Companies face significant penalties, up to 70 million dong, if they fail to delete former employees' personal data after employment termination, as stipulated by new regulations taking effect from 19/8/2026. This legal requirement aims to protect individuals' privacy and prevent misuse of sensitive information.

According to point c, clause 2, Article 25 of the Law on Personal Data Protection 2025, employers are mandated to delete or destroy former employees' personal data upon contract termination, unless otherwise agreed upon or specified by law. This legal provision underscores the importance of data privacy in the workplace.

Non-compliance with this regulation carries substantial financial repercussions. Point b, clause 2, Article 61 of Decree 330/2026/ND-CP, effective from 19/8/2026, states that employers failing to delete or destroy personal data of employees after contract termination, without a specific agreement or legal exemption, will be fined between 50 million dong and 70 million dong.

This means that if a company retains an employee's personal data after their departure, without a mutual agreement, it will be subject to the penalties outlined above. Therefore, companies must ensure their data retention policies align with these new legal frameworks to avoid fines.

An employee, Duc Thanh, recently shared their concern after working for a private company for nearly 5 years. During their employment, the company collected and stored extensive personal information, including: a copy of their citizen identification card, permanent address, phone number, email, bank account details for salary payments, tax identification number, social insurance information, health records, and other documents in their personnel file. After formally resigning and completing handover procedures, Duc Thanh remains worried about how this information will be handled and fears it might be misused or disclosed.

In situations where an employment contract has ended but related matters or benefits between the employee and the company are still pending, such as social insurance procedures or post-employment support, both parties should formalize an agreement. This written agreement should specify that the employee consents to the employer temporarily retaining certain necessary personal information for a defined period, solely to finalize procedures and ensure full settlement of benefits.

Furthermore, the fine ranging from 50 million dong to 70 million dong also applies to the following violations:

• Storing employees' personal data beyond the legally prescribed or mutually agreed-upon duration.
• Using technology to collect employees' personal data without ensuring the employee is fully aware of such measures. This includes installing tracking software, surveillance cameras, or other data collection devices in the workplace without informing employees.
• Implementing technological or technical measures to collect employees' personal data that are not compliant with legal regulations or that infringe upon employees' legitimate rights and interests.

_Lawyer Pham Thanh Huu_

_Ho Chi Minh City Bar Association_