Retention Obligations and Storage Periods for HR Records Ahead of the Personal Data Protection Law: Practical Steps Required from 2026 Onward
Attorney admitted in Vietnam
NEXORA LAW FIRM, Managing Partner
Attorney admitted in Vietnam
Mediator, Bankruptcy Trustee, Outside Statutory Auditor
Table of Contents
01 - Retention Periods for HR Records (Statutory Retention Terms)
02 - New Rules on Deletion and Disposal of Personal Data of Former Employees and Job Applicants
03 - Practical Responses and Recommended Solutions for Companies
Under Vietnam's Personal Data Protection Law, which takes effect on January 1, 2026, companies will be subject to new obligations concerning the collection, retention, and deletion of employee information. This article explains the retention periods for HR records and the practical steps required in response.
Today, the retention and management of former employees' records is no longer merely an administrative obligation — it has become an important part of legal risk management, information security, and compliance. In particular, the 2025 Personal Data Protection Law (effective January 1, 2026) introduces new obligations concerning the "collection, retention, use, deletion, and disposal" of personal information, and companies will need to fundamentally review their employee data management systems.
This article organizes the retention periods, disposal timing, and direction of digitization for HR records under Vietnam's current legislation, and explains the practical points to note in preparing for future legal compliance.
01 - Retention Periods for HR Records (Statutory Retention Terms)
Appendix I to Circular No. 10/2022/TT-BNV of the Ministry of Home Affairs of Vietnam clearly sets out the retention periods for employee-related records maintained by companies.
Type of Document
Retention Period
Records relating to recruitment, transfer, reassignment, change of duties, and disciplinary action
20 years
Records relating to resignation/termination procedures
20 years
Employees' basic information (resumes, educational certificates, employment decisions, copies of ID cards/passports, etc.)
70 years
Documents responding to matters concerning employee treatment/benefit schemes
10 years
Accordingly, documents relating to resignation, transfer, disciplinary action, and the like may be disposed of 20 years after the employee's departure, whereas an employee's basic records (the personnel file, copies of identification documents, etc.) must be retained for 70 years.
Companies are required to set a retention schedule for each type of document and to optimize the balance between disposal, digitization, and continued storage.
● Retention Period for Labor Contracts ●
Under Circular No. 10/2022/TT-BNV, Appendix I (Section 3.2, Item 41), labor contracts (fixed-term, indefinite-term, seasonal, or under 12 months) fall within the category of "documents relating to recruitment, transfer, change of duties, secondment, disciplinary action, etc." The retention period for these types of labor contracts is 20 years.
02 - New Rules on Deletion and Disposal of Personal Data of Former Employees and Job Applicants
(Effective January 1, 2026: Personal Data Protection Law 2025)
Under Vietnam's Personal Data Protection Law 2025, which takes effect on January 1, 2026, companies will be subject to new obligations regarding the collection, retention, use, deletion, and disposal of personal data belonging to employees and job applicants.
With this law taking effect, companies will bear not only the obligation to retain data, but also the responsibility to properly delete and dispose of it.
● What Is Personal Data?
The law defines personal data as follows:
Basic personal data
Information relating to an individual's identity, background, and social relationships, used in ordinary transactions and social life.
Sensitive personal data
Information closely connected with an individual's privacy, the improper use or leakage of which could directly infringe the individual's rights and interests.
Accordingly, the resumes, contracts, application documents, and contact information of employees and job applicants are all treated as "personal data," and companies must establish a management system that complies with the law regarding their collection, retention, deletion, and disposal.
2.1. Company Obligations Concerning Employee Data
Article 25(2) of the Personal Data Protection Law 2025 sets out the following obligations for companies regarding the management of personal data in the employment relationship:
a. Compliance with this law, labor and employment-related laws, and other applicable laws.
b. Employees' personal data may only be retained for the period specified by law or agreed upon between the parties.
c. On termination of the labor contract, personal data must be deleted or disposed of.
Except where retention is permitted by agreement between the employer and employee or by law.
➡ In other words, a company may not retain employee data beyond the statutory period, and in principle must delete or dispose of personal data upon termination of the contract. As an exception, retention for a certain period is permitted only where there is a consent agreement from the individual concerned, or a retention obligation under other laws.
2.2. Obligations Concerning Job Applicant Data
Article 25(1) of the same law provides as follows regarding the handling of personal data in recruitment activities:
a. A company may only request information necessary for recruitment purposes, within the scope permitted by law.
Information obtained may only be used for recruitment purposes or for purposes based on the individual's consent.
b. Information provided must be processed in accordance with the law, and the consent of the applicant concerned must be obtained.
c. Personal information of applicants who are not hired must be deleted or disposed of after the recruitment process ends, unless the individual has consented or a separate agreement provides otherwise.
➡ Accordingly, the information of unsuccessful applicants must be promptly deleted or disposed of once the recruitment process has concluded. Except where the applicant has expressly consented, continuing to retain resumes or contact information may be regarded as unlawful.
● Practical Points to Note
Clearly define the retention deadlines for former-employee and applicant data through internal rules, and share them with each department.
Define the process for deleting/disposing of data (both electronic and paper) and retain records of execution.
Always obtain the individual's written consent before reusing or re-referencing applicant data.
Implement technical measures to address data that may remain in backups or in the cloud even after deletion.
These measures will be among the most important areas of data protection compliance from 2026 onward.
03 - Practical Responses and Recommended Solutions for Companies
Amid growing demands for legal compliance and data security, companies need to build, at an early stage, a system capable of comprehensively managing HR records and personal data from the standpoints of security, efficiency, and legal compliance.
The following are examples of effective practical measures.
① Systematize document classification and retention methods
Classify HR records into clear categories (original documents, labor contracts, resignation-related, disciplinary, etc.) and accurately track their retention deadlines.
Once the retention period has expired, carry out deletion, disposal, or digitization as appropriate.
Establish a document management ledger and introduce a system that allows tracking by person in charge and by year.
② Establish a secure storage environment
Store paper documents in a dedicated storage facility or warehouse with access control.
For electronic data, use secure cloud storage (OneDrive, SharePoint, Google Workspace, etc.) and rigorously configure backups and access permissions.
Regularly review access logs to prevent unauthorized viewing and information leakage.
③ Establish internal rules for the deletion and disposal of personal data
Set out in writing the timing, procedure, and responsible person for deleting/disposing of former employees' data.
Put in place technical and operational processes to prevent "duplicate storage" or "hidden files."
Retain deletion records (logs) to prepare for audits.