From 1 January 2026, the Law on Personal Data Protection requires businesses to delete or destroy an employee’s personal data when the employment contract ends, unless otherwise agreed or provided by law. But payrolls, employment contracts, payment records and personal income tax withholding records are accounting documents. They are also the evidence a business uses to justify its expenses to the tax authority. Manufacturers and FDI companies with high staff turnover are often unsure: delete everything or keep everything? In fact, the Law does not force a choice between the two. This article explains which data may still be kept, which data should be deleted, and how to tier, minimise and restrict access to the data so that you keep enough records and still follow data protection principles.
- Clause 2, Article 25 of Law No. 91/2025/QH15: a business must delete or destroy employee data when the contract ends, unless otherwise agreed or provided by law.
- This is not a real conflict. Law 91 already leaves room for retention duties under other laws, such as the Law on Accounting, tax law and labour law.
- Accounting vouchers used directly for bookkeeping and for preparing financial statements must be kept for at least 10 years (Law on Accounting 2015, Decree No. 174/2016/ND-CP).
- The exception covers only the data the law actually requires you to keep. Data outside that scope must still be deleted, destroyed or de-identified once its purpose has ended.
- A safe approach: tier HR data, keep the mandatory part in a separate archive, restrict who can access it, log access, and reply in writing when an employee asks for deletion.
1. What does Law 91 require for data when an employee leaves?
The Law on Personal Data Protection (Law No. 91/2025/QH15, in force from 1 January 2026) has a specific article on employment relationships. The key point is in Clause 2, Article 25: employee data is kept for the period required by law or agreed, and must be deleted or destroyed when the contract ends, except where otherwise agreed or provided by law.
Calling this a “conflict” between data law and tax law is misleading. Law 91 itself refers to the provisions of other laws. So the right question is not “which law do we follow?” but which data falls within the exception and which does not.
Articles 25, 14 and 19 of Law No. 91/2025/QH15
- Clause 2, Article 25: employees’ personal data must be stored for the period provided by law or agreed; it must be deleted or destroyed when the contract ends, unless otherwise agreed or provided by law.
- Clause 1, Article 14: personal data is deleted or destroyed in cases such as: the data subject requests it, the processing purpose has been fulfilled, the storage period has expired, a competent authority decides so, it has been agreed, and other cases provided by law.
- Clause 2, Article 14: a data subject’s request for deletion or destruction is not carried out in the cases in Article 19, or where deletion or destruction would breach Clause 3, Article 4 of the Law.
- Clause 1, Article 19: cases where data may be processed without consent, including: to serve the activities of state agencies and state management activities as provided by law (point (c)); to perform an agreement between the data subject and the relevant agency, organisation or individual as provided by law (point (d)); other cases provided by law (point (dd)).
- Article 3: personal data may only be stored for a period appropriate to the purpose of processing.
Analysis: Read together, these provisions lead to two conclusions. First, the business has a basis to keep the records that accounting, tax and labour law require, even after the employee has left and even if they ask for deletion. Second, that basis has limits. It covers only the data needed to meet the legal obligation, and only for the period set by law. A full HR file with a CV, photos, biometric attendance data, internal emails and so on does not automatically become an “accounting document” just because it sits in the same folder as the payroll.
The general principle is explained in the article “When an employment contract ends, the business must delete the employee’s personal data”. This article focuses on the accounting and tax side.
- Do not apply a “delete everything on departure” policy mechanically on your HRIS or ERP. An automatic delete command may also remove data linked to payroll entries and payment records.
- Equally, do not “keep everything forever”. For each group of data you keep, record the legal basis and the retention period.
2. Which rules require a business to keep a former employee’s records?
Three groups of rules are usually cited: accounting, tax and labour. Each plays a different role.
Law on Accounting 2015 and Decree No. 174/2016/ND-CP
Under Article 41 of the Law on Accounting 2015 (as amended and supplemented) and Articles 12 and 13 of Decree No. 174/2016/ND-CP, accounting documents are kept for these periods:
- At least 5 years: accounting documents used for management and operations, including accounting vouchers not used directly for bookkeeping and preparing financial statements.
