Starting January 1, 2026: Employers are legally required to delete personal data of employees upon termination of employment

Under the 2025 Personal Data Protection Law (PDPL), effective from January 1, 2026, all organizations—especially employers—are legally required to delete, destroy, or anonymize personal data of employees upon termination of employment, if there is no longer a lawful purpose for retaining such data. This marks a significant step forward in safeguarding privacy and enhancing legal accountability in human resource management.

1. Legal Basis

2025 Personal Data Protection Law, effective from January 1, 2026

– Article 3: Sets out key principles of personal data protection, including transparency, accuracy, confidentiality, and compliance with the law.

– Clause 1, Article 25: Requires deletion of personal data of job applicants who are not hired.

– Clause 2, Article 25: Establishes the obligation to delete personal data of employees upon termination of employment.

2. Types of Data Subject to Deletion or Anonymization:

Employers must review and process the following categories of data after an employee leaves:

– Identification data: Full name, date of birth, national ID, social insurance number

– Contact information: Phone number, email, residential address

– Financial data: Tax code, bank account details

– Health records and biometric data (if collected)

– Employment records: Labor contracts, payroll, performance evaluations, disciplinary or reward decisions

– Data stored in HRM systems, company email, and internal platforms

3. Employer Obligations Upon Termination:

According to Clause 2, Article 25, employers must delete or destroy personal data of former employees unless:

– There is a clear legal exception

– A mutual agreement allows continued retention This includes HR files, contracts, contact details, images, biometric data, and more.

 Employers must:

– Audit all data related to former employees

– Establish compliant data deletion protocols

– Retain data only within the legally permitted timeframe or under valid agreements

4. Data of Unsuccessful Job Applicants Must Be Deleted:

According to Clause 1, Article 25 requires employers to delete all collected data of job applicants who are not hired, unless a separate agreement is in place.

 Key Notes:

– Collect data solely for recruitment purposes

– Obtain explicit consent before processing applicant data

– Do not retain applicant data without a clear agreement

5. Legal Risks of Non-Compliance:

Failure to comply may result in serious consequences:

– Administrative penalties under cybersecurity and data protection laws

– Civil liability for damages caused to individuals

– Criminal prosecution in severe cases

– Reputational damage affecting recruitment, internal trust, and HR governance

6. What Should Businesses Do Now?

– Audit existing data of former employees and rejected applicants

– Establish clear protocols for deletion, destruction, or anonymization

– Update internal documents: labor contracts, recruitment forms, HR policies

– Train HR, legal, and IT teams on data protection regulations

– Invest in secure data systems with automated deletion alerts and compliance tracking

7. Exceptions to Data Deletion:

Employers may retain personal data post-termination only if:

– There is a clear agreement with the employee

– Sector-specific laws require retention (e.g., labor inspections, audits, tax compliance)

– Retention serves to protect the employer’s legitimate interests (e.g., labor dispute resolution)

 Now is the time for businesses to review their HR data management processes to ensure legal compliance and protect employee rights.

8. How LTS LAW Can Help:

At LTS LAW, we offer end-to-end legal services to help businesses comply with the 2025 PDPL:

– Drafting internal data processing protocols

– Reviewing and updating employment contracts and recruitment templates

– Advising on internal data protection policies

– Conducting staff training and preparing for inspections

We don’t just help you comply—we help you proactively protect your business from legal risks.

LTS LAW – Dedicated Legal Support in Ho Chi Minh City

LTS LAW specializes in legal consulting for individuals and businesses, including company formation, licensing, foreign investment, contract drafting, and dispute resolution.

 Office Address: 520 Cach Mang Thang Tam Street, Nhieu Loc Ward, Ho Chi Minh City 

 Hotline/Zalo: +84 902 798 066 / +84 965 000 524 

 Website: https://lts.com.vn

Contact LTS LAW for tailored legal advice that fits your business needs.