Surveillance cameras and biometric technologies (face recognition, fingerprints) are everywhere in Vietnamese companies: from factory gates, offices and retail stores to attendance systems. But few companies realise these two technologies touch the most strictly protected data group. Biometric data is classified as sensitive personal data under Decree 356/2025/ND-CP, while camera images may become sensitive data depending on collection and use context.
From 01/01/2026, Personal Data Protection Law 2025 (No. 91/2025/QH15) and Decree 356/2025/ND-CP tighten conditions for collecting, storing and using both data types. Companies installing cameras or deploying biometric attendance without a full legal basis face real legal risks.
Quick summary
| Main legal bases | Law 91/2025/QH15; Articles 3–4, 13 of Decree 356/2025/ND-CP |
|---|---|
| Key points | Biometrics = sensitive data, requiring separate consent; cameras need clear notification and no purpose misuse |
| Target audience | Manufacturing, retail and office companies using cameras and biometric attendance |
Why cameras and biometrics are compliance hotspots
Cameras and biometrics have two features making them hotspots. Collection happens continuously, automatically and usually without active interaction from data subjects; meanwhile biometric data is immutable: a leaked password can be changed, but faces and fingerprints cannot. Once leaked, the damage is permanent.
The law therefore classifies biometric data as sensitive data with enhanced protection measures; continuous workplace recording combined with analytics technology may create sensitive data about behaviour and personal habits. Companies need to treat both as high-risk data processing activities.
Biometric data: legal classification and specific requirements
Articles 3 and 4 of Decree 356/2025/ND-CP classify personal data into basic and sensitive data, with biometric data (fingerprints, facial features, irises, voices and other biological characteristics used for personal identification) in the sensitive group. Consequences: companies must obtain separate, clear consent; apply enhanced protection measures; and carefully assess necessity before collecting.
The necessity and data minimisation principle is especially important for biometrics. Before deploying, companies must ask themselves: does this purpose really require biometrics, or are key cards or PINs enough? Only cases genuinely needing high security, such as access control for restricted areas, have a convincing basis for biometrics.
Fingerprint and face attendance: legal conditions
Biometric attendance is the most common application at Vietnamese factories and offices. Legally, this is sensitive employee data processing, which must simultaneously meet sensitive data requirements (separate consent, enhanced protection) and Clause 3 Article 25 of Law 91/2025/QH15 (employees clearly know and consent).
Good practice is giving employees a choice: those consenting use fingerprint or face attendance, those not consenting use key cards or other methods. Forcing all employees to use biometrics without alternatives weakens the “voluntariness” of consent. Companies also need to clearly notify: where biometric data is stored (on devices or central servers), how long, who has access, and how data will be handled when employees leave.
Workplace surveillance cameras
Workplace cameras are directly governed by Clause 3 Article 25 of Law 91/2025/QH15: companies may only apply them when employees clearly know and consent, and must not use collected data for other purposes without consent. This means silently installing cameras and then using images to discipline employees is inconsistent with current law.
Companies need written camera policies: installation locations, purposes per area, retention periods, persons authorised to view extracts. Cameras in changing rooms and restrooms are absolutely prohibited as serious privacy invasions. Camera system notifications should be placed visibly and included in new employee handover documents.
Cameras in companies’ public areas
Beyond workplaces, many companies install cameras where customers and partners enter: lobbies, retail stores, parking lots, warehouses. The legal basis for recording this group is usually consent through public notification, or legitimate interest in securing property.
“CCTV in operation” signs at entrances are the minimum measure and should be implemented seriously, not formally. Signs should state the system operator and contact information for data subjects to exercise their rights. For retail stores using cameras to analyse customer behaviour for marketing, clearer consent is needed as processing purposes exceed normal security scope.
Collecting consent for cameras and biometrics
For biometric data, consent must be separate and clear, not bundled into general clauses in labour contracts or regulations. Consent documents should state: collected data types, purposes, storage locations, retention periods, the right to withdraw consent and consequences of withdrawal.
