Developing an anti-sexual harassment policy: What should businesses pay special attention to from early 2026?

According to the 2019 Labor Code and its guiding regulations, employers are required to issue a policy and procedures for handling acts of sexual harassment (“SH”), ensuring that employees work in a safe environment free from discrimination and harm to dignity. In addition, when the Personal Data Protection Law 2025 takes effect on 01 January 2026, the investigation, handling, and storage of information related to SH cases will require businesses to strictly comply with the regulations on the collection, use, and protection of personal data of all relevant parties.

In this article, BLawyers Vietnam sets out two key considerations that businesses should pay attention to when developing a substantive and effective Anti-Sexual Harassment Policy (“ASHP”), ensuring a balance between compliance with labor regulations and the responsibility to safeguard personal data.

1. Employer’s obligation to develop and implement an ASHP

To ensure gender equality and workplace safety, developing an ASHP is a mandatory obligation for employers. Below are several key points that businesses should consider when establishing an ASHP:

(i) ASHP is one of the mandatory contents required in an employer’s internal labor regulations (“ILR”). At the same time, employers are obligated to issue an ILR, if an employer uses 10 or more employees, the ILR must be in writing; if an employer has fewer than 10 employees, a written ILR is not mandatory, but the parties must agree on labor discipline and material responsibility in the labor contract.

In practice, many small enterprises with fewer than 10 employees do not issue a written ILR and overlook the development of an ASHP, resulting in difficulties when handling SH incidents in the workplace due to the absence of a clear procedure.

(ii) Mandatory contents of an ASHP include:

1. Prohibiting SH in the workplace;
2. Clearly and specifically identifying SH behaviors, suitable to the nature of the business sector and workplace environment;
3. Establishing internal handling procedures: responsibilities, deadlines, steps for receiving and resolving complaints and denunciations, and other related provisions;
4. Specifying disciplinary measures corresponding to the nature and severity of the violation, including for individuals who make false accusations;
5. Compensation for victims and measures to remedy the consequences.

Although the legal framework is relatively complete, most enterprises still develop ASHP by merely referring to statutory provisions, without specifying behaviors, procedures, or the responsibilities of each department. For example, direct sexual harassment at a factory differs from online sexual harassment at a technology company. This makes the policy impractical and lacking guidance or effectiveness when disputes arise.

(iii) Responsibility for implementing the ASHP and protecting whistleblowers:

Issuing the policy is only the first step; more importantly, enterprises must implement and supervise the application of the ASHP. Accordingly, employers need to:

1. Disseminate and communicate the policy to all employees;
2. Establish procedures for receiving, verifying, and resolving complaints and denunciations;
3. Ensure the confidentiality of the identities, dignity, and personal data of all involved parties, avoiding “secondary harassment” caused by rumors or unnecessary disclosure;
4. Establish whistleblower protection mechanisms, including anonymous reporting channels, independent intake procedures, and a prohibition against retaliation or discrimination.

Under Decree No. 12/2022/ND-CP, any individual committing SH in the workplace but not to the extent of criminal prosecution may be administratively fined from VND15 million to VND30 million, applicable to employees, employers, partners, or customers.

(iv) Limitations and shortcomings in the practical implementation of an ASHP in enterprises

Although the Labor Code 2019 is more advanced than its predecessor, current regulations remain general, lacking detailed guidance on:

• First, the law does not provide standards for evidence, making it difficult to collect evidence to handle SH in the workplace. In reality, evidence is often provided by only one party (usually the victim), and SH often occurs in private spaces with no or few witnesses. Even if recorded by cameras, the footage may not be sufficiently clear, complete, or objective to serve as evidence.
• Second, regarding internal investigation procedures, enterprises face limitations on workplace location and working hours. However, SH behaviors may occur outside such boundaries or be recorded on employees’ personal applications. This raises the issue that enterprises must ensure employees’ privacy rights and particularly comply with personal data protection obligations, as presented in Item 2 below.
• Third, a current ILR cannot be applied to individuals who are not part of the labor relationship (such as customers or partners). Therefore, when SH is committed by these individuals, enterprises remain uncertain due to the lack of specific legal guidance on how to handle such cases.
• Fourth, enterprises must identify SH cases with possible criminal elements and transfer them to the competent police authority. During this process, enterprises may temporarily suspend the accused employee to ensure workplace safety and avoid interfering with the investigation. The suspension must not exceed 90 days for complicated cases, and during this period, the employee must receive 50% of their salary in advance. Enterprises should actively monitor and urge the police to issue an investigation conclusion. Prolonged suspension without clear grounds or conclusions may expose the enterprise to lawsuits claiming compensation for wages, lost benefits, and mental damages.

