Vietnam privacy law requirements during recruitment process

The Law on Personal Data Protection 2025 (Law No. 91/2025/QH15), effective from January 1, 2026, clearly stipulates the responsibilities of agencies, organizations, and individuals in protecting personal data in recruitment and employee management activities. Let’s read into data privacy obligations for HR and recruitment operations with Faro Vietnam.

1.  New data protection rules for collecting candidate information

According to Article 25 of the Law on Personal Data Protection 2025, during the recruitment process, employers may only request candidates to provide information that is truly necessary, serves the purpose of recruitment, and is in accordance with the law.

This information may only be used for recruitment purposes or other purposes if there is a legal agreement with the applicant.

The processing of applicant information must comply with the law on legal compliance for storing applicant personal data and must have the consent of the applicant.

Specifically, in cases where recruitment is not completed, the recruiting agency, organization, or individual is responsible for deleting and destroying all collected information of the applicant, unless otherwise agreed upon by the parties.

Regarding the management and employment phase of employees, the Law requires employers to fully comply with the provisions of the Law on Personal Data Protection, labor and employment laws, and other relevant regulations.

Employee personal data may only be stored for the period prescribed by law or by agreement. Upon termination of the employment contract, the employee's personal data must be deleted and destroyed, unless otherwise stipulated by law or agreement.

Furthermore, the processing of employee personal data collected through technological and technical means may only be carried out in accordance with legal regulations, ensuring the rights and interests of the employee, and the employee must be fully informed about these methods.

The processing and use of personal data collected through illegal means is strictly prohibited.
 

Personal data decree implications for hiring activities

2. Penalties for Violations of Personal Data Protection Regulations

The Law on Public Health has stipulated a comprehensive system of sanctions for violations of regulations on the processing of personal data. Depending on the nature and severity of the violation, organizations and individuals may be subject to administrative penalties, criminal prosecution, and compensation for damages (if any).

The maximum administrative penalties for organizations are specifically stipulated as follows:

(i) Violations of regulations on cross-border data transfer: maximum penalty equal to 5% of the revenue of the immediately preceding year. In cases where there is no revenue or the penalty calculated based on revenue is lower than the ceiling of 3 billion VND, the maximum penalty is 3 billion VND.

(ii) Buying and selling personal data: maximum penalty equal to 10 times the revenue from the violation. If there is no revenue or the penalty calculated based on revenue is lower than the ceiling of 3 billion VND, the maximum penalty is 3 billion VND.

(iii) Other violations: the maximum fine is VND 3 billion.

The maximum administrative fine for individual violations will be half the fine for organizations.
 

Data privacy obligations for HR and recruitment service operations

3. Updated regulations for handling employee information securely

The legal compliance for storing applicant personal data clearly stipulates the scope, purpose of collection, and retention period of personal data collected from candidates during the recruitment process. Accordingly, businesses are only allowed to request information for recruitment purposes; the information provided may only be used for recruitment purposes and other purposes as agreed upon in accordance with the law. Unless otherwise agreed, businesses must delete or destroy the information provided by the applicant if they are not hired. Therefore, if a company needs to retain candidate information for future recruitment purposes, it must obtain the candidate's consent.

Regarding personal data decree implications for hiring activities, it must be deleted or destroyed upon termination of the contract, except in cases where otherwise stipulated by agreement or law. Since current laws do not specify a time limit for storing employees' personal data, to protect the legitimate rights of employers (e.g., for resolving labor disputes, tax audits and inspections, and other legal obligations), businesses should clearly agree with employees on the type of data to be stored, the purpose of storage, and the storage period at the time of termination of the employment contract.

If you require further information or more in-depth legal assistance for your specific situation, please contact us.

>>>Read more: When do businesses need Employee Self-Service (ESS)?

Faro Vietnam
Email: service@farovietnam.com.vn
HANOI HEAD OFFICE

• Tel: + 84 24 3974 3091

HO CHI MINH CITY OFFICE

• Tel: + 84 28 3821 4654

Grow your business with our trusted Human Resource Solutions.