The personal phone is a quiet friction point in almost every plant and office: management wants an outright ban to protect productivity and secrets, while employees see the device as private property and a personal lifeline. The law gives companies considerable room to set rules — but those rules only have teeth when they are built and enforced the right way.
Banning or restricting phones: allowed, if the regulations say so
Workplace order and the protection of assets and business secrets are two core content groups of the internal labour regulations under clause 2, Article 118 of the 2019 Labour Code — and rules on personal devices sit squarely inside them. A company may legitimately prescribe: no phones inside sensitive production zones or clean rooms; phones deposited in personal lockers during shifts; phone use only during breaks in designated areas; and no photographing or filming of documents or lines without permission.
For such rules to support sanctions they must appear in duly issued and registered internal labour regulations (or in the labour contract at sub-ten-employee companies), with a corresponding sanction level for each act. A supervisor’s verbal announcement or a notice pinned to the workshop wall creates no disciplinary basis. Sanctions must still climb the four-step ladder of Article 124 and respect Article 127: no fines, no wage deductions, and never confiscation of the employee’s phone — the company may only require storage as prescribed; personal property is not an enforcement tool.
Social media and speaking about the company
Social media conduct splits into two layers. The first layer is the employment relationship: posting internal images or documents that leak business or technological secrets is disciplinable under the regulations, and where serious damage results it reaches the Article 125 dismissal ground; leaking secrets also triggers compensation liability. The second layer sits outside employment: false information harming the company may be handled under cybersecurity and civil law, independently of internal discipline.
The line a company must not cross: the regulations cannot ban employees from expressing personal views outside working hours on matters unrelated to the company’s secrets and demonstrable reputation. A sweeping clause like “no bad-mouthing the company on social media”, with no defined acts, is very weak when challenged — prescribe precisely instead: disclosing classified documents, using internal images without permission, impersonating the company in public statements.
Electronic monitoring: cameras, software and personal data
Some companies want to move from banning to monitoring: workplace cameras, tracking software on company computers, device checks at gates. These measures touch personal data protection law — the current framework of the Personal Data Protection Law 91/2025/QH15 and Decree 356/2025/ND-CP (which replaced Decree 13/2023/ND-CP). The through-line: processing employees’ personal data needs a lawful basis, clear notice of purpose, scope and retention, and collection no broader than the notified purpose.
Safe practice includes: writing the monitoring policy into the regulations and notifying employees; cameras only in common work areas, never in private spaces; company-issued devices and accounts may carry an inspection right as prescribed, while personal data on the employee’s own device sits beyond the company’s lawful reach. Covert, unannounced monitoring is the fastest way to turn a justified disciplinary case into the company’s own personal-data violation.
Frequently Asked Questions
Can phones be banned during work?
Yes, provided the rule sits in duly issued and registered internal labour regulations (or in the labour contract at companies under ten staff): no phones in sensitive zones, locker deposit during shifts, break-time use in designated areas, no unauthorised filming. Verbal rules or wall posters create no disciplinary basis.
What discipline applies?
The Article 124 ladder of the 2019 Labour Code, scaled by gravity and repetition: reprimand, wage-raise deferral, demotion; only leaking secrets with serious damage reaches the Article 125 dismissal ground. Fines and wage deductions are banned (Article 127), and an employee’s personal phone may never be confiscated.
How should confidentiality be framed?
List concrete acts in the regulations: disclosing classified documents, using internal images without permission, speaking in the company’s name without authority. Posting that leaks business or technological secrets is disciplinable and may trigger compensation; false information is separately actionable under cybersecurity and civil law.
What are the monitoring limits?
Cameras and monitoring software must comply with the Personal Data Protection Law 91/2025/QH15 and Decree 356/2025/ND-CP: a lawful basis, notified purpose and scope, no coverage of private areas, and no intrusion into data on personal devices. The monitoring policy should be written into the regulations and openly communicated.
This article has been quality-reviewed by the FLAW AI Legal Council