Are businesses required to delete employees' personal data after terminating their contracts?
Mr. A resigned from Company X on November 30, 2025. More than a month later, Mr. A requested that Company X delete all of his personal data (phone number, address, salary history, performance reviews) from the human resources management system. Is Company X obligated to immediately delete all of Mr. A's data as requested? This is a question raised by Mr. Le Nguyen N. (Thai Hoa Ward, Nghe An Province).
ReplyBased on point c, clause 2, Article 25 of the Law on Personal Data Protection 2025, which regulates the protection of personal data in the recruitment, management, and use of employees, the following provisions apply:
1. The responsibilities of agencies, organizations, and individuals in protecting personal data during labor recruitment are stipulated as follows:
a) Information may only be requested for recruitment purposes by the recruiting agency, organization, or individual in accordance with the law; the information provided may only be used for recruitment purposes and other purposes as agreed upon in accordance with the law;
...
2. The responsibilities of agencies, organizations, and individuals in protecting personal data in the management and employment of workers are stipulated as follows:
a) Comply with the provisions of this Law, labor and employment laws, data laws, and other relevant legal provisions;
b) Employees' personal data must be stored for the period prescribed by law or by agreement;
c) Personal data of employees must be deleted or destroyed upon termination of the contract, except in cases where otherwise stipulated by agreement or law.
3. The handling of personal data of employees collected through technological and technical means in employee management is regulated as follows:
a) Only technological and technical measures that comply with legal regulations and ensure the rights and interests of data subjects, on the basis that employees are fully aware of such measures, may be applied;
b) Personal data collected through technological or technical means that violate the law must not be processed or used.
Accordingly, based on the content of the Law on Personal Data Protection 2025, which takes effect from January 1, 2026, businesses (employers) must delete the personal data of employees after the termination of their employment contract, except in cases where otherwise agreed upon or stipulated by law.
