Client's Question:
Dear Lawyer, under the Personal Data Protection Law 2025, are we still allowed to retain personal data of employees after they leave the company, starting from 2026?

Gattaca Law Firm’s Answer:
Pursuant to the Personal Data Protection Law No. 91/2025/QH15, effective from January 1, 2026, the retention of employees’ personal data after the termination of employment is only permissible when there is a clear legal basis or a valid agreement between the parties. Specifically, Clause 2 and Clause 3 of Article 25 stipulate that such data must be deleted or destroyed upon termination, unless otherwise required by law (e.g., for purposes related to social insurance, tax, dispute resolution, litigation, etc.) or explicitly agreed upon by the employee.

Furthermore, the use of technological tools for surveillance such as GPS, CCTV, biometric systems, or time-tracking software is only lawful if the employee is fully informed and has given explicit consent. The collected data may only be used for the specific purposes previously disclosed, and any unauthorized use without employee consent is strictly prohibited.

Therefore, starting now, enterprises must review their entire process of collecting, processing, and storing employees’ personal data — both during the period of employment and after termination — to ensure compliance with legal requirements. In particular, businesses should pay close attention to amending the relevant provisions of employment contracts concerning personal data protection to meet the new statutory obligations.

Anh Tuan

_____________________________

GATTACA LAW FIRM | Trusted Legal Partner

M: + 84 901763379 | W: gattacalaw.vn | E: lawyer@gattacalaw.vn