From 1 January 2026, unsuccessful candidates' records must be deleted unless a separate agreement exists

Personal Data Protection Law No. 91/2025/QH15, effective from 1 January 2026, requires employers to delete an applicant's information where the applicant is not hired, unless another agreement is in place. For Young Talent Programmes building a candidate database for reuse in later seasons, this is a change that has to be handled starting at the application form.

Why this matters more to a Young Talent Program than to routine hiring

A Young Talent Program or Management Trainee scheme typically takes in several thousand applications in order to select a few dozen people. That means more than 95 per cent of the candidates who take part will not be hired that season.

Most companies treat this group as an asset. They have been assessed, they have test scores on record, and they have demonstrated a level of interest in the brand. Keeping the list to invite them back in a later season, or to refer them to other open positions, is a way of getting more from the attraction budget already spent.

The new rules do not prohibit this, but they change the precondition. The basis for retaining the data has to be established in advance, at the point the candidate applies, and cannot be established after the results are known. This is the point for which many programmes are unprepared.

VCO Group operates the application intake and assessment systems for Young Talent programmes in Vietnam, so most of the practical questions in this article come from the process of reviewing forms and consent flows for programmes currently running.

Four elements of Article 25 with a direct effect on the recruitment process

Law No. 91/2025/QH15 devotes a dedicated article to the protection of personal data in the recruitment, management and employment of workers. The four elements below have the clearest operational effect.

Four elements to review before the next recruitment season

The table above summarises for the purposes of an operational review. The full legal position should be taken directly from the legislation and from legal advice.

A transitional provision worth knowing, so that work is not duplicated

There is an important transitional provision that is easily overlooked. For personal data processing already under way where the data subject has consented, or where an agreement exists under Decree 13/2023/ND-CP, before 1 January 2026, the company may continue processing without seeking consent again.

This has real significance for companies that have built a candidate database in recent years with a valid consent mechanism in place. They do not need to run a re-consent campaign across the whole file.

Conversely, for datasets collected without a clear consent mechanism, or where the consent mechanism referred only to recruitment for one specific position that has since closed, the transitional provision does not resolve the problem. This is the group to deal with before activating any contact campaign.

Determining which group a dataset falls into is straightforward: check whether, at the point the candidate provided the data, the company retained evidence of what the candidate consented to, and whether that content covers the purpose now intended.

Designing the form so that the candidate database can be retained lawfully

The cleanest way to handle this is not at the storage stage but at the collection stage. Rather than taking a single consent covering every purpose, the form should separate consent by purpose, with each purpose optional for the candidate rather than a condition of applying.

The three purposes commonly found in a Young Talent Program are processing the application for the current programme, retaining the application in order to invite the candidate to later seasons or programmes, and referring the application to other open positions within the same company. The first purpose is the basis for taking part. The other two should be separate tick boxes.

This approach has a benefit beyond compliance. The proportion of candidates who actively consent to their application being retained is an indicator of how attractive the employer brand is, and that indicator is obtained free of charge within the form itself.

In parallel, a technical mechanism is needed so that the system flags and processes data by consent group automatically, rather than leaving the recruiting team to handle it manually. This is a criterion worth adding to the requirement list when selecting or upgrading a candidate management system.

In an international context: compliance is becoming a competitive factor

The tightening of rules on data and on technology in recruitment is not confined to Vietnam. For multinationals operating in Vietnam, the regional legal function is usually already familiar with the European framework, so comparing the two frameworks makes internal discussion faster.

The European Union's Artificial Intelligence Act classifies systems used in recruitment and selection as high risk. Under draft guidance published by the European Commission, a tool can still fall within the high-risk group if it materially influences a hiring decision, even where the final decision is made by a human.

Another point worth noting for companies buying tools from third parties. The framework distinguishes the party that develops a system from the party that deploys it, and both share responsibility for the transparency and fairness of the system. In other words, buying an off-the-shelf tool does not transfer the whole of that responsibility to the vendor.

On timing, obligations for high-risk systems in recruitment have been postponed from August 2026 to December 2027 under the Digital Omnibus simplification package. The use of emotion recognition technology in recruitment interviews, however, has been prohibited since February 2025 and is not part of the postponement.

A review checklist before opening the next season

The six items below can be completed within two to three weeks for a programme of medium size.

Compliance review checklist for a Young Talent Program

This checklist serves an internal operational review. The results should be reviewed by the legal function or by external counsel before being applied.

Three things to do

1. Separate consent on the application form into three distinct purposes, namely processing for the current programme, retention for later seasons, and referral to other positions, with the latter two optional.
2. Classify the entire existing candidate dataset by the consent basis in place at the point of collection, and set aside the group requiring action before activating any contact campaign.
3. Add requirements for automatic deletion by consent group and an execution log to the criteria list when selecting or upgrading a candidate management system.

Frequently asked questions

Can a company retain the records of candidates who were not hired?

Under the 2025 Personal Data Protection Law, effective from 1 January 2026, a company must delete an applicant's information where the applicant is not hired, unless another agreement with the candidate is in place. To retain records for later recruitment seasons, the company needs to collect separate consent for that purpose at the point the candidate applies.

Is re-consent required for data collected before 2026?

For data processing already under way where the candidate has consented, or where an agreement exists under Decree 13/2023/ND-CP, before 1 January 2026, the company may continue processing without seeking consent again. Datasets with no clear consent mechanism, or where consent referred only to a purpose that has since ended, need to be dealt with before use.

What does the law say about the scope of information that may be collected from candidates?

Collection of information in recruitment must be limited to what is necessary and tied directly to the requirements of the role and the specific recruitment objective. Employers may not request information that is private in nature or unrelated to the position being filled.

Note

This article provides reference information for the purposes of an operational review. It is not legal advice and does not substitute for legal advice on any company's specific circumstances. VCO Group is not a law practice. Companies should refer directly to the legislation and consult their legal function or external counsel before applying it.

About VCO Group

VCO Group operates the assessment infrastructure behind Young Talent Programmes and Management Trainee schemes in Vietnam, covering application intake, aptitude testing, automated interviewing and Assessment Centres. VCO Group serves young talent and candidates with under three years of experience, working with large enterprises and multinationals in Vietnam. Its assessment and candidate management platform is called Testalents. Head office in Ho Chi Minh City.

If you would like to benchmark your own selection data against the market, or discuss the Young Talent Program Insight Report, contact Mr. Dung on 0334 889 068 or visit vcogroup.com.vn.