Facial recognition time clocks mean staff no longer need a card, they reduce “buddy punching” (one employee clocking in for another), and they feed data automatically into the payroll software. But few businesses ask: where is employees’ facial data stored, who can access it, and what happens when an employee leaves? From 1 January 2026, biometric data is sensitive personal data under the Law on Personal Data Protection 2025 and Decree No. 356/2025/ND-CP. This article helps HR, IT, Legal and management identify what to check: data flows, access rights, vendors, information for employees, handling when staff leave, and incident response.
- Biometric data is sensitive personal data under the list in Article 4 of Decree No. 356/2025/ND-CP. Facial recognition attendance is therefore not only an HR matter.
- The Law on Personal Data Protection 2025 has a specific article (Article 31) on biometric data: physical security of devices, limited access, and monitoring for unauthorised access.
- Article 25 of the Law requires technology used to manage employees to comply with the law, protect employees’ rights, and be known to employees.
- If biometric data is leaked, Article 29 of Decree No. 356 requires notice to the data subjects within 72 hours of discovering the breach.
- The risk is often outside the device itself: servers, HRM software, cloud, vendors and sub-processors. Map the data before you draft any forms.
- Small enterprises that process sensitive data do not benefit from the exemption from certain obligations under Decree No. 356, such as preparing an impact assessment dossier.
1. What data does facial recognition attendance process?
A card time clock only records “Employee A, in 8:02, out 17:35”. With facial recognition, the system must also capture and match the employee’s facial features. So the right question is not only “is the device accurate?” but “what data does the system process to recognise the employee?”.
Two products both sold as “Face ID attendance” may have very different designs: they may store the original photo or only a recognition template, store data on the device or sync it to the cloud, and the vendor may or may not have remote access.
- Clause 2, Article 31 of the Law on Personal Data Protection (Law No. 91/2025/QH15): biometric data is data on the physical attributes and specific, stable biological characteristics of an individual, used to identify that individual.
- Point đ, Clause 1, Article 4 of Decree No. 356/2025/ND-CP: “biometric data and genetic characteristics” are on the list of sensitive personal data.
- The Law and the Decree are both in force from 1 January 2026; Decree No. 356 replaces Decree No. 13/2023/ND-CP.
2. Where is the facial data and who does it pass through?
The answer “the data is in the time clock” is usually not enough. Your business needs to check whether the device syncs with an internal server, connects to the HRM system, makes backups, sends data to the cloud, allows the vendor remote access, or syncs with a mobile app or group systems. A real data flow may look like this:
A typical data flow- Employee’s face
- Time clock device
- Internal server
- HRM / payroll software
- Vendor’s cloud
- Sub-processor (if any)
Analysis: If you look only at the device by the office door, you can easily miss most of the data’s life cycle. The vendor may use a cloud provider or another support company. Each link in the chain is a point where data can leak and must be covered by a contract.
Ask IT and the vendor to answer five questions in writing:
- What data does the system capture?
- How is the data processed (matching on the device, or on the server/cloud)?
- What data is stored, where and for how long?
- Who can access it?
- Which results are passed to the HRM/payroll system?
This is a small data map, the basis for every later review step.
3. How must your business protect biometric data?
Agencies, organisations and individuals that collect and process biometric data must apply physical security measures to the devices that store and transmit biometric data; limit access rights; have a monitoring system to detect and prevent intrusions; and comply with the relevant laws and standards. If the processing causes damage to the data subject, they must notify the data subject as required by the Government.
Analysis: Many systems are set up for convenience: a shared administrator account, and permanent remote access for the vendor. You need to answer: who may see which data, for what purpose and for how long.
| Role | Access needed | Purpose |
|---|---|---|
| HR | Attendance results | Working time and payroll |
| IT | Technical administration, only as far as needed | Operation and security |
| Vendor | Temporary access during support, logged | Maintenance and fixing faults |
| Line manager | Attendance data within their area of management | Staff management |
- Access rights should follow job needs, not the convenience of the system.
- Separate the right to view attendance results from the right to access facial templates.
- Stop using shared administrator accounts; turn on and keep access logs.
- Grant the vendor remote access case by case, for a limited time.
4. What do employees need to be told?
A common situation: HR announces “from next week the company will use facial recognition attendance”, staff stand in front of the device, register their face, and that is it. An administrative notice about the new attendance method does not deal with data governance.
