In the context of digital transformation and business operations increasingly relying on the collection, storage, and exploitation of information relating to customers, employees, and business partners, personal data has become an important resource for businesses. However, improper processing of personal data may give rise to significant legal risks, directly affecting individuals' privacy rights as well as a business's reputation and operations.

In particular, as of 1 January 2026, the Law on Personal Data Protection No. 91/2025/QH15 officially came into force, establishing a new legal framework governing data subjects' rights and the responsibilities of organizations and individuals involved in personal data processing activities. What obligations must businesses therefore fulfill to ensure compliance with the law?

1. What is personal data? Which businesses are subject to personal data protection regulations?

Pursuant to Clause 1, Article 2 of the Law on Personal Data Protection 2025, personal data means digital data or information in another form that identifies or helps identify a specific individual, including basic personal data and sensitive personal data.

In business operations, personal data may include:

- Identification information: Full name, date of birth, Citizen Identity Card (ID) number, and passport number;

- Contact information: Residential address, telephone number, and email address;

- Financial information: Bank account information and other financial information associated with an individual;

- Employee information: Personnel records, employment history, income, and other related information;

- Customer information: Transaction history, purchasing preferences, and information relating to the use of products or services;

- Sensitive personal data: Data classified as sensitive personal data under applicable laws, which may directly affect an individual's lawful rights and interests if compromised.

Pursuant to Article 1 of the Law on Personal Data Protection 2025, its scope of application is not limited to Vietnamese agencies, organizations, and individuals, but also extends to foreign organizations and individuals in Vietnam and certain foreign entities directly involved in or related to personal data processing activities concerning Vietnamese citizens.

Accordingly, businesses should identify all activities involving the collection, storage, use, sharing, and processing of personal data conducted in the course of their operations in order to determine their corresponding compliance obligations.

2. Legal obligations that businesses must fulfill when processing personal data

2.1. Determine the purposes and lawful grounds for personal data processing

Businesses must clearly determine the purposes of personal data processing before collecting and using such information. Data collection must be associated with specific, lawful purposes and must be consistent with the intended processing activities.

For example, collecting a customer's telephone number for delivery purposes does not automatically entitle a business to use that number for advertising or disclose it to third parties for marketing purposes.

In particular, businesses should note that personal data processing must have a lawful basis under the Law on Personal Data Protection. The data subject's consent is an important lawful basis, but it is not the only permissible basis in all circumstances. Businesses should also examine cases in which personal data may be processed without consent as permitted by law.

2.2. Ensure the rights of data subjects

Pursuant to Clause 1, Article 4 of the Law on Personal Data Protection 2025, individuals have the following fundamental rights in relation to their personal data:

- The right to be informed about personal data processing activities;

- The right to give or withhold consent and to request the withdrawal of consent to personal data processing;

- The right to access and request the correction of personal data;

- The right to request the provision, deletion, or restriction of personal data processing;

- The right to object to personal data processing;

- The right to lodge complaints, file denunciations, initiate legal proceedings, and claim compensation for damages in accordance with the law.

Accordingly, businesses are not only responsible for protecting personal information but must also establish mechanisms for receiving and handling lawful requests from data subjects.

For example, when a customer requests the deletion of personal information previously provided, the business must consider the legal grounds for processing, the purpose of retention, and any statutory data retention obligations before addressing such a request appropriately.

2.3. Establish personal data protection measures

Businesses must develop and implement appropriate administrative and technical measures to minimize the risks of unauthorized access, disclosure, misappropriation, alteration, or loss of personal data.

Some measures that businesses may implement include:

- Restricting data access rights based on the functions and responsibilities of each department;

- Establishing procedures for managing, storing, and disposing of data;

- Applying appropriate security measures to information systems;

- Controlling the copying, downloading, and internal sharing of data;

- Developing incident response procedures for personal data-related incidents;

- Training employees on their information confidentiality and data protection responsibilities during the course of their employment.

In particular, businesses should control employees' use of customer, business partner, and colleague information to ensure that such information is not used beyond the scope of their assigned duties.

2.4. Review the sharing and transfer of personal data to third parties

In the course of business operations, businesses frequently share data with service providers, delivery companies, marketing partners, technology platforms, or overseas parent companies.

Data sharing must be assessed based on the purpose of processing, the respective roles of the parties, and the applicable lawful grounds. Businesses should clearly define the parties' contractual responsibilities, the scope of data access, security measures, and procedures for handling violations or incidents.

With respect to cross-border transfers of personal data, businesses should pay particular attention to the applicable conditions and impact assessment obligations under the Law on Personal Data Protection 2025 and Decree No. 356/2025/ND-CP.

2.5. Establish documentation and management mechanisms for personal data processing

Businesses should review and establish an internal documentation system for managing personal data, depending on their respective roles, scale, and actual processing activities.

Such documentation may include:

- Personal Data Protection Policies;

- Personal data processing notices for customers and employees;

- Consent forms and records where required by law;

- Procedures for receiving and handling data subjects' requests;

- Internal regulations on data access rights and access control;

- Data processing agreements with business partners;

- Personal data processing impact assessment dossiers and documentation relating to cross-border transfers, where applicable.

In addition, businesses should review the applicable requirements concerning the appointment of personnel or the establishment of a personal data protection department. It should not be assumed that all businesses are subject to identical obligations or exemptions.

3. What legal consequences may businesses face for violations?

Pursuant to Article 8 of the Law on Personal Data Protection 2025, organizations and individuals committing violations of personal data protection regulations may, depending on the nature and severity of the violations, be subject to administrative sanctions or criminal prosecution. Where damage is caused, they may also be required to pay compensation in accordance with the law.

Notably, the Law provides for the following maximum administrative fines applicable to organizations:

- For violations involving the purchase or sale of personal data: A maximum fine of up to 10 times the proceeds obtained from the violation may be imposed where the proceeds-based calculation method applies;

- For violations of regulations on cross-border transfers of personal data: The maximum fine may reach 5% of the revenue generated in the immediately preceding year;

- For other violations in the field of personal data protection: The maximum administrative fine is 3 billion VND.

It should be noted that these are maximum fine levels applicable to different categories of violations and are not automatically imposed in every case. The specific penalty must be determined based on the nature and severity of the violation and other applicable administrative sanctioning regulations.

In addition to administrative sanctions, the disclosure or loss of personal data may also result in disputes, compensation claims, loss of customer trust, and adverse impacts on business operations.

4. What should businesses do to proactively prevent legal risks?

To minimize the risk of violations, businesses should proactively implement the following measures:

First, review all personal data currently under their management. Identify the sources from which the data is collected, its classification, where it is stored, and which departments are authorized to access it.

Second, verify the purposes and lawful grounds for data processing. Review each activity involving the collection, use, and sharing of data against applicable legal requirements to identify activities that lack appropriate lawful grounds.

Third, review contracts and internal policies. Amend contracts with customers, employees, and business partners that contain provisions relating to personal data processing.

Fourth, establish data security and incident response procedures. Assign specific responsibilities to relevant departments and establish mechanisms for receiving and handling data subjects' requests.

Fifth, conduct regular training