From 2026, businesses must delete personal data when employees quit

According to Clause 2, Article 25 of the Law on Personal Data Protection 2025, No. 91/2025/QH15 (effective from January 1, 2026), stipulating the responsibility to protect personal data of agencies, organizations and individuals in the management and use of employees is stipulated as follows:

- Comply with the provisions of this Law, the law on labor, employment, the law on data and other relevant legal provisions;

- Personal data of employees must be stored within the prescribed time limit by law or by agreement;

- The personal data of the employee must be deleted or destroyed upon termination of the contract, except in cases where otherwise agreed or prescribed by law.

Thus, from 2026, employees who quit their jobs and businesses are also required to delete or cancel their personal data when the contract is terminated.

In addition, according to Clause 3, Article 25 of the Law on Personal Data Protection 2025, which stipulates the processing of personal data of employees collected by technological and technical measures in employee management, it is stipulated as follows:

- Only technological and technical measures in accordance with legal regulations and ensuring the rights and interests of personal data subjects are applied, on the basis that employees are aware of those measures.

- Do not process or use personal data collected from technological and technical measures contrary to the provisions of law.

Thus, during the working process, if the company wants to process personal data of employees collected using technological and technical measures, it must notify employees so that employees are well aware.

See the original here