- At least 10 years: accounting vouchers used directly for bookkeeping and preparing financial statements, accounting books, annual financial statements and certain other documents.
- Permanently: documents of historical value or of major economic, security or defence importance.
The retention period is normally counted from the end of the annual accounting period.
Tax administration and corporate income tax law
- Law on Tax Administration No. 108/2025/QH15 (in force from 1 July 2026, replacing Law No. 38/2019/QH14), Clause 7, Article 46: the limitation period for penalties is 2 years for violations of tax procedures and 5 years for tax evasion and incorrect declarations leading to underpaid tax. Clause 8: after the limitation period for penalties has expired, the taxpayer must still pay in full the underpaid tax, evaded tax and late payment interest for up to 10 years back from the date the violation is discovered.
- Law on Corporate Income Tax No. 67/2025/QH15, Clause 1, Article 9: a deductible expense must actually be incurred, relate to production and business activities, be supported by invoices and records as required, and meet the conditions on non-cash payment.
Labour Code 2019
- Article 12: the employer must prepare, update, manage and use a labour management register (on paper or electronic) and present it when a competent state authority asks.
- Clause 3, Article 48: when the contract ends, the employer must complete the procedure to confirm the periods of social insurance and unemployment insurance contributions, return documents it has kept, and provide copies of documents relating to the employee’s work if the employee asks.
- Article 190: the limitation period for asking a court to resolve an individual labour dispute is 1 year from the date the alleged violation is discovered (6 months for a labour mediator, 9 months for a labour arbitration council).
Analysis: The Law on Accounting creates the clearest duty to retain. Payrolls, timesheets used to calculate pay, bank payment records, personal income tax withholding records and so on fall into the group kept for at least 10 years if they are used directly for bookkeeping.
Tax law sets a risk horizon. A salary expense is deductible only if it is supported by records, and the tax authority can claim back tax over a long period. This is a practical reason for the business to keep enough records to prove its expenses. It is not a basis for keeping every type of HR data.
For documents kept only to guard against labour disputes, set a reasonable retention period based on the limitation period, instead of keeping them indefinitely.
| Group of records | Basis usually cited | Personal data usually included | Note on retention period |
|---|---|---|---|
| Payrolls, timesheets used to calculate pay | Law on Accounting 2015; Decree No. 174/2016/ND-CP | Full name, employee ID, days worked, pay, deductions | Usually in the at-least-10-years group if used directly for bookkeeping |
| Employment contracts, salary annexes | Law on Accounting; Law on Corporate Income Tax (proof of expenses) | Full name, date of birth, personal identification number, address, salary | Linked to the retention period for salary expense records |
| Bank payment records | Law on Accounting; non-cash payment conditions | Full name, account number, amount | Usually in the at-least-10-years group |
| PIT withholding and PIT finalisation records made on behalf of employees | Law on Accounting; tax administration law | Tax code, income, deductions, dependants | Consider the 10-year claw-back horizon under the Law on Tax Administration |
| Labour management register, termination records | Labour Code 2019 (Articles 12 and 48) | Personal details, period of work, job title, social insurance | Set in the internal retention policy |
| CV, photos, biometric attendance data, internal emails | Usually no mandatory retention basis | Identification data, possibly sensitive data | Delete, destroy or de-identify once the purpose has ended, unless there is another basis |
3. What to keep and what to delete: tiering HR records
Instead of dealing with “the whole file”, a business should split a former employee’s file into tiers according to the basis for retention. Each tier has its own rules on retention period, storage location and who may access it.
| Tier | Examples of data | Basis for keeping it | How to handle it |
|---|---|---|---|
| Tier 1: required for accounting and tax | Contract, salary annexes, payrolls, timesheets used for pay, payment records, PIT withholding records, family deduction records | Accounting and tax law (Clause 2, Article 25 of Law 91: otherwise provided by law) | Keep for the full legal period; move to a separate, read-only archive with restricted access |
| Tier 2: labour obligations, dispute prevention | Labour management register, termination decision, termination agreement, handover record, disciplinary records | Labour Code; the need to protect lawful rights and interests | Set a specific retention period in the policy; delete or destroy when it expires |
| Tier 3: purpose ends when the employee leaves | CV, ID photo, fingerprint templates, facial attendance data, internal email account, relatives’ details not used for tax | Usually no remaining basis | Delete, destroy or de-identify; make a written record |
Points to watch when tiering
Not all data that “looks unnecessary” can be deleted straight away. Some records, such as health check results, occupational accident records and occupational safety and health records, may be subject to specific retention rules under sector-specific law. Before putting any group of data into Tier 3, check the rules that apply to your business line.
