Data protection for HR data in Vietnam (PDPL)

The PDPL regime: Law 91/2025 and Decree 356/2025

The PDPL is Vietnam's first comprehensive data-protection statute: Law 91/2025/QH15, passed 26 June 2025 and effective 1 January 2026, in five chapters and 39 articles.1 It does not expressly repeal the old Decree 13/2023; the practical supersession comes through Decree 356/2025/ND-CP, which took effect the same day and replaced Decree 13/2023.2 The accurate way to state it is that the PDPL and Decree 356/2025 now govern, with the Law sitting above the decree.

A transitional rule matters if you processed data before 2026: impact assessments validly made under Decree 13/2023 stay valid, but any update from 1 January 2026 onward must meet the new Law and Decree 356/2025.12 These changes sit alongside the other shifts in our round-up of what changed for Vietnamese employers in 2026.

Does the PDPL reach foreign companies?

Yes. The law binds domestic and foreign organisations that process personal data in Vietnam, and it reaches foreign organisations with no establishment in Vietnam that process the personal data of Vietnamese citizens (PDPL, Arts. 1–2).1 That reach surprises overseas employers: a parent or client abroad receiving a Vietnamese employee's payroll, performance or health data is within scope even with no entity in Vietnam. For anyone hiring through an EOR that is precisely the situation — the data starts in Vietnam and needs to reach a team elsewhere.

HR data duties: notice, consent and sensitive data

Processing employee personal data needs clear notice and consent, impact assessments, and extra care for sensitive data such as health records; the EOR, as controller or processor, must map how that data flows to any overseas client or parent.12 One difference from the European GDPR catches employers out: under the PDPL, “legitimate interest” is not a standalone lawful basis, so an employer cannot simply assert a business interest — properly taken notice and consent do the work instead. The duties below apply from the first day you collect a candidate's or employee's data; pre-employment screening is a pressure point because it can involve sensitive categories, which we cover under what a lawful background check can cover in Vietnam.

Cross-border transfer impact assessment

Sending Vietnamese personal data abroad requires a cross-border-transfer impact assessment. The controller prepares an impact-assessment dossier and sends one original to the personal-data-protection authority (the Ministry of Public Security) within 60 days of the first cross-border transfer. The governing provision is PDPL Article 20 (clause 2); Decree 356/2025 (Article 18) adds the detailed conditions.12 The clock runs from 60 days after the transfer first starts, not a permission you obtain beforehand — though the dossier itself must be ready in advance.

For an EOR arrangement this is the operative rule, because employee data routinely needs to reach an offshore client or parent — for payroll funding, reporting lines or group HR systems. The same discipline applies when payroll data moves to a provider; see how payroll data is handled when payroll is outsourced.

The personnel-management transfer exemption

Decree 356/2025 provides an exemption from the cross-border-transfer impact assessment for transfers made to manage employees across a multinational group, in line with labour rules and agreements — relevant to EOR and HR-data flows, though the exact conditions should be confirmed for each case.23 The exemption is tied to the underlying labour documentation: the transfer must genuinely be for personnel management and consistent with the labour rules, the internal labour regulations or a collective agreement that already govern the employment.4

Treat it as a conditional carve-out, not a blanket exemption. It can remove the 60-day filing for an intra-group HR transfer where the conditions are met; if the data is used for a different purpose, or the labour documentation does not support it, the Article 20 assessment is back in play. A foreign parent receiving data from a Vietnamese workforce should document which basis it relies on — the exemption or a filed assessment — rather than assume the exemption applies automatically.

Penalties for data-protection breaches

The financial exposure is now settled by Decree 356/2025, which fixed the maxima the draft rules had left open. Cross-border-transfer violations can reach up to 5% of the offender's prior-year revenue, and illegally selling or buying personal data can draw up to 10 times the illicit proceeds, or VND 3,000,000,000, whichever is higher.12 Both are revenue- or gain-based, so for a sizeable group the exposure is large — reason enough to get the mapping, and the choice between an assessment and the exemption, right.

How EOR Vietnam maps and protects employee data

As the employer of record, EOR Vietnam is a controller or processor of your workers' personal data, so the PDPL duties above are ours to run. The handling follows a fixed sequence for every hire.

1. Collect with notice and consent

   We take only the data the role and payroll need, with clear notice about what is collected, why, who receives it and for how long — not an assumed “legitimate interest”.

2. Keep sensitive data separate

   Health-check results and any biometric or screening data get the extra care the PDPL requires, kept apart from ordinary payroll records.

3. Map every cross-border flow

   Before data reaches your team, a client or a parent abroad, we record the route and choose the basis: the personnel-management exemption where its conditions are met, or a filed Article 20 assessment where they are not.

4. Return or delete on exit

   On offboarding, or if you move providers, data is returned or deleted on a documented basis — see how data is returned when you switch EOR providers.

This handling is part of the standard service, not a line item. Our EOR fee is a flat US$149 per employee per month for Vietnamese nationals, as of October 2026 — the same regardless of salary, role or location, with no separate data-protection or compliance charge and no setup, onboarding, offboarding or hidden fees. Foreign nationals who need a Vietnamese work permit are quoted separately. A security deposit of two months of the employee's employment cost — gross salary plus statutory employer contributions — is held for the engagement and returned at the end, less any unpaid amounts; salary and the statutory social, health and unemployment contributions are passed through at cost.

Data protection is one recurring obligation among several, so we fold the PDPL touchpoints into the wider HR compliance calendar and our other Vietnam employer guides, alongside related contract matters such as who owns the intellectual property an employee creates. Our own processing is set out in the privacy notice for this site. To get your data flows mapped in writing, send EOR Vietnam your hiring details.