These are practical issues that enterprises must consider when developing an ASHP to avoid creating a policy that is merely formalistic, lacking specific mechanisms for handling incidents, and potentially causing legal risks for the enterprise.

2. Handling SH in the context of compliance with personal data protection regulations

When developing an ASHP, enterprises must pay attention to compliance obligations relating to personal data protection, specifically:

(i) Collection and processing of personal data during SH case handling: Data collected during SH case handling, such as statements, emails, messages, images, videos, recordings, and personal information of involved parties may be considered sensitive personal data because they may reveal a person’s sexual life or sexual orientation.

Under the Law on Personal Data Protection 2025, effective from 01 January 2026 (“LPDP 2025”), sensitive personal data is broadly defined as data relating to an individual’s privacy and will be listed by the Government. The draft implementing decree identifies “data revealing sexual life or sexual orientation” as sensitive personal data that must be subject to strict processing procedures and enhanced security measures.

(ii) Obligations and principles for processing personal data during SH investigations: Enterprises must exercise caution when collecting and processing personal data, especially sensitive personal data. Under LPDP 2025, all data processing activities must be conducted “within the correct scope and for specific, clear purposes in compliance with the law.” Accordingly, enterprises need to:

1. Obtain employee consent or agreement for the collection and processing of data in cases involving SH. This consent should be formalized in the labor contract, collective labor agreement, or internal policies;
2. Ensure compliance with data protection principles, including accuracy, scope limitation, appropriate retention periods, and technical security measures. The LPDP 2025 requires that data be retained only “for a period appropriate to the processing purpose.” Thus, once an SH case is fully resolved, unnecessary data must be deleted, anonymized, or encrypted;
3. Restrict access to SH-related data; enterprises must clearly define who is permitted to access such data. Evidence such as images, videos, or recordings of SH cannot be shared arbitrarily via internal emails or workplace chat groups. Only those with relevant responsibilities or lawful authorization may access the data and must commit to strict confidentiality. The disclosure or circulation of sensitive content, even for the purpose of “transparency”, may constitute unlawful personal data processing, a prohibited act under the LPDP 2025.

(iii) Despite the LPDP 2025’s progressive approach, several issues remain unclear or may conflict with labor law when applied to SH case handling:

1. Issues relating to the employee’s consent:
   • In employment relationships, consent to data processing is often embedded in contracts or policies, raising concerns about whether such consent is truly voluntary.
   • Under the LPDP 2025, employees may withdraw consent at any time. If consent is withdrawn during an SH investigation, enterprises face a dilemma: continuing to process data may violate the law, but stopping may hinder the investigation.
   • For SH handled without employee consent, enterprises must prove that data processing is necessary to protect the legitimate rights or interests of employees.
2. Lack of specific regulations on storage, sharing, and destruction of investigation data: The LPDP 2025 only provides the general principle of “appropriate retention period,” without specifying who determines the period or how sensitive evidence should be preserved or destroyed. This creates risks when enterprises must balance privacy protection with the need to prevent future disputes.
3. No clear guidance on data breach notification during internal investigations: In practice, if SH-related images or information are leaked, it remains unclear whether enterprises must notify employees and State authorities. The LPDP 2025 does not yet specify the procedure for such cases in the internal workplace context.
4. When SH cases are transferred to the police, the LPDP 2025 does not yet clarify how enterprises must lawfully transfer sensitive personal data to law enforcement.

Enterprises should therefore proactively integrate personal data protection requirements into their ASHP and ILR not only to comply with the LPDP 2025 but also to create a safe, respectful, and transparent workplace environment.

Legal support from BLawyers Vietnam

BLawyers Vietnam can assist enterprises with the following:

1. Reviewing and advising on ASHP development

• Assessing the current ASHP and existing internal regulations;
• Proposing, drafting, or revising ASHP contents to ensure compliance;
• Advising on incorporating personal data protection requirements into ILR, labor contracts, and related internal policies.

2. Advising on the handling of SH cases in the workplace

• Guiding procedures for receiving, verifying, and handling SH complaints in accordance with laws and internal regulations;
• Advising on lawful collection, use, and storage of evidence under the Law on Personal Data Protection;
• Drafting or reviewing notices, disciplinary decisions, minutes, and internal reports to minimize legal risks;
• Representing enterprises in working with parties involved in SH matters to ensure compliance with the law.

The above is not official advice from BLawyers Vietnam. If you have any questions or suggestions about the above, please contact us at info@blawyersvn.com. BLawyers Vietnam would love to hear from you.

Date: 2 December 2025

Writer: Chau Dang