- Prepare a retention schedule: each line shows the type of data, the system that holds it, the legal basis, the period, the department responsible and the method of destruction.
- For Tier 1, keep only the data fields needed for the records. For example, a payment record needs the full name, account number and amount. It does not need a portrait photo or a copy of an ID document attached, unless the record requires it.
- Agree the schedule between HR, Accounting, IT and Legal. It is the base document for the data protection policy and the personal data processing impact assessment dossier.
4. How to store records so you keep enough evidence and minimise data
Keeping data because of a legal duty does not mean leaving it on the systems used every day. The purpose has changed from HR management to meeting accounting and tax obligations, so the way the data is stored must change too.
- Separate it from the live HRIS: move former employees’ files to a separate, read-only storage area.
- Role-based access: only the chief accountant, the person in charge of tax or an authorised person may access it, and only for a specific need such as tax finalisation, inspection or audit.
- Access logs: who opened it, when and for what purpose.
- Encryption and controlled backups: backups must follow the same retention period and destruction rules.
- Destroy on time: schedule regular reviews; when the period expires, destroy the data and make a written record.
De-identification of data under Law No. 91/2025/QH15
- Clause 11, Article 2: de-identification is the process of changing or deleting information to create new data that cannot identify, or cannot help identify, a specific person.
- Clause 1, Article 2: personal data that has been de-identified is no longer personal data.
- Clause 6, Article 14: the de-identification process must be strictly controlled; de-identified data must not be re-identified, unless otherwise provided by law.
Analysis: For internal reports such as staff turnover, labour cost per production line or productivity per shift, the business usually does not need to know who the people are. De-identifying analytical datasets keeps their statistical value without prolonging the processing of personal data. However, de-identification does not replace keeping the original Tier 1 records. Accounting vouchers must still be kept in their original form as required.
FDI companies should check whether former employees’ files are being synchronised to the parent company’s systems abroad. If so, assess this under the rules on cross-border personal data transfers in Law 91 and Decree No. 356/2025/ND-CP, and apply the same retention period and destruction rules to the copies held abroad.
FC Legal can review former employees’ data on your HRIS, ERP and attendance software, build a retention schedule based on accounting, tax and labour rules, and set up a procedure for answering deletion requests.
5. A former employee asks for deletion: what to do
The business should not stay silent or give a general answer such as “the company must keep it by law”. The sensible approach is to delete what can be deleted and explain clearly what must be kept.
Procedure for handling a former employee’s deletion request:
- Receive the request through an official channel and verify the requester’s identity.
- Search for the person’s data on every system: HRIS, ERP, attendance, email, shared files, backups.
- Check the retention schedule to separate Tier 1, Tier 2 and Tier 3.
- Delete, destroy or de-identify data that no longer has a basis for retention; make a written record.
- Reply in writing: what was deleted, what is still kept, the legal basis and the retention period.
- Keep the file on how the request was handled, in case you need to explain it later.
Analysis: The deadlines for handling data subject requests are set out in Decree No. 356/2025/ND-CP (which replaced Decree No. 13/2023/ND-CP from 1 January 2026). Some drafts and online materials still cite the “72 hours” deadline under Decree 13/2023 for deleting data. Businesses should update their procedure to the regulations in force and handle requests within the legal deadline.
The written reply should state the groups of data still kept, the basis (for example Clause 2, Article 25 and Clause 2, Article 14 of Law 91, together with the rules on keeping accounting documents), the expected retention period and the protection measures in place.
Prepare a template reply to deletion requests, with a section listing the groups of data by tier. HR receives the request, but Accounting and Legal should confirm the reply before it is sent.
6. Self-check questions for HR, Accounting and IT
- Does the business have a list of employee data by system?
