Guide · Data protection
Employee data protection in Vietnam.
What the 2026 Personal Data Protection Law means for payroll, HR records and sending employee data abroad.
Updated 22 October 2026 · General information, not legal or tax advice
Short answer
How does Vietnam's data protection law affect HR data?
Since 1 January 2026, Vietnam's Personal Data Protection Law (Law 91/2025/QH15) and Decree 356/2025/ND-CP govern how employers handle employee personal data. Processing needs a clear notice to the employee and a lawful basis, usually consent or a legal obligation such as payroll and insurance filings. Sensitive data, including health records, needs extra care. Sending Vietnamese personal data abroad — for example payroll reports to a head office — generally requires a cross-border transfer impact assessment filed with the Ministry of Public Security within 60 days of the first transfer, although Decree 356/2025 exempts some transfers made to manage employees within a group. The law also reaches foreign companies that receive data about Vietnamese citizens. Penalties for cross-border transfer violations can reach 5% of the offender's prior-year revenue.
Employer duties
What the law asks of employers.
| Duty | In practice |
|---|---|
| Notice and lawful basis | Tell employees what is collected, why and who receives it |
| Minimisation | Collect only what the job, payroll and filings need |
| Sensitive data | Keep health and similar data separate, with restricted access |
| Cross-border transfer | Impact assessment filed within 60 days of the first transfer, unless an exemption applies |
| Rights requests | Let employees access, correct and, where lawful, delete their data |
| Retention | Keep records only as long as law and purpose require |
With an EOR
How Nhân Kiệt handles your team's data.
As the employer, Nhân Kiệt collects only the data each role and payroll need, keeps health information separate from payroll records, documents every flow of data to you, and returns or deletes records when employment ends. Employee documents are exchanged through our portal rather than by email. The conditions of the group-employee exemption must be checked case by case, so we confirm the position for your data flows in writing.
Sources: Law on Personal Data Protection (Law 91/2025/QH15), in force from 1 January 2026; Decree 356/2025/ND-CP.
Questions
Employee data protection: frequently asked questions
When did Vietnam's Personal Data Protection Law take effect?
On 1 January 2026, together with Decree 356/2025/ND-CP.
Can employee data be sent to a head office abroad?
Yes, but a cross-border transfer impact assessment is generally needed within 60 days of the first transfer, unless an exemption such as group employee management applies.
What are the penalties for breaching the data law?
Cross-border transfer violations can be fined up to 5% of the offender's prior-year revenue.
Does the law apply to foreign companies?
Yes. It reaches foreign companies that process or receive personal data of Vietnamese citizens.
Hiring in Vietnam? We handle all of this as your employer.
Nhân Kiệt employs your team, runs payroll, insurance, tax and work permits. Fee: US$99–199 per employee a month, plus VAT.
Request a quote