Pre-employment background checks in Vietnam

Are background checks legal in Vietnam?

Yes. Pre-employment background checks are lawful in Vietnam, but since 1 January 2026 they are governed by the Personal Data Protection Law (PDPL). You need the candidate's specific, informed consent; you may collect only data relevant to the role; and where a check touches criminal-record or other sensitive data — or runs at any real scale — you must file a personal-data-processing impact assessment with the data-protection authority within 60 days of starting. In short, screening must be run lawfully and case by case, not as a blanket routine.12

Nothing in the Labour Code forces an employer to screen candidates for ordinary private-sector roles, so what you check is largely your choice — but that choice is bounded by data-protection law and by the specific documents the State requires for a foreign hire's work permit. The two sit on different footings: discretionary screening is a PDPL question, while the work-permit criminal-record certificate is a statutory requirement discussed below. For the wider data regime that frames all of this, see the PDPL and HR data in Vietnam, and for the employment-relationship basics, Vietnam's labour law and contracts.

What pre-employment checks are common in Vietnam?

The checks employers run in Vietnam are much the same as elsewhere; what differs is the data-protection treatment of each. The table groups the common ones by how sensitive the underlying data is under the PDPL, because that determines how heavy the compliance duties become.

The PDPL overlay: consent, data minimisation and impact assessment

Three PDPL duties shape lawful screening. First, consent and minimisation: the law has a dedicated article on personal data in recruitment, management and employment, under which you may collect only data relevant to the recruitment, you need the candidate's consent, and a candidate who is not hired must have their data deleted unless otherwise agreed. Consent must be voluntary, explicit, specific and fully informed, given separately for each purpose — silence is not consent — and the PDPL has no stand-alone "legitimate interest" basis, so you cannot screen on that ground alone.1

Second, sensitive-data care: a candidate's criminal-record information is classified as sensitive personal data, so a check that involves it needs explicit consent and the stricter safeguards the law reserves for sensitive categories. The grace period that small enterprises and start-ups otherwise get does not apply once sensitive data (or data on 100,000 or more people) is processed.12

Third, the impact assessment: an employer or an EOR that processes candidate data — particularly sensitive criminal-record data, or at any real scale — must prepare a personal-data-processing impact assessment and file one original with the specialised data-protection authority, the Ministry of Public Security, within 60 days of the first day of processing. That is a separate filing from the cross-border-transfer impact assessment needed to send the data abroad.12 If your screening data will flow to an overseas parent or client, plan both; the HR compliance calendar tracks the filing deadlines, and the PDPL and HR data page covers the controller/processor mapping.

The criminal-record certificate (judicial record)

A Vietnamese criminal-record check runs on the judicial-record certificate (phiếu lý lịch tư pháp), which comes in two types showing different things. The distinction matters because the law restricts which one an employer may ask for.3

The key limit is on the full-history certificate: under Decree 216/2026/ND-CP, agencies, organisations and individuals are not allowed to require a person to hand over the Type 2 certificate. A candidate may still voluntarily obtain a Type 1, or authorise the employer to request a certificate on their behalf for a specific purpose such as a work-permit dossier.3

From 1 July 2026 the certificate is normally applied for online through the VNeID app or the National Public Service Portal, and the electronic certificate has the same legal value as a paper one. Issuance moved from the justice department to the provincial police and the Ministry of Public Security, with processing of about five working days — up to 15 where verification is needed. People without an electronic ID, including many foreigners, can still apply on paper.3

What you cannot do

Most compliance failures in Vietnamese screening are over-reach, not under-checking. Four lines are worth holding:

• Do not over-collect. You may gather only data relevant to the role; sweeping up social-media history, family details or health data "to be safe" breaches the minimisation rule.
• Do not process sensitive data without an explicit basis. Criminal-record and health data need explicit, purpose-specific consent and the sensitive-data safeguards — not a general consent buried in an application form.
• Do not require the Type 2 certificate. Forcing a candidate to produce their full-history judicial record is prohibited.
• Do not export screening data without the assessment. Sending candidate data to an overseas parent or vendor needs the cross-border-transfer impact assessment filed within 60 days of the first transfer.

The penalties are real: data-protection breaches can reach up to 5% of prior-year revenue for an unlawful cross-border transfer, and up to ten times the illicit proceeds (or ₫3 billion, whichever is higher) for illegally trading personal data. Because the PDPL reaches foreign organisations that process Vietnamese citizens' data even without a local presence, an overseas parent receiving screening results is in scope too.12

Screening and the work-permit dossier for foreign hires

For a foreign hire, one background document is not discretionary: a criminal-record certificate is part of the statutory work-permit dossier. Under Decree 219/2025/ND-CP the dossier includes a valid passport, a health certificate issued within the previous 12 months, a criminal-record certificate issued within the previous 6 months, and proof of qualifications and experience. The certificate can be a Vietnamese one or one from the applicant's home country, depending on where they have been living.4 Foreign English teachers are a common case — their work-permit dossier requires exactly this criminal-record certificate, issued within the previous six months; see hiring English teachers through an EOR.

Documents issued abroad must be consular-legalised and translated and notarised into Vietnamese, unless a treaty or reciprocity arrangement exempts them — so a home-country police check needs lead time, not just the certificate itself.4 This is where private screening and the permit overlap: the qualification evidence you verify also supports the "expert" or "technical worker" category. See Vietnam work permits for the full dossier and timeline, and the work visa and residence card for what follows permit approval.

How EOR Vietnam runs compliant screening

Because an employer of record is the legal employer in Vietnam, it carries the data-protection duties on screening as the controller of candidate data — so the consent, minimisation, sensitive-data and impact-assessment steps sit with us, not stranded on an overseas client. In practice we scope the checks to the role, take purpose-specific consent, obtain the right certificate type (and arrange the criminal-record certificate for a foreign hire's work-permit dossier), file the personal-data-processing impact assessment where it is triggered, and delete the data of candidates who are not hired. For how the employer-of-record structure works and why it is lawful, see what an EOR is in Vietnam and whether an EOR is legal in Vietnam.

1. Scope and consent

   Agree the checks relevant to the role and collect the candidate's specific, informed consent for each purpose.

2. Verify and certify

   Run identity, employment and qualification checks; obtain a Type 1 judicial-record certificate where appropriate, or the work-permit criminal-record certificate for a foreign hire.

3. Assess and file

   Prepare and file the personal-data-processing impact assessment where sensitive data or scale triggers it, and plan any cross-border transfer.

4. Retain or delete

   Keep only what is needed for the hire; delete a non-hired candidate's data.

Screening sits inside onboarding, and onboarding carries no separate charge. Our fee for a Vietnamese national is a flat US$149 per employee per month — the same whatever the salary, role or location — with no setup, onboarding, offboarding, contract or payslip fees; a refundable security deposit equal to two months of the employee's employment cost is held for the engagement and returned at the end, less any unpaid amounts (as of October 2026). A foreign national who needs a Vietnamese work permit is quoted separately. The full breakdown is on the EOR Vietnam cost page. For the wider picture, see the EOR Vietnam overview and our other Vietnam employer guides.