personal data of current or former employees only for a legally prescribed or contractually agreed period. Upon contract termination, such data must be deleted unless exempted by law or agreement.
- Use of monitoring technologies: Employers must inform and obtain consent from employees before using tools such as GPS tracking, cameras, or attendance software. These tools may not be used for other purposes without explicit consent.
- Credit data protection: Financial institutions and credit information organizations must not assess or rank individuals’ creditworthiness without their explicit consent, and must implement safeguards to prevent data breaches and unauthorized use.
Vietnam’s New Personal Data Protection Law: Key Implications for Employers and Businesses
This new law is a wake-up call for businesses in Vietnam to review and update their HR, recruitment, and data management practices to ensure compliance. Organizations should start preparing now to meet the 2026 deadline.
Please contact us at jamesphan@hthpartners.com.vn or legalenquiries@hthpartners.com.vn, if you wish to discuss any aspect further.
