LEGAL RISKS OF RETAINING PERSONAL DATA OF UNSUCCESSFUL JOB APPLICANTS

In recruitment practice, many companies routinely retain applicants’ CVs, contact details, academic qualifications, salary histories and interview assessments for use in future recruitment exercises. However, companies may be unaware that retaining the personal data of unsuccessful applicants without their consent or an appropriate agreement may constitute a violation of personal data protection laws.
As of 1 January 2026, such violations may be subject to administrative fines of up to 50 million VND under the new legal framework.
1. Common Types of Violations
1.1. Processing Personal Data Without Consent
Under Clause 6, Article 2 of the Law on Personal Data Protection No. 91/2025/QH15, personal data processing refers to operations performed on personal data, including collection, analysis, aggregation, encryption, decryption, modification, erasure, destruction, de-identification, provision, disclosure, transfer and other operations affecting personal data.
Pursuant to Point c, Clause 1, Article 61 of Decree No. 330/2026/ND-CP, processing the personal data of job applicants without their consent, or processing such data beyond the scope or purposes to which they have consented, is subject to a fine ranging from VND 20 million to VND 50 million.
This provision applies to recruitment activities in which a company collects, retains, uses or otherwise processes applicants’ personal data without their consent, or processes such data inconsistently with the agreed scope and purposes.
Applicants’ personal data may include their full names, contact details, professional qualifications, educational backgrounds, employment histories, CVs and other information collected during the recruitment process. Companies should ensure that such data is processed only to the extent necessary for recruitment purposes or in accordance with the scope and purposes to which the applicants have consented.
1.2. Failure to Delete or Destroy Personal Data Where an Applicant Is Not Hired
Under Point d, Clause 1, Article 61 of Decree No. 330/2026/ND-CP, failure to delete or destroy an applicant’s personal data where the applicant is not hired, except where otherwise agreed, is subject to a fine ranging from VND 20 million to VND 50 million.
This provision requires companies to process applicants’ personal data in accordance with the applicable purposes, scope and retention requirements. Where an applicant is unsuccessful, the company must delete or destroy the personal data collected for recruitment purposes, including CVs, contact details, professional qualifications, employment histories and other related information, unless otherwise agreed with the applicant or retention is otherwise permitted by law.
2. Legal Framework Under the Law on Personal Data Protection 2025
Article 25 of the Law on Personal Data Protection 2025 specifically sets out employers’ responsibilities for protecting personal data in recruitment. In particular:

• Companies may only request information relevant to recruitment purposes and in compliance with applicable laws.

• Information provided by applicants may only be used for recruitment purposes and other purposes agreed upon by the parties, provided that such purposes comply with applicable laws.

• Applicants’ information must be processed in accordance with the law and with their consent.

• Where an applicant is not hired, the information provided by that applicant must be deleted or destroyed, unless otherwise agreed with the applicant.

Furthermore, Article 14 of the Law on Personal Data Protection 2025 provides for the deletion or destruction of personal data once the purpose of processing has been fulfilled. Accordingly, where an applicant is unsuccessful and the recruitment purpose has been fulfilled, the relevant personal data must be deleted or destroyed in accordance with the applicable requirements.
3. Legal Consequences Beyond Administrative Fines
In addition to administrative fines, violating companies may be subject to remedial measures under Clause 4, Article 61 of Decree No. 330/2026/ND-CP, including an order to delete or destroy unlawfully collected or processed personal data in a manner that renders the data irrecoverable.
Consequently, companies may face not only financial penalties but also mandatory data deletion or destruction measures imposed by the competent authorities. Such measures may disrupt recruitment operations, increase compliance costs and adversely affect the company’s reputation.
4. Recommendations for Companies
First, review existing recruitment procedures. Companies should identify the categories of personal data collected from applicants, the purposes for which such data is processed, the applicable retention periods and the personnel authorised to access it.
Second, establish a clear consent and agreement mechanism for data retention. Where a company intends to retain applicants’ CVs and other personal data for future recruitment opportunities, it should obtain the applicants’ consent and establish a clear agreement specifying the purposes, scope and duration of such retention and subsequent use. Under Article 9 of the Law on Personal Data Protection 2025, silence or failure to respond does not constitute consent.
Third, implement a data deletion procedure. Companies should establish internal procedures to ensure that the personal data of unsuccessful applicants is deleted or destroyed promptly after the recruitment process has concluded, unless continued retention is covered by an applicable agreement or otherwise permitted by law.
Fourth, monitor the retention periods applicable to successful applicants and employees. Under Point a, Clause 2, Article 61 of Decree No. 330/2026/ND-CP, retaining employees’ personal data beyond the retention period prescribed by law or the agreed retention period is subject to a fine ranging from VND 50 million to VND 70 million.
Companies should therefore establish clear data retention schedules and review mechanisms to ensure that personal data is not retained longer than legally permitted or agreed upon.