When Must Employers Delete Employees’ Personal Data?
Learn about the new requirements under the 2025 Law on Personal Data Protection regarding the deletion of employees’ personal data upon termination of employment, the deletion of unsuccessful job applicants’ personal data, and the circumstances in which employers are legally permitted to retain such data.
1. What Is Personal Data?
Pursuant to the Law on Personal Data Protection 2025 and Decree No. 356/2025/ND-CP, personal data means digital data or information in any other form that identifies or can identify a specific individual. Personal data comprises basic personal data and sensitive personal data.
1.1. Basic Personal Data
Basic personal data refers to personal information reflecting an individual’s identity and background that is commonly used in social relations and transactions. It includes:
- Full name and any other lawful name (if any);
- Date of birth, date of death or declaration of disappearance;
- Gender;
- Place of birth, place of birth registration, permanent residence, temporary residence, current residence, hometown and contact address;
- Nationality;
- Personal image;
- Telephone number, personal identification number, passport number, driver’s licence number and vehicle registration plate number;
- Marital status;
- Family relationship information (parents, children, spouse);
- Information relating to an individual’s digital accounts; and
- Other information associated with or capable of identifying a specific individual, except for information classified as sensitive personal data.
1.2. Sensitive Personal Data
Sensitive personal data refers to personal data closely connected with an individual’s privacy, the infringement of which may directly affect the lawful rights and interests of agencies, organizations or individuals.
Sensitive personal data includes:
- Information revealing racial or ethnic origin;
- Political opinions, religious beliefs or faith;
- Information relating to private life, personal secrets and family secrets;
- Health information;
- Biometric and genetic data;
- Information relating to a person’s sex life or sexual orientation;
- Criminal records and information on legal violations collected or retained by law enforcement authorities;
- Location data obtained through positioning services;
- Login credentials and passwords for electronic identification accounts; images of identity cards and citizen identity cards;
- Banking usernames and passwords, bank card information, bank account transaction history, financial and credit information, and information concerning financial, securities and insurance transactions held by credit institutions, foreign bank branches, payment intermediaries, securities companies, insurance enterprises and other authorized organizations;
- Data relating to an individual’s activities and behaviour when using telecommunications services, social networks, online communication services and other cyberspace services; and
- Other personal data that is required by law to remain confidential or subject to enhanced security measures.
2. Must an Enterprise Delete All Personal Data When an Employee Leaves?
From 1 January 2026, an enterprise is required to delete or destroy an employee’s personal data upon termination of the employment contract, unless continued retention is permitted by law or agreed by the parties.
Article 25(2) of the Law on Personal Data Protection 2025 provides that employers are responsible for:
- complying with the Law on Personal Data Protection, labour and employment legislation, and other relevant laws;
- retaining employees’ personal data only for the period prescribed by law or agreed by the parties; and
- deleting or destroying employees’ personal data upon termination of the employment contract, unless otherwise agreed or otherwise provided by law.
Accordingly, enterprises must delete or destroy employees’ personal data once the employment relationship ends, except where another legal basis permits continued retention.
Cases Where the Law Permits Continued Retention
Accounting and Tax Laws
Clause 5 Article 41 of the Law on Accounting 2015 requires accounting records to be retained for statutory periods. Accounting vouchers used directly for bookkeeping and preparation of annual financial statements, accounting books and annual financial statements must be retained for at least 10 years, while certain other accounting documents must be retained for at least 5 years.
Labour Laws
The statute of limitations for labour dispute resolution ranges from 6 months, 9 months or 1 year, depending on the nature of the dispute. Employers may therefore need to retain employment records to provide evidence during dispute resolution proceedings.
Accordingly, employment records should generally be retained for at least one year after termination of the employment contract. In addition, records relating to compulsory social insurance, health insurance and unemployment insurance contributions and benefits should continue to be retained to facilitate the protection of employees’ statutory entitlements.
3. Must an Enterprise Delete Applicants’ Personal Data If They Are Not Hired?
Article 25(1) of the Law on Personal Data Protection 2025 provides that, during recruitment, employers:
- may only request information necessary for recruitment purposes in accordance with applicable law;
- may use the information provided solely for recruitment purposes or for other purposes agreed upon in compliance with the law;
- must process applicants’ personal data in accordance with the law and with the applicant’s consent; and
- must delete or destroy the personal data provided by unsuccessful applicants unless otherwise agreed with the applicant.
Accordingly, where an applicant is not recruited, the enterprise is legally required to delete or destroy the applicant’s personal data unless the applicant has agreed that the data may continue to be retained.
DNP VIET NAM LAW FIRM COMPANY LIMITED – DNP VIET NAM LAW FIRM
🏢 5th Floor, No. 52 Nguyen Thi Nhung Street, Van Phuc Urban Area, Hiep Binh Ward, Ho Chi Minh City, Vietnam.
📞 Hotline: +84 987 290 273 (LL.M., Lawyer Dinh Van Tuan).
📩 Email: info@dnp-law.com
Website: https://www.dnp-law.com/en/
