Businesses mandated to delete former employees’ personal data

New law prohibits selling personal health data to insurance companies, bans social media platforms from requiring ID for account verification, and mandates businesses to delete former employees’ personal data.

These are among the new provisions of the Personal Data Protection Law, passed by the National Assembly on 26/6/2025. The law, effective from 1/1/2026, is Vietnam's first legislation dedicated to personal data protection. Previously, this area was only governed by Decree 13/2023/ND-CP.

The law comprises five chapters and 39 articles, featuring a broader scope, stricter penalties, and an independent oversight mechanism. Notably, it dedicates a section to protecting personal data within businesses and banks across five key areas of life: recruitment, management, and employment of workers; insurance; finance, banking, and credit information; advertising, social media, and online media services.

Companies must delete former employees’ data.

In recruitment, management, and employment, the Personal Data Protection Law stipulates that businesses may only request information relevant to the recruitment process, in accordance with legal regulations.

This information can only be used and processed for recruitment purposes and other purposes if agreed upon in accordance with the law and with the candidate’s consent.

If a candidate is not hired, the business must delete the candidate's provided information unless otherwise agreed.

Workers at the 29/3 Textile and Garment Joint Stock Company, Da Nang. Photo: Nguyen Dong

Workers at the 29/3 Textile and Garment Joint Stock Company, Da Nang. Photo: Nguyen Dong

During employment, if a company processes personal data collected through technological means, employees must be informed.

Businesses are also obligated to delete employee data upon termination of the employment contract.

The law prohibits selling personal health data to insurance companies.

For the first time, the law addresses personal health data protection within insurance operations. The collection and processing of personal health data require the subject’s consent. Healthcare organizations and individuals cannot share personal data with third-party healthcare or insurance providers (health, life) unless the individual provides written consent.

Reinsurance companies sharing customer data with partners must specify this in their customer contracts.

According to Ministry of Finance statistics from late 2024, Vietnam's insurance market has 85 operating businesses. This includes 19 life insurance companies with 11.7 million active contracts. Over 95.5 million people, covering over 94% of the population, participate in health insurance, while nearly 18.6 million are enrolled in social insurance.

Social media platforms are prohibited from using ID for account verification.

Social media and online media providers must clearly inform users about the personal data collected during service installation and use. Beyond the disclosed and agreed-upon information, unauthorized collection of personal data is prohibited. These platforms cannot require users to provide photos or videos of identification documents for account verification. The law also prohibits eavesdropping, call recording, and reading text messages without user consent.

The average Vietnamese person has three social media accounts (domestic and international), spending about 2 hours and 30 minutes on them daily. Photo: Thanh Nguyen

The average Vietnamese person has three social media accounts (domestic and international), spending about 2 hours and 30 minutes on them daily. Photo: Thanh Nguyen

Online, users have the right to access, edit, delete, and set privacy settings for their personal data, as well as report privacy and security violations.

Lawyer Vu Tien Vinh (Bao An Law Firm, Hanoi) noted that the current definition of "identification documents" is incomplete. In practice, it refers to photo-bearing documents issued by competent authorities, such as citizen identity cards, passports, and travel documents. In some cases, it also includes photo IDs issued by competent authorities that are still valid and can replace standard identification, such as Party membership cards, driver’s licenses, press cards, and identification for armed forces.

The Personal Data Protection Law was drafted by the Ministry of Public Security due to the alarming rise in large-scale personal data trafficking. Several operations involving the illegal collection and trade of thousands of GB of data have been uncovered recently.

Leaked information has included customer data from banks, student and parent data from schools, business registration information, government personnel data, and customer data from sectors like real estate, electronics, dentistry, and cosmetic surgery.

Banks are prohibited from using personal data for credit scoring and ranking.

Article 27 stipulates that organizations and individuals in finance, banking, and credit information are prohibited from using customer credit information for scoring, ranking, or assessing creditworthiness without the customer's consent, in addition to their responsibility to comply with regulations on sensitive personal data protection.

They must implement measures to prevent unauthorized access, use, disclosure, and modification of customer data. In case of data breaches or loss, banks must notify customers and implement recovery solutions.

Lawyer Vu Tien Vinh (Bao An Law Firm, Hanoi) praised the new regulations as progressive, clearly establishing employer responsibilities. Without these, employee information could be leaked intentionally or unintentionally, with little accountability for employers. For instance, a candidate’s proposed salary, resume, or previous work experience are sensitive details most employees, especially those in senior positions, wish to keep confidential. Unauthorized use of this information could have severe consequences.

With the new law, candidates and employees can demand remedies, compensation, and even legal action if businesses violate data privacy obligations.

"The law elevates employer responsibility and raises candidate awareness about providing personal information," Vinh assessed.