Beginning September 10, 2026, Government Decree No. 283/2026/ND-CP on administrative penalties in the fields of labor, social insurance, and Vietnamese workers employed overseas under contract will take effect.
A notable new provision imposes fines ranging from US$1,910 to US$2,670 on organizations and individuals that illegally buy, sell, exchange, or appropriate information and data contained in the labor database, as well as labor market information that has not yet been officially released or published by competent state authorities.
Ho Thi Thanh Hai, Human Resources Director and Legal Director at a company in Ho Chi Minh City, said her company stores employees' paper records in a dedicated area managed by the Human Resources Department. Other departments may access the data only after submitting a request approved by the company's executive management.
Electronic records are managed through the company's internal software system, with access rights assigned under internal regulations.
To comply with the new personal data protection requirements, the company has issued internal regulations on the processing and protection of personal data. Job applicants and employees are required to provide written consent allowing the company to use their personal information for recruitment and employment management purposes.
For third parties, the company has added contractual provisions requiring the protection of personal data in an effort to reduce the risk of information leaks or unauthorized disclosure.
Associate Professor Doan Thi Phuong Diep of the University of Economics and Law under Vietnam National University Ho Chi Minh City said that, in the context of the introduction of personal data protection regulations, the provisions of Decree No. 283/2026/ND-CP are appropriate because they indirectly reinforce employers' obligation to protect employees' personal data.
She said the decree clarifies employers' responsibilities and strengthens the deterrent effect of the law in practice.
According to Associate Professor Doan Thi Phuong Diep, businesses should immediately implement measures such as establishing a dedicated unit or appointing a responsible person to oversee personal data protection and monitor the management and use of employees' personal information.
Companies should also incorporate personal data protection responsibilities into workplace regulations and provide legal guidance on the issue to departments involved in managing and processing employee data.
