Question: I am currently working at the Company, and I now wish to resign. May I ask whether, according to the provisions of the law, the old company has the right to continue to retain my personal information? If so, which information needs to be retained and which information must be deleted immediately?
Answer:
Pursuant to clause 2 Article 25 of the Law on Personal Data Protection 2025, immediately upon the employee's resignation, their personal data must be destroyed instantly, except for groups of data permitted for continued storage according to the provisions of the law or according to an agreement.
As such, to clarify the application of this provision to the actual file of the Client, personal data at the company shall be classified into two basic groups: the group that continues to be stored and the group that must be deleted.
1. Group of data requiring continued storage
A. Storage for a minimum of 01 year
Pursuant to clause 3 Article 190 of the Labor Code 2019, this group of documents should be stored for at least 01 year to serve the purposes of comparison, explanation, and resolution of individual labor disputes, as the statute of limitations for requesting a Court to resolve an individual labor dispute is 01 year from the date of discovering the act which the disputing party believes violates their lawful rights and interests, specifically:
- Performance evaluation records
- Decisions, personnel notices
- Records (labor discipline processing, handover and termination of labor contracts, complaints, explanations,...)
B. Storage for a minimum of 10 years
Pursuant to point b clause 5 Article 41 of the Accounting Law 2015, this group of documents must be stored for at least 10 years for direct use in recording accounting books and preparing financial statements, except where the law provides otherwise, specifically:
- Labor contracts, Appendix to labor contracts
- Agreements on amendment, extension, termination of labor contracts
- Payment records of salary, social insurance and allowances
- Commercial contracts stating the name, title, contact information, signature of the employee
- Invoices, vouchers, payment requests, payment orders attached with personal data of the employee
- Emails/appendix confirming transactions if they are a part of the accounting records or official transaction records
C. Storage according to the duration of the agreement
Pursuant to point b clause 2 Article 25 of the Law on Personal Data Protection 2025, personal data of the employee must be stored within the duration as provided by the law or according to an agreement, specifically:
- Agreements (information confidentiality, non-competition)
- Information of the employee serving recruitment purposes
- Original images/Videos not yet posted containing images/personal voice of the employee (in cases where there is an agreement)
- Images/Videos already posted containing images/personal voice of the employee (in cases where there is an agreement)
2. Group of data that must be deleted, destroyed
Pursuant to point c clause 2 Article 25 of the Law on Personal Data Protection 2025, this group of documents shall be subject to immediate deletion/erasure upon the termination of the labor contract, except where there is an agreement or the law provides otherwise, specifically:
- Vehicle control data
- Employee's biometric data
- Original images/Videos not yet posted containing images/personal voice of the employee (in cases where there is no agreement)
- Images/Videos already posted containing images/personal voice of the employee (in cases where there is no agreement)
- Profiles of individuals, families of employees collected for employee welfare purposes (health checkups, travel,...)
3. Notes, recommendations
- Clients should remember and closely monitor the retention deadlines applied by the company to each type of their documents to promptly send a written request compelling the company to thoroughly execute the obligation of deleting and destroying all personal data immediately when these deadlines arrive.
- Clients should master the regulations on the list of documents requiring retention or deletion to proactively propose and negotiate with the enterprise regarding a safe personal data processing plan prior to officially resigning.
