A company's candidate records do not automatically transfer to another company

Under compliance guidance for the Personal Data Protection Law 2025, an applicant's records held by company A cannot automatically transfer to company B without a lawful processing basis. For job-connection programmes, careers fairs and shared multi-employer assessment models, this is a condition to handle in the registration form itself rather than after results are out.

The prevailing model and where it runs into difficulty

A great deal of recruitment activity today is designed around one organisation collecting candidate records and then passing them to multiple employers. University careers fairs, connection programmes run by industry associations, shared aptitude assessment platforms, and even simple cases such as one company passing surplus records to a sister company within the same group.

The reasoning behind these models is economically sound. Candidates have already put in the effort to prepare a record and sit an assessment once, that result can serve several opportunities, and employers gain access to a pre-screened candidate pool without paying attraction costs again.

The difficulty is that the economic value of the model does not create a legal basis for transferring the data. That basis has to be established at the moment the candidate provides their information, with wording that states clearly who the data will be transferred to and for what purpose.

VCO Group operates application intake and assessment systems for a number of programmes with exactly this shared structure, so most of what follows comes from the process of reviewing forms and consent flows before a programme opens.

Three common situations and the level of risk in each

The three situations below look alike operationally but differ markedly in the level of preparation required.

Three candidate data transfer situations and their conditions

What all three share is that the consent wording must identify who will receive the data and for what purpose. Generic wording along the lines of permitting sharing with partners does not meet this requirement.

Why asking again after results are out does not solve the problem

The option that comes to mind first is to wait until results are known and only then contact the candidate for permission to transfer their record. This sounds safer, because the candidate knows the specific opportunity before deciding.

There are two problems with it. First, the act of making contact to ask is itself a data processing activity, so it too requires a valid basis established beforehand. Second, operationally, the response rate to a permission request sent by email after a candidate has received an unsuccessful outcome is usually very low, and most of the highest-value records are lost.

The more effective approach is to ask at the point where the candidate's motivation is highest, which is while they are filling in the form to join the programme. At that moment, a tick box stating clearly that the record may be introduced to other employers in the programme usually attracts a high consent rate, because candidates see it as a benefit rather than a demand.

One accompanying condition is worth noting: this consent must be optional, it cannot be made a condition of submitting an application, and the candidate has the right to withdraw it at any time. On withdrawal, the employer must delete or anonymise the corresponding data.

A consent structure for a multi-employer connection programme

The structure below is the way these programmes are commonly organised when several employers take part. It separates each purpose clearly and keeps the choice with the candidate.

Four consent layers for an assessment and job-connection programme

These four layers should appear as four separate boxes in the form, with a record kept of when the candidate consented and to what, so that it can be evidenced later.

There is a benefit beyond compliance worth noting. The proportion of candidates who actively opt in to being introduced to a given employer is a measure of that employer brand's appeal, obtained free of charge within the form itself and comparable across the employers taking part in the same programme.

Placing this in a regional context

This tightening is not unique to Vietnam, and for multinationals operating here, setting the two regulatory frameworks side by side usually makes the conversation with regional legal move faster.

The European Union's Artificial Intelligence Act classifies systems used for recruitment, screening and ranking candidates as high risk, with obligations covering data governance, documentation and human oversight. Notably, that framework draws a clear distinction between the party developing the system and the party deploying it, and both share responsibility.

This means that in a multi-employer connection model, both the organiser and each employer receiving data carry their own share of responsibility, and this allocation of responsibility should sit in the contract between the parties rather than being left to default.

For programmes being designed for the 2027 recruitment season, this is an item to bring in at the stage of agreeing terms with participating employers, because adding a data processing annex after a programme is already running usually takes far longer than including it from the outset.

Three things to do

1. Split consent in the form into separate layers by purpose, with the introduction of records to other employers as an optional box that can be ticked employer by employer.
2. Collect consent at the point the candidate fills in the form rather than asking again after results, because the later response rate is very low and the act of making contact itself requires a valid basis.
3. Bring a data processing and responsibility allocation annex between the organiser and each participating employer into the agreement from the programme design stage.

Frequently asked questions

Can candidate records be transferred to another company?

Under compliance guidance for the Personal Data Protection Law 2025, an applicant's records held by company A cannot automatically transfer to company B without a lawful processing basis. That basis must be established at the moment the candidate provides their information, with wording that states clearly who the data will be transferred to and for what purpose.

Does transferring records to a sister company in the same group need separate consent?

Being in the same group does not automatically create a basis for transfer, because these are still two separate legal entities. The consent wording needs to state clearly that data may be transferred to group companies, together with a list or a criterion identifying those companies.

When should consent to transfer records be obtained?

At the point the candidate fills in the participation form, when their motivation is highest and when being introduced to several employers is seen as a benefit. Asking again after a candidate has received an unsuccessful outcome usually produces a very low response rate, and the act of making that contact also requires a valid basis.

Note

This article provides reference information to support operational review. It is not legal advice and does not replace legal advice for any individual company's circumstances. VCO Group is not a law practice. Companies should refer directly to the relevant legislation and consult their legal function or a legal adviser before applying anything set out here.

About VCO Group

VCO Group operates the assessment infrastructure behind Young Talent Programmes and Management Trainee schemes in Vietnam, covering application intake, aptitude testing, automated interviewing and Assessment Centres. VCO Group serves young talent and candidates with under three years of experience, working with large enterprises and multinationals in Vietnam. Its assessment and candidate management platform is called Testalents. Head office in Ho Chi Minh City.

If you would like to benchmark your own selection data against the market, or discuss the Young Talent Program Insight Report, contact Mr. Dung on 0334 889 068 or visit vcogroup.com.vn.