Almost every factory in Vietnam runs two systems that process sensitive personal data without anyone noticing: surveillance cameras recording workers all day, and fingerprint or face-recognition timekeeping. From 1 January 2026, Personal Data Protection Law 91/2025/QH15 puts both systems under a clear compliance regime — and the most common mistake is treating timekeeping data as “internal operational data” outside the law.
Governing Instruments
Two systems, two data types, one duty framework
Biometric data — fingerprints and faces used to identify a specific individual — is sensitive personal data under Article 2 of Personal Data Protection Law 91/2025/QH15. The consequence: collection and processing must meet the enhanced conditions for the sensitive class, namely clear notice to employees, an identified processing basis, designation of a personal data protection unit and personnel, and commensurate safeguards. Surveillance camera images are also personal data where individuals are identifiable; the factory must give notice of camera areas, monitoring purposes (asset security, workplace safety) and image retention periods.
On processing basis: plant security and timekeeping are legitimate operational needs, but “legitimate” does not mean “no procedure”. Employees must be notified before the biometric system goes live — which system, what data, where stored, for how long, who can access — and for sensitive data the enterprise should obtain the employee’s clear consent, with an alternative method (card, PIN) for those who do not consent, unless another legal basis permits the processing. A consent line buried in the internal labour rules does not meet the separate-consent standard for sensitive data.
Application Analysis
The retention question has no single statutory number for biometric data: the principle under Law 91/2025 is not to keep data longer than the notified purpose requires. Correct operation ties retention to the employment lifecycle — biometric templates are deleted when the employee leaves, raw timekeeping data is kept for the payroll cycle and complaint window, and camera footage runs on a short overwrite cycle (usually measured in weeks) except segments extracted for incident investigation. Access must be role-based: HR sees aggregated timekeeping data, security sees camera images, and raw biometric templates are not opened to line managers; every access to sensitive data must be logged.
The legal boundary for using timekeeping data in discipline sits in two layers. The data layer: processing must stay within the notified purpose — using timekeeping data to verify late arrivals is within labour administration, but using camera images for a purpose remote from the notified security purpose (such as monitoring workers’ private conduct) is processing beyond purpose. The labour layer: discipline must follow the forms and procedure of Labour Code 45/2019/QH14 (Article 124: reprimand; deferral of pay rise for up to six months or demotion; dismissal), while salary deductions are only permitted for compensating damage caused by the employee under Article 102, capped at 30% of monthly salary after social insurance and tax — deducting pay as a punishment for lateness is not permitted, however accurate the timekeeping data is.
Recommended Actions
- Register both systems in the data map and the Article 21 impact assessment file: purpose, data types, retention, access roles, storage location (in-house server or vendor cloud — if offshore cloud, assess Article 20 as well).
- Issue a dedicated biometric-data notice to employees and obtain clear consent; prepare an alternative timekeeping method for non-consenters.
- Fix written retention periods per data type (biometric templates, timekeeping records, camera footage) with automatic deletion at expiry or on termination of employment.
- Set role-based access and enable access logging for sensitive data; designate the data protection function responsible for both systems.
- Review internal labour rules and the disciplinary code: use data only within notified purposes; deduct salary only under Article 102 of the Labour Code.
Frequently Asked Questions
What must a manufacturer using surveillance cameras and biometric timekeeping comply with under Law 91/2025?
Four core duties. First, correct classification: fingerprint and face data is sensitive personal data (Article 2 of Law 91/2025), and camera images are personal data where people are identifiable. Second, notice and basis: notify employees of the system, purpose and retention before it operates, with a clear processing basis for each system. Third, organisation: designate the data protection unit and personnel, and bring both systems into the Article 21 impact assessment file. Fourth, protection: role-based access, access logging, fixed retention periods and deletion when the purpose ends — biometric data must be deleted when the employee leaves.
Must the enterprise notify employees and obtain their consent for face and fingerprint data?
Notice is required in all cases: employees have the right to know which system collects their biometric data, for what purpose, for how long and who may access it. On consent: biometric data is sensitive data, so where consent is the processing basis the enterprise needs the employee’s clear, separate consent — the safe compliance practice is a dedicated written consent form plus an alternative timekeeping method (card, PIN) for those who decline, rather than inferring consent from the labour contract or internal rules. Even where another basis exists (security, workplace safety), the notice duty and the sensitive-data safeguards remain unchanged.
How long may biometric timekeeping data be stored, and who may access it?
Law 91/2025 sets no fixed number of years; the principle is no longer than necessary for the notified purpose. A compliant retention design has three tiers: biometric templates (fingerprints, faces) — kept for the duration of employment and deleted when the employee leaves; detailed timekeeping records — kept for the payroll cycle and the wage-complaint period; aggregated records for final settlement — retained under the labour-records regime. Access is role-based and logged: HR accesses timekeeping data for payroll, security accesses camera images, and raw biometric templates are restricted to system administrators — line managers get no access to employees’ biometric data.
Is it lawful to use biometric timekeeping data for discipline and salary deduction?
The two must be separated. Discipline: timekeeping data may evidence a violation (lateness, absence) if that labour-administration purpose was notified at collection; the ensuing discipline must follow the forms and procedure of Labour Code 45/2019/QH14. But the data may not be used beyond the notified purpose — for example, mining security camera footage to grade everyday work attitude. Salary deduction: deducting pay as a punishment is not permitted; labour law allows deduction only to compensate damage caused by the employee (Article 102 of the Labour Code), capped at 30% of monthly salary after compulsory contributions — accurate timekeeping data does not legitimise a deduction that lacks a legal basis.
