Human resources (HR) data collection is an essential activity in the recruitment and management of employees at every enterprise. However, businesses are not permitted to collect, store, or process any information arbitrarily. Since the Law on Personal Data Protection 2025 was enacted, the legal boundaries of HR data collection have been regulated more strictly than ever. The following article analyzes the legal limits that businesses must clearly understand to avoid violations during the collection and processing of employees’ personal data.
LEGAL BASIS
- Law on Personal Data Protection 2025 (Law No. 91/2025/QH15)
I. FUNDAMENTAL PRINCIPLES OF HR DATA COLLECTION
1.1. Principle of Proper Scope and Purpose
According to Clause 2, Article 3 of the Law on Personal Data Protection 2025, personal data “shall only be collected and processed within the correct scope and for specific, clear purposes, ensuring compliance with the provisions of law”. This is the core principle governing all HR data collection activities within an enterprise.
This means that any information a business collects from candidates or employees must be tied to a clearly predefined purpose. Businesses are not allowed to collect HR data indiscriminately or for vague reasons, whether during the recruitment phase or throughout the employment management process.
1.2. Principle of Data Subject Consent
Another critical principle is that businesses may only process the personal data of candidates and employees with their consent, except as otherwise provided by law. This consent must be explicit, voluntary, and stem from the true will of the data subject – meaning that candidates or employees are not coerced or misled when providing their information.
In practice, many businesses still underestimate this requirement, particularly during recruitment when candidates are often in a weaker position and tend to provide any information requested by recruiters. However, since the Law on Personal Data Protection 2025 took effect, the act of collecting HR data without a valid legal basis of consent can be considered a violation of the law.
II. SPECIFIC LEGAL LIMITS ON HR DATA COLLECTION
2.1. Limits in the Recruitment Phase
Clause 1, Article 25 of the Law on Personal Data Protection 2025 explicitly outlines the responsibilities of businesses when collecting HR data during the recruitment phase, specifically:
First, businesses “are only permitted to request information that serves the recruitment purposes of the hiring agency, organization, or individual in accordance with legal regulations; the provided information shall only be used for recruitment purposes and other purposes as agreed upon in compliance with the provisions of law”. Thus, questions or information requests unrelated to the recruitment job – such as marital status, plans to have children, religion, or political views – can be deemed as collecting HR data beyond the permitted scope.
Second, all collected information must “be processed in accordance with the provisions of law and must obtain the consent of the applicant”. Businesses cannot arbitrarily share or transfer candidate profiles to a third party without prior permission.
Third, a highly notable regulation is that businesses “must delete or destroy the information provided by the applicant in the event that they are not hired, unless otherwise agreed upon with the applicant”. This means that the profiles, CVs, and personal information of unsuccessful candidates are not allowed to be stored indefinitely in a company’s database without a clear legal basis or agreement.
2.2. Responsibilities of Businesses in the Management and Utilization Phase of Employees
Once an employee officially starts working, the business must continue to comply with the legal limits on HR data collection under Clause 2, Article 25 of the Law on Personal Data Protection 2025:
Businesses must “comply with the provisions of this Law, labor and employment legislation, data legislation, and other relevant legal regulations”. This represents the intersection between labor law and data protection law, requiring the HR department to be well-versed in both regulatory systems simultaneously.
Regarding the storage period, “employees’ personal data must be stored for the duration prescribed by law or as agreed upon”. Storing HR data past the regulated period without grounds is a legal violation. Upon termination of the employment contract, the business “must delete or destroy the employee’s personal data upon termination of the contract, unless otherwise agreed upon or as provided by law”.
2.3. Limits on the Use of Technological and Technical Measures
In the context where businesses increasingly apply technology to HR management—ranging from biometric timekeeping systems and surveillance cameras to productivity-tracking software—Clause 3, Article 25 of the Law on Personal Data Protection 2025 imposes important constraints:
“Technological and technical measures may only be applied in accordance with the provisions of law and must ensure the rights and interests of the personal data subject, on the basis that the employee is fully aware of such measures”. This means employees must be clearly notified about the tracking and monitoring systems applied to them. Businesses must not secretly collect HR data through technological devices. In addition, businesses “are forbidden from processing or using personal data collected from technological and technical measures in violation of legal regulations”.
III. PROHIBITED ACTS IN HR DATA PROCESSING
Article 7 of the Law on Personal Data Protection 2025 lists prohibited acts, including those directly related to the HR data collection activities of businesses:
-
- Processing personal data in violation of legal regulations: This is the most fundamental prohibited act, encompassing all activities of collecting, storing, using, or sharing HR information improperly.
- Buying and selling personal data: Businesses are absolutely forbidden from buying or selling the information of candidates or employees, unless otherwise provided by law.
- Appropriating, intentionally disclosing, or losing personal data: Acts that lead to the leakage of HR information, whether due to negligence or intent, can result in legal liability.
Violations in HR data collection can lead to administrative sanctions or criminal prosecution depending on the severity of the infraction.
FREQUENTLY ASKED QUESTIONS (FAQ)
Can the profiles of unsuccessful candidates be kept for the next recruitment cycle?
According to regulations, businesses must delete or destroy the information of applicants who are not hired, unless there is a separate written agreement with that candidate.
Can a business install surveillance cameras to monitor employees without notice?
No, this is not permitted. The Law on Personal Data Protection 2025 requires employees to be fully aware of the technological and technical measures applied to collect their data.