- Clause 3, Article 25 of Law No. 91/2025/QH15: for employees’ personal data collected by technological or technical means, only measures that comply with the law, protect the lawful rights and interests of employees and are known to employees may be used; data collected by these means must not be processed in breach of the law.
- Where processing is based on consent, the consent must be clear and verifiable; it must not be assumed by default or presented in a misleading way (Decree No. 356/2025/ND-CP).
Analysis: Employees find it hard to really “refuse” a request from their employer, so a signature on a consent form is not enough on its own. You need to identify the legal basis for processing and the purpose, and consider an alternative for staff who do not want to register their face. Employees should be told:
- the purpose of processing and the types of data processed;
- the systems and vendors involved in the processing;
- where the data is stored and for how long;
- how to exercise their rights over the data (access, correction, withdrawal of consent, request for deletion, etc.);
- the contact point for questions or incidents.
Before choosing facial recognition, compare it with cards, codes and apps on four criteria: business need, operational efficiency, data risk and legal requirements. Considering data at the design stage costs much less than fixing problems after roll-out.
5. Do you need an impact assessment dossier?
- Article 19 of Decree No. 356/2025/ND-CP: the personal data processing impact assessment report is prepared on Form No. 10 and sent to the specialised personal data protection authority (the Department of Cybersecurity and High-Tech Crime Prevention (A05), Ministry of Public Security) within 60 days from the start of processing.
- Article 41 of Decree No. 356: micro enterprises, small enterprises, start-ups and household businesses are exempt from, or may choose whether to comply with, certain obligations (such as the impact assessment dossier and designating personal data protection personnel or a unit), except where they process sensitive personal data, directly provide personal data processing services, or process the data of a large number of data subjects.
Analysis: Because biometric data is sensitive data, a small enterprise that introduces facial recognition attendance is unlikely to be able to rely on the exemption to skip the impact assessment dossier.
6. Does the vendor contract deal with data?
Attendance system contracts usually focus on price, licence and warranty. The data section is sometimes just one sentence: “the parties shall keep information confidential”. Analysis: if the vendor stores or accesses the data, it is processing data on behalf of your business, so the contract should clearly cover:
| What to include | Question to answer |
|---|---|
| Scope of data | Which data may the vendor access? |
| Purpose | May the data be used for any other purpose? |
| Access | Which of the vendor’s staff may access it? |
| Sub-processors | Is any third party involved? |
| Security measures | Encryption, access rights, logs, server location? |
| Incidents | How quickly must the vendor inform your business? |
| End of contract | How is data returned and deleted, and confirmed in writing? |
7. What happens to the data when an employee leaves or you change vendor?
Employees’ personal data is stored for the period set by law or as agreed; it must be deleted or destroyed when the contract ends, unless otherwise agreed or otherwise provided by law.
Analysis: The leaving process usually covers locking the email account, collecting the laptop and the card, and closing the payroll. It rarely includes a step for the facial template, which may still be on the device, the server, the HRM system, the cloud, backups or with the vendor. The same applies when you change vendor: you need to know what data the old vendor still holds and whether it has confirmed deletion.
- Add a step “delete biometric data on all systems” to the leaver checklist, with a person responsible and a record of the date.
- Be clear about which data must be kept (for example, attendance records for payroll) and which must be deleted (the facial template).
- Put a clause on returning and deleting data, with written confirmation, into the vendor contract.
8. What must your business do if the attendance system is hacked?
- Clause 1, Article 23 of Law No. 91/2025/QH15: when a breach is discovered that may harm the lawful rights and interests of individuals (and in the other cases set by the Law), the data controller must notify the specialised personal data protection authority no later than 72 hours after discovery; the data processor must notify the data controller immediately.
- Article 29 of Decree No. 356/2025/ND-CP (breach notification for personal location data and biometric data): notify the affected data subjects within 72 hours of discovering the breach. The notice must state the types of data affected, how serious the breach is, the remedial measures and guidance on prevention.
Analysis: 72 hours is very short if your business only has an IT incident plan. When an administrator account is hacked, IT works to isolate the system. But who counts the affected employees, who contacts the vendor, and who drafts the notices? Without roles assigned in advance, the response easily becomes fragmented and late.
Steps to cover in the first 72 hours- Confirm the incident and isolate the system.