- For each group of data kept after an employee leaves, are the legal basis and the retention period recorded?
- Does the HRIS have automatic deletion, and is there a risk of deleting data linked to payroll records by mistake?
- Are former employees’ files still stored together with current employees’ files, where anyone can see them?
- Is former employees’ fingerprint or facial attendance data still on the attendance devices or servers?
- Are backups and payroll files sent by email within the scope of the review?
7. Where should a business start?
You do not need to build everything at once. A business with a large workforce should start with the systems that hold the most data on former employees, and with sensitive data.
Suggested roadmap:
- Inventory former employees’ data on all systems.
- Determine the basis for retention for each group: accounting, tax, labour, agreement.
- Prepare the retention schedule and the tiering rules.
- Separate the archive, set access rights and turn on access logs.
- Delete or destroy backlog data that no longer has a basis for retention.
- Issue a procedure for answering deletion requests and a schedule for regular reviews.
The results of the review also feed into the personal data processing impact assessment dossier and the business’s data protection policy. The article “Employees’ personal data: what should businesses review?” gives an overview of the whole life cycle of HR data.
Frequently asked questions
A departing employee asks for all their data to be deleted. Must the business comply?
The business is not required to delete everything. Clause 2, Article 25 of Law No. 91/2025/QH15 allows data to be kept where the law provides otherwise, and Clause 2, Article 14 allows a deletion request not to be carried out in the cases in Article 19. The business must still delete the data that no longer has a basis for retention, and explain clearly what is kept and why.
How long must a former employee’s payroll be kept?
If the payroll is an accounting voucher used directly for bookkeeping and preparing financial statements, it falls into the group kept for at least 10 years under the Law on Accounting 2015 and Decree No. 174/2016/ND-CP, usually counted from the end of the annual accounting period. When the period expires, the business should destroy it following its procedure.
Does the business need the employee’s consent again to keep payroll records?
Usually not, if the records are kept to meet an obligation under the law. Article 19 of Law No. 91/2025/QH15 lists the cases where data may be processed without consent, including other cases provided by law. The business must still keep to the purpose and scope and have protection measures in place.
Must fingerprint or facial attendance data be kept to justify tax positions?
Usually not. Salary expenses are proven with timesheets, payrolls and payment records, not the original biometric templates. Biometric data is sensitive data and should be deleted or destroyed once its purpose has ended, unless another basis for retention has been clearly identified.
Does the 10-year tax claw-back period mean every HR file must be kept for 10 years?
No. Under the Law on Tax Administration No. 108/2025/QH15, the taxpayer must still pay underpaid tax for up to 10 years back from the date the violation is discovered. This is a reason to keep enough records to prove expenses. It is not a basis for keeping CVs, photos or biometric attendance data.
8. Legal basis and references
- Law on Personal Data Protection (Law No. 91/2025/QH15) (Articles 2, 3, 14, 19 and 25), in force from 1 January 2026.
- Decree No. 356/2025/ND-CP detailing the Law on Personal Data Protection, replacing Decree No. 13/2023/ND-CP.
- Law on Accounting No. 88/2015/QH13 (as amended and supplemented), Article 41.
- Decree No. 174/2016/ND-CP detailing certain articles of the Law on Accounting, Articles 12 and 13.
- Law on Tax Administration No. 108/2025/QH15, Article 46, in force from 1 July 2026, replacing Law on Tax Administration No. 38/2019/QH14.
- Law on Corporate Income Tax No. 67/2025/QH15, Article 9.
- Labour Code No. 45/2019/QH14, Articles 12, 48 and 190.
Review your personal data compliance with an FC Legal lawyer
Find out what data your business processes, where it is held, which risks to deal with first and which dossiers you must prepare.
- Data map and compliance gap assessment
- Drafting the impact assessment dossiers (DPIA) and the cross-border data transfer dossier
- Standardising policies, vendor contracts and the incident response procedure
Please do not send confidential documents or personal data through the form.
This article is for reference. It reflects the regulations in force at the time of publication. For a legal opinion on a specific case, please contact an FC Legal lawyer.
Prepared by the FC Legal legal team and reviewed by FC Legal’s managing lawyer. Updated 4 October 2026.
