Responsibility for protecting personal data in recruiting and managing workers

The Lao Dong Newspaper Legal Consulting Office replied:

Article 25 of the Law on Personal Data Protection 2025 (effective from January 1, 2026) stipulates the protection of personal data in recruiting, managing and using workers as follows:

1. The responsibility to protect personal data of agencies, organizations and individuals in labor recruitment is stipulated as follows:

a) Only required to provide information for recruitment purposes of recruiting agencies, organizations and individuals in accordance with the provisions of law; the information provided shall only be used for recruitment purposes and other purposes according to the agreement in accordance with the provisions of law;

b) The information provided must be processed in accordance with the provisions of law and must have the consent of the candidate;

c) Must delete or cancel the information provided by the candidate in case of non-recruitment, except in cases where there is another agreement with the candidate;

2. The responsibility to protect personal data of agencies, organizations and individuals in the management and use of employees is stipulated as follows:

a) Comply with the provisions of this Law, the law on labor, employment, the law on data and other relevant legal provisions;

b) Personal data of employees must be stored within the prescribed time limit by law or by agreement;

c) The personal data of the employee must be deleted or destroyed upon termination of the contract, except in cases where otherwise agreed or prescribed by law.

3. The processing of personal data of employees collected by technological and technical measures in employee management is regulated as follows:

a) Only technological and technical measures in accordance with legal regulations and ensuring the rights and interests of personal data subjects are applied, on the basis that employees are aware of those measures;

b) Not to process or use personal data collected from technological and technical measures contrary to the provisions of law.

Thus, from January 1, 2026, the responsibility for protecting personal data in recruiting and managing workers is as above.

See the original here