For cameras, consent forms can be more flexible depending on context: for employees, written confirmation of having been notified; for customers, public signs at entrances. The common point is notifications must be complete and truthful — collection cannot precede notification. Companies should keep evidence of notification and consent collection (see data subject consent management).
Retention periods for image and biometric data
The limited storage principle requires data be kept only as long as necessary for notified purposes. For security camera data, common practice is 7–30 day rolling cycles depending on system capacity, then automatic overwriting, except segments needed for specific incident investigations.
For biometric data, retention is tightly tied to employment relations: when employees leave, biometric templates for attendance lose their purpose and must be deleted as required by point c Clause 2 Article 25. Companies need biometric template deletion procedures in offboarding, including deletion on terminal devices and central servers if any.
Technical and organisational security for camera and biometric data
Technically: encrypt biometric data both in storage and transmission; do not store original fingerprint or face images when one-way encrypted feature templates suffice; grant camera system access rights under the minimum principle; log every access and extraction.
Organisationally: limit the number of people authorised to view and extract data; define extraction approval procedures; train operating personnel on security; and have response plans when unauthorised access to biometric data storage systems is detected.
Data subjects’ rights over their images
People recorded by company cameras have full data subject rights: the right to know they are being recorded, the right to request copies of their images, the right to request deletion when no longer needed. Companies need procedures to receive and handle these requests, with timelines under Decree 356/2025/ND-CP: respond within 02 working days, provide data within 10 days.
In practice, the most common requests are camera extracts when property losses, parking lot collisions or disputes occur. Companies need procedures to verify requesters’ identities and blur images of unrelated persons before providing, to avoid violating others’ rights while fulfilling one person’s rights.
Risks and sanctions for camera and biometric violations
Typical risks: collecting biometrics from thousands of employees without separate written consent; permanently storing fingerprint and face templates even years after employees left; using security camera images to discipline employees when the original installation purpose was only asset protection; camera systems with too many uncontrolled accessors; solution providers storing data on their servers without data processing agreements.
On sanctions, sensitive data violations may be subject to higher administrative fines than ordinary violations, with companies required to remedy consequences like deleting illegally collected data. When biometric data leaks occur, companies also face damages liability to affected persons. Notably, companies’ data protection personnel will be the focal point explaining to authorities during inspections (see sensitive personal data processing).
How FLAT LAW FIRM supports companies
FLAT LAW FIRM supports companies in comprehensively reviewing camera and biometric systems: assessing the legality of current collection; drafting camera policies, notification documents and biometric data collection consent templates; building data storage, extraction and deletion procedures; reviewing contracts with camera and attendance solution providers on data processing clauses.
We also support preparing impact assessment dossiers for high-risk data processing systems. We work in Vietnamese, Chinese and English. See also employee data processing in companies and the data and technology compliance checklist.
Frequently asked questions
Must fingerprint attendance have employee consent?
Yes. Biometric data is sensitive data, requiring employees’ separate, clear consent, while meeting Clause 3 Article 25 of Law 91/2025/QH15 on monitoring technology. Offer employees alternative attendance methods.
Do office and factory cameras need notification?
Yes. Employees must clearly know about camera systems and consent under Clause 3 Article 25. Companies need visible signs, written camera policies and no image purpose misuse.
How long can camera data be kept before deletion?
Keep only as long as necessary for notified purposes; common practice is 7–30 day rolling overwrite cycles, except segments needed for specific incident investigations.
How are departed employees’ fingerprint and face data handled?
Biometric templates must be deleted upon contract termination under point c Clause 2 Article 25, including on terminal devices and central servers. Include this in offboarding procedures.
What rights do customers recorded by store cameras have?
Customers have the right to know they are being recorded (via signs), the right to request copies and deletion when no longer needed. Companies need procedures to handle these requests on time.
Talk to FLAT LAW FIRM
If your company uses surveillance cameras or biometric attendance and needs compliance review, FLAT LAW FIRM is ready to support in Vietnamese, Chinese and English.
