An employee leaves, but their records — ID cards, labor contracts, payroll data, internal email accounts — remain in the company’s systems. From 1 January 2026, the Personal Data Protection Law 91/2025/QH15 sets a clear rule: when the labor contract ends, the data must be deleted and destroyed, unless there is a basis for retention. Here are 5 points for HR and legal teams.
1. The rule: departure means deletion and destruction
Point c, Clause 2, Article 25 of the Personal Data Protection Law 91/2025 provides: upon termination of the labor contract, the organization must delete and destroy the employee’s personal data, unless otherwise agreed by the parties or otherwise provided by law.
This is a default obligation: the business must delete even without waiting for the employee to ask. Keeping records “just in case” with no legal basis is a violation.
2. Delete properly: secure, unrecoverable, including backups
Deletion and destruction must use secure measures that prevent unauthorized recovery of the data (Clauses 3 and 4, Article 14 of Law 91/2025). Removing records from the software interface while they remain intact in the database, or leaving them in backups with no scheduled destruction process, does not satisfy the law’s “delete and destroy” requirement.
In practice: the deletion procedure must cover the primary systems, backup systems, and copies held by third parties (HR service providers, cloud storage).
3. Retention periods must be determined in advance
Point b, Clause 2, Article 25 requires organizations to determine in advance the retention period for employee personal data — based on legal provisions or agreement with the employee. Retention must also follow the purpose-limitation principle (Clause 3, Article 3): once the purpose ends and the period expires, the data must be deleted.
Businesses should include retention periods in their internal personal data protection rules and notify employees from the moment the contract is signed.
4. Retention allowed where sectoral law requires — but cite the specific basis
The exception to the deletion rule is where sectoral law mandates retention — for example, record-keeping duties under tax, accounting or social insurance legislation. In such cases the business may retain data within the scope of that duty, but must cite the specific legal basis for each retained data category.
Note: do not state a specific retention period in years without directly checking the sectoral legal text — each record type has different periods, which may change.
5. Former employees keep the right to withdraw consent and request deletion
Ending the labor contract does not extinguish the data subject’s rights. Departed employees retain the right to withdraw consent and request deletion of their data (Articles 4, 10 and 14 of Law 91/2025). Businesses need a standing receiving channel (email, responsible contact) to handle such requests even after the employee has left.
Frequently asked questions
Can we keep former employee records “in case of a tax audit”?
Yes, if covered by a tax/accounting record-keeping duty — but cite the specific legal basis and keep only within the scope and period the sectoral law requires.
Is deleting the departed employee’s internal email account enough?
Not enough. The deletion duty covers all personal data across primary systems, backup systems, backups and third-party-held data — by secure, unrecoverable means.
Can the business refuse a former employee’s deletion request?
Only with a lawful basis: an agreement with the employee or a legal provision on retention (Point c, Clause 2, Article 25; Article 14).
Sources
- Personal Data Protection Law 91/2025/QH15 — effective 1 January 2026: Article 3.3, Article 4, Article 10, Article 14 (deletion and destruction), Article 18, Article 25 (Clause 2: Point b retention period, Point c deletion upon contract termination), Article 33.2;
- Labor Code 45/2019/QH14.
Conclusion
From 1 January 2026, departed employees’ data is no longer a corporate asset to keep “just in case”: departure means deletion and destruction as the default rule; deletion must be secure, unrecoverable and include backups; retention periods must be determined in advance; retention is allowed only where sectoral law mandates it with a cited basis; and former employees keep the right to withdraw consent and request deletion. Setting up this 5-step procedure now keeps HR compliant without last-minute scrambling.
Does your business need an HR data handling procedure under Law 91/2025? Contact FLAT Law Firm for advice.
For reference only; not legal advice. This content was prepared by AI and will undergo quality review by the AI Legal Council of FLAT Law Firm before any publication consideration; it is not the legal opinion of a licensed human lawyer. Laws and regulations may change; verify the current legal texts before applying them.
