Why policies alone are no longer enough, and which records Vietnamese employers should have ready under the 2025–2026 labour, social insurance and data protection reforms

Vietnam’s labour and employment framework has changed significantly over 2025 and 2026. New laws on social insurance, trade unions, employment and personal data protection are now in force, and since 10 September 2026 Decree 283/2026/ND-CP has replaced Decree 12/2022/ND-CP as the penalty framework for labour and social insurance violations.

The change for employers is that it is now no longer only about whether policies exist, but whether the company can show, through records, that those policies are followed in practice. This article sets out five areas worth reviewing in 2026, the main risk in each and the evidence to keep on file.

Key 2026 Legal Milestones

Why Records Matter More Under Decree 283

Decree 283 raises the cost of weak documentation. Fines can reach VND 75 million per violation for an individual, and organisations are generally fined at twice the individual level, meaning up to VND 150 million per violation. Three features matter most for the five areas below:

• Under-declared insurance salary may be assessed as social insurance evasion, with fines of 18% to 20% of the evaded amount, rather than as a simple administrative error.
• Labour registration is now a stand-alone rule. Completing social insurance registration does not, on its own, satisfy the labour registration requirement.
• Serious violations may be referred for criminal prosecution. Examples include forged records and violations of an employee’s dignity or honour during disciplinary processes.

1. Internal Labour Regulations

Employers with 10 or more employees must have written internal labour regulations and register them within the statutory timeframe. The regulations should be prepared after consulting the employee representative organisation at the workplace, where one exists, and then publicised as required. They should cover working and rest hours, workplace order, occupational safety and health, prevention of workplace sexual harassment, disciplinary rules, material liability and disciplinary authority.

Key risk: Incomplete disciplinary provisions, or skipped consultation, registration or publication steps, weaken the employer’s position when it needs to enforce the rules. For disciplinary dismissal, the misconduct and the corresponding sanction must be clearly and lawfully reflected in the regulations. Given the dignity safeguards noted above, the disciplinary process itself should also be handled carefully.

Keep on file: the issued regulations, consultation records, evidence of registration, and evidence of publication or posting.

2. Compensation and Bonus Policies

Salary, allowances and supplementary remuneration should be clearly defined in employment contracts and relevant internal documents. Bonus rules and any performance evaluation criteria should be established and communicated to employees.

The social insurance contribution base should be determined by the legal nature of each income component, its payment conditions and the rules that apply to it, not by the label the company gives it. A payment called a “bonus” or “support allowance” is not automatically outside the contribution base.

Key risk: Inconsistent classification or documentation of income components can lead to underpayment of mandatory social insurance contributions, which Decree 283 may treat as evasion. Where performance results support employment decisions, the criteria must be objective, communicated and backed by assessment records.

Keep on file: employment contracts, salary and bonus regulations, payroll records, social insurance contribution records, and performance assessment records where used.

3. Salary Scales, Payroll Tables and Labour Norms

Employers should develop and issue salary scales, payroll tables and labour norms in accordance with the Labour Code. As with internal regulations, the employee representative organisation should be consulted where one exists, and the documents publicised before they apply. Labour norms should be trialled before formal issuance.

Key risk: The common problem is inconsistency: a salary scale that says one thing, contracts that say another, and actual pay that reflects a third position. Such gaps create labour and social insurance exposure. The contribution base should be assessed separately under the applicable social insurance rules rather than assumed to mirror the salary scale.

Keep on file: the issued salary scale and payroll table, consultation records, publication evidence, and records of the labour norm trial.

4. Workplace Democracy and Dialogue

Employers should establish and maintain workplace democracy regulations and hold periodic dialogue at least once a year, together with any other dialogue the law requires. Employee conferences should be organised where applicable, and prescribed information publicised.

Key risk: This area is often treated as a formality, but the consequences extend beyond the obligation itself. Failure to hold dialogue, consult or disclose information as required can affect the process for certain HR decisions, so a decision may be challenged on procedural grounds even where the business reason is sound.

Keep on file: the workplace democracy regulation, the list of dialogue representatives, minutes of periodic and ad hoc dialogues, employee conference records, and evidence of publication.

5. Personal Data Protection

The Personal Data Protection Law and Decree 356/2025/ND-CP establish Vietnam’s first statute-level data protection framework. For employers, candidate and employee data is squarely in scope, and payroll data deserves particular care because information such as income and bank account details falls within the category of sensitive personal data, which attracts enhanced safeguards.

Employers should identify the legal basis for each processing activity and manage consent properly where consent is the basis relied upon. Consent must be voluntary, clear and verifiable, and employees may withdraw it. Employers should also review how data is collected, used, stored, shared and deleted, and check arrangements with payroll or HR providers. Depending on the organisation, further obligations may include appointing a Data Protection Officer, preparing impact assessment dossiers and notifying the Ministry of Public Security of a qualifying breach within 72 hours.

Key risk: Unauthorised collection, use, sharing, retention or disclosure of personal data creates regulatory and operational risk. The employer’s role in a processing arrangement depends on the purpose and means of processing, so outsourced payroll and HR arrangements should be reviewed individually. Transitional relief for micro, small and start-up businesses may not be available where sensitive data is processed directly, so eligibility should be confirmed before it is relied on.

Keep on file: privacy notices and policies, records supporting the legal basis, consent records, retention and deletion procedures, third-party processing agreements, and impact assessment documents where required.

Priorities for Employers: Review, Align and Document

Employers can start with five practical actions:

• Review internal labour regulations and confirm that registration, consultation and publication requirements have been met.
• Reconcile salary structures across employment contracts, payroll records and social insurance declarations, and confirm that labour registration runs alongside social insurance registration.
• Update bonus rules and performance evaluation frameworks where relevant.
• Maintain evidence of workplace consultation, dialogue and employee communication.
• Review personal data practices and third-party HR and payroll arrangements.

A review of this kind should take place at least annually, and whenever there is a material change in legislation, in the company’s employment structure or in its remuneration arrangements.

Across all five areas, the same principle applies: compliance is judged not only by what policies say, but by what the records prove. Consultation minutes, registration evidence, payroll reconciliations and data processing agreements are the documents that turn a policy into a defensible position. Employers that review these areas early will be better placed to respond to inspections and to manage the new penalty framework with confidence.

To discuss your payroll, employment and compliance arrangements in Vietnam, contact Alitium at vietnam@alitium.com.

********

This article is intended to provide an overview of recent updates and announcements. While it aims to present useful insights, it is important to note that the content shared here should not be considered as formal legal, tax or financial advice. For specific guidance on tax obligations or legal matters related to your business, we strongly recommend consulting with a qualified professional, such as a tax advisor or legal expert or directly reach out to us.