Personnel Data After Termination of Employment: May Enterprises Continue to Retain It?

In the context of the digital economy, the processing of employees’ personal data after the termination of an employment relationship is raising a number of new legal issues for enterprises. The 2025 Law on Personal Data Protection (Law No. 91/2025/QH15), which took effect on January 1, 2026, has established a more specific legal framework concerning rights and obligations in the processing of personal data.

This places enterprises under the requirement to review how they store, use, and delete employees’ data after their employment ends.

For enterprises, the issue is not simply whether the data must be deleted, but also which data must be deleted, which data may continue to be retained, and in what circumstances an enterprise may refuse an employee’s request to delete data after the employee has left the company. The following are the legal issues that enterprises should pay attention to when processing personnel data after the termination of an employment relationship.

1. Under the regulations, the general principle is that data must be deleted or erased upon termination of the employment contract

     Under Point c, Clause 2, Article 25 of the 2025 Law on Personal Data Protection, enterprises are responsible for deleting or erasing employees’ personal data upon termination of the employment contract. This provision indicates that an employee’s departure from the company not only terminates the employment relationship but also imposes a requirement on the enterprise to review and process the personal data collected during the recruitment, management, and employment of the employee.

     This provision is also consistent with the principles of personal data processing under Article 14 of the Law. Accordingly, personal data must be deleted or destroyed once the processing purpose has been fulfilled or the prescribed retention period has expired. The retention period may not be extended arbitrarily but must be appropriate to the original purpose of data processing.

     Therefore, an enterprise may not automatically continue to retain all personnel records and personal information of an employee after the employee leaves merely on the ground that such information may be “needed for future use.” Continued retention must have an appropriate legal basis.

2. When may an enterprise continue to retain data?

     Although the general principle is that data must be deleted or destroyed upon termination of the employment contract, the law also provides for certain exceptions under which enterprises may continue to retain personal data.

    First, an enterprise may continue to retain data if there is another clear agreement with the employee in writing. Such retention should be based on the employee’s voluntary, clear, and verifiable consent. For example, an employee may consent to the enterprise retaining their contact information for the purpose of maintaining an alumni network or retaining their profile in a candidate pool for recruitment to future positions.

   Second, an enterprise may continue to retain data where the law provides otherwise regarding the retention period. In practice, certain types of records relating to salaries, taxes, social insurance, accounting, or other legal obligations may be required to be retained for a specified period. In such cases, the enterprise may continue to retain the data within the scope and for the period required by law.

    It should be noted that the fact that data is permitted to be retained does not mean that the enterprise may continue to use such data for any purpose. The enterprise must still ensure that the data is processed only to the extent necessary and in accordance with the corresponding legal basis.

3. What should enterprises do when an employee leaves?

    To minimize compliance risks, enterprises should incorporate personal data processing as an official step in the off-boarding process, rather than focusing solely on the handover of work, assets, and the employee’s entitlements.

    First, enterprises should establish a data review procedure upon termination of the employment contract, clearly identifying which types of data must be deleted, which types of data need to be retained, and the legal basis for such retention. Where an enterprise wishes to continue using an employee’s information for new purposes, such as future recruitment or maintaining contact, the employee’s appropriate consent should be obtained.

    In addition, enterprises should classify data instead of applying a single method of processing to all personnel records. Data that must be retained under specialized legislation should be separated from data for which there is no longer a processing purpose, such as certain personal contact information, images, or information about the employee’s relatives.

     Finally, when deleting or destroying data – both on software systems and in physical paper records – enterprises must apply necessary security measures to ensure that the information cannot be accessed or recovered without authorization.