Personal Data in Recruitment and Labor Management What Businesses Need to Note?

In the process of recruitment and human resource management, businesses frequently collect and process various types of personal data of candidates and employees, ranging from information on application dossiers, qualifications, work experience to timekeeping data, performance evaluations, camera footage, or data collected through human resource management software. However, not all businesses are aware that these activities must comply with legal provisions on personal data protection. Requesting candidates to provide excessive information, storing recruitment records indefinitely, or implementing employee monitoring measures without prior notice can all lead to significant legal risks.

What information are businesses permitted to collect during the recruitment process? How should the dossiers of unsuccessful candidates be handled? Are businesses permitted to use cameras, monitoring software, or other technological measures to manage employees? These are issues that businesses need to pay special attention to in the context of increasingly stringent personal data protection requirements.

1. Businesses may only collect necessary information for recruitment purposes

During the recruitment process, recruiting organizations and individuals may only request candidates to provide information necessary for recruitment purposes in accordance with legal provisions. The information provided may only be used for recruitment purposes or other purposes agreed upon by the parties. However, many businesses currently still have the habit of requesting candidates to provide information that is not truly necessary, such as marital status, family planning, information about relatives, or data not directly related to the recruitment position. Businesses need to review their recruitment forms to ensure the principle of minimal collection, limited only to the scope necessary for assessing the candidate’s competence and suitability.

2. Processing of candidate data must be based on the consent of the applicant

Information provided by candidates must be processed in accordance with applicable laws and with the candidate’s consent. The candidate’s consent should not merely be “implied” through the act of submitting an application. Businesses should develop a Personal Data Protection Notice for candidates, clarifying the purpose of collection, scope of processing, retention period, and the candidate’s rights regarding their personal data.

3. Dossiers of unsuccessful candidates must be deleted or destroyed in accordance with regulations

Businesses must delete or destroy the personal data of candidates who are not selected, unless otherwise agreed with the applicant. Storing candidate dossiers for subsequent recruitment rounds is a common business need. However, businesses should only do this with the clear consent of the candidate regarding the duration and purpose of retaining the dossier.

4. Employee personal data may only be stored for an appropriate period

Employee personal data may only be retained for the period prescribed by law or agreed upon by the parties. Businesses need to develop a human resource data retention policy, classifying each data group and determining appropriate retention periods. Indefinite data retention without legal basis can increase compliance risks. For example:

• Social insurance records, records related to employees’ insurance contributions may need to be retained for the period prescribed by specialized laws to serve future benefit settlements.
• Accounting records related to salaries, bonuses, and payments to employees may need to be retained for the period prescribed by accounting laws.
• Timekeeping data and performance evaluation data should be retained for a reasonable period to serve human resource management, resolve complaints or labor disputes (if any).
• Copies of identification documents, emergency contact information, or data necessary for employment administration need to be periodically reviewed to determine if they are still necessary for labor management purposes.
• Data collected from surveillance cameras or technology-based management tools should not be retained for too long if they no longer serve the purpose of ensuring security, safety, or resolving incidents.

5. Personal data must be deleted or destroyed upon termination of employment relationship

Upon termination of the employment relationship, businesses must delete or destroy the personal data of employees, unless otherwise provided by law or agreed upon by the parties. This is often overlooked in practice. Businesses need a process to review data of departing personnel to identify data that needs to be retained according to regulations and data that needs to be deleted to limit potential risks.

• Continued retention: Records related to social insurance, payroll payment vouchers, accounting documents, or necessary records for resolving labor disputes (if any) may continue to be retained for the period prescribed by law.
• To be deleted or destroyed: Data on work email accounts, access rights to internal systems, biometric data used for timekeeping, or information no longer serving labor management purposes after an employee’s departure need to be reviewed for deletion or destruction.
• Specific assessment needed: Performance evaluation records, images from surveillance camera systems, or data collected from internal management tools need to be considered based on the purpose of retention and corresponding legal basis before deciding whether to continue retaining or deleting them.

6. Are businesses allowed to monitor employees using technology?

The processing of data collected through technological tools and monitoring measures used in employee management may only be carried out when employees have been informed and are fully aware of these measures. Businesses are not allowed to process or use collected data contrary to legal provisions and may only apply appropriate measures, ensuring the legitimate rights and interests of employees.

The use of surveillance cameras, performance monitoring software, biometric timekeeping systems, or other management tools is not prohibited. However, businesses need to be transparent about the scope of monitoring, the purpose of data use, and ensure that these measures do not excessively infringe upon employees’ privacy rights.

From practical consulting experience, CDLAF observes that most businesses have established relatively strict recruitment and human resource management processes from a labor law perspective, but have not adequately focused on personal data protection requirements. Meanwhile, candidate and employee data is one of the most frequently processed data groups within businesses. Therefore, reviewing recruitment processes, HR policies, and workforce management tools from a personal data protection perspective should be a key priority within a company’s compliance program.

Time of writing: June 09, 2026

The article contains general information which is of reference value. In case you want to receive legal opinions on issues you need clarification on, please get in touch with our Lawyer  at  info@cdlaf.vn

You can refer for more information:

• Personal Data Transfer under the 2025 Personal Data Protection Law: What Businesses Need to Know
• Personal Data Management On E-commerce Platforms: Legal Framework And Risk Mitigation Solutions For Enterprises
• Cross-Border Cash Flow Management: Legal Considerations For Repatriating Profits To Vietnam