Image: Laptop with data security icon — Source: Pexels, by Dan Nelson (Pexels License).
HR files are no longer the HR department’s “private property”
A manufacturer with 800 workers keeps all personnel files in one shared spreadsheet: names, ID numbers, addresses, bank accounts, marital status, pre-employment health check results, even disciplinary records. The file travels by internal email, sits on HR staff’s personal computers, with no password. The HR director sees nothing to worry about: “it’s internal data.”
Since 1 January 2026, that mindset is a legal risk. The Law on Personal Data Protection No. 91/2025/QH15 (passed by the National Assembly on 26 June 2025, 5 chapters and 39 articles) has taken effect, establishing Vietnam’s first comprehensive personal-data framework. Alongside it, Decree No. 356/2025/ND-CP (also effective 1 January 2026) provides detailed implementation guidance. Businesses — as processors of hundreds or thousands of employees’ personal data — sit squarely in the regulatory spotlight.
Employee data: what counts as “sensitive”?
The law classifies personal data into basic and sensitive categories. For HR data, many types fall into the sensitive group with heightened protection:
- Health data: recruitment medical results, occupational disease records, sick-leave certificates;
- Biometric data: fingerprints and facial scans used for attendance;
- Socio-political organisation data: union or party membership (where applicable);
- Financial data: salary bank accounts, transaction history (per new guidance);
- Family life data: marital status, spouse and children information (for maternity benefits, dependent deductions).
Notably, the concept of personal data has been broadened compared with the former Decree No. 13/2023/ND-CP (now superseded within the new data-protection framework). Businesses cannot assume “what we have always done is fine.”
Five obligations businesses must implement now
1. A legal basis for every processing activity — starting with consent. All personal-data processing must rest on the data subject’s clear, transparent, and verifiable consent. Long template clauses buried in internal labour regulations or “implied consent” upon hiring no longer suffice. Redesign consent collection: separate, explicit, and purpose-specific (recruitment, payroll, performance review, biometric attendance).
2. Transparent notification. When collecting data, businesses must disclose: what is collected, for what purpose, retention periods, employees’ rights, and contact points. For new hires, this notice should be part of onboarding.
3. Respect data-subject rights. Employees hold rights to be informed, to consent and withdraw consent, to access, rectify, and erase data, to object to processing, and to complain and claim damages. Businesses need procedures to receive and handle such requests within statutory timelines — requests cannot be “received and shelved.”
4. Proportionate security measures. From access controls (not everyone in HR may view full files) and encryption of sensitive data, to incident response procedures (assessment, remediation, notification to competent authorities and affected individuals as required). The shared unprotected spreadsheet in the opening example is the first thing to eliminate.
5. Designate data-protection personnel. Under the implementing guidance, businesses must designate the unit or individuals responsible for personal-data protection, with defined duties and powers. For larger companies, this should be a dedicated focal point — not a nominal side assignment.
HR scenarios that commonly trip up
- Fingerprint/facial attendance: biometric data is sensitive — it needs separate consent and a necessity/proportionality assessment.
- Background checks: collect only what the position genuinely requires, with prior notice.
- Sharing HR data with an overseas parent: cross-border personal-data transfers face dedicated conditions — impact assessments and statutory procedures apply.
- Retaining files of former employees: no indefinite “just in case” retention; set retention periods tied to purpose (tax finalisation, potential disputes) and delete when the purpose ends.
Conclusion
Law 91/2025/QH15 has turned employee data from “internal property” into a legally protected asset with a full system of duties: consent, notification, security, respect for data-subject rights, and accountability. Businesses should start with an “HR data inventory”: what is collected, where it is stored, who can access it, and on what legal basis — then close each gap. Compliance costs today are always cheaper than incident costs tomorrow.
Frequently asked questions
When did the Personal Data Protection Law take effect?
Law No. 91/2025/QH15 was passed on 26 June 2025 and took effect on 1 January 2026. Decree 356/2025/ND-CP guiding its implementation took effect on the same date.
Do employment contracts signed before 2026 need new data-consent clauses?
They should be reviewed and supplemented. Consent under the new law must be clear and purpose-specific; vague blanket clauses in old contracts are unlikely to meet the standard.
Is fingerprint attendance data “sensitive”?
Yes. Biometric data is sensitive personal data, subject to heightened protection and requiring the employee’s separate consent.
Can employees request deletion of their data?
Yes, in statutory cases (e.g., consent withdrawn, data no longer necessary for the collected purpose). Businesses must have procedures to receive and process such requests.
What conditions apply to transferring HR data to an overseas parent?
Cross-border transfers of personal data must meet dedicated statutory conditions, including impact assessments and prescribed procedures. FDI enterprises should pay special attention here.
This article has been quality-reviewed by the FLAW AI Legal Council