- Identify the data and the number of employees affected.
- Identify the systems and vendors involved.
- Assess how serious the breach is.
- Notify the specialised authority and the employees.
- Fix the problem, record it and keep the incident file.
Appoint in advance the Legal, IT and HR contacts and the decision-maker for data incidents; prepare notice templates; and ask the vendor to commit to reporting incidents to your business well within 72 hours, so your business still has time to act.
9. Where should your business start?
Do not start with the question “does the company have a consent form?”. Start with: “where is our employees’ facial data going?”. A review of a biometric attendance system should follow this order:
Biometric data review roadmap- Business purpose and necessity
- Map of systems and data flows
- Review of vendors and contracts
- Review of access rights and retention periods
- Comparison with legal obligations and identification of gaps
- Risk priorities and remediation roadmap
Analysis: The result should not just be “compliant / not compliant”. It should be a data map, a list of gaps, risk priorities and an action list. A review of attendance often reveals issues in the HRM system, payroll, cameras and personnel files. It is a good starting point for looking again at how you manage all employee data.
Quick self-check: can your business say what the system stores, where, who has access, what the vendor holds, what employees have been told, how data is deleted when they leave, and how incidents are handled? If many answers are “not sure”, review the system before simply adding another form.
FC Legal can include your biometric attendance system in an employee data review: data mapping, vendor review, access rights, retention and legal gaps.
10. Frequently asked questions
Is facial data used for attendance sensitive personal data?
Yes. Biometric data is defined in Clause 2, Article 31 of the Law on Personal Data Protection 2025 and is on the list of sensitive personal data in Point đ, Clause 1, Article 4 of Decree No. 356/2025/ND-CP. Your business must therefore apply the protection measures for sensitive data, not treat it like ordinary attendance data.
Do employees have to consent to facial recognition attendance?
Clause 3, Article 25 of the Law requires technology used to manage employees to comply with the law, protect employees’ rights and be known to employees. If processing is based on consent, the consent must be clear and verifiable, not assumed by default. The right legal basis for processing should be assessed case by case.
Are small enterprises exempt from obligations when using facial recognition attendance?
Under Article 41 of Decree No. 356/2025/ND-CP, the exemption or choice for micro, small and start-up enterprises does not apply when the business processes sensitive personal data. Because biometric data is sensitive data, a small enterprise using facial recognition attendance should carefully review obligations such as the impact assessment dossier.
When an employee leaves, must the facial data be deleted?
Clause 2, Article 25 of the Law requires employees’ personal data to be deleted or destroyed when the contract ends, unless otherwise agreed or otherwise provided by law. Your business should separate data it must keep (such as timesheets for payroll) from the facial template, and delete the template on all systems, including the vendor’s.
If employees’ facial data is leaked, how quickly must we give notice?
Article 29 of Decree No. 356/2025/ND-CP requires notice to the affected data subjects within 72 hours of discovering the breach. Clause 1, Article 23 of the Law also requires notice to the specialised personal data protection authority no later than 72 hours in the cases set by the Law.
11. Legal basis and references
- Law on Personal Data Protection No. 91/2025/QH15, passed on 26 June 2025, in force from 1 January 2026 (Articles 23, 25 and 31).
- Decree No. 356/2025/ND-CP dated 31 December 2025 detailing certain articles of, and measures to implement, the Law on Personal Data Protection, in force from 1 January 2026 (Articles 4, 19, 29 and 41).
- Decree No. 13/2023/ND-CP dated 17 April 2023 on personal data protection (replaced).
- Government electronic portal, policy-making section: rules on protecting personal location data and biometric data.
- EY Vietnam, legal alert of March 2026 on Decree No. 356/2025/ND-CP.
Review your personal data protection compliance with an FC Legal lawyer
Find out what data your business processes, where it is, which risks to deal with first and which dossiers you must prepare.
- Data map and compliance gap assessment
- Impact assessment dossiers (DPIA) and cross-border transfer dossiers
- Standard policies, vendor contracts and incident response procedures
Please do not send confidential documents or personal data through the form.
This article is for reference. It reflects the rules in force at the time of publication. For legal advice on a specific case, please contact an FC Legal lawyer.
Prepared by the FC Legal legal team and reviewed by FC Legal’s Managing Lawyer. Updated 4 October 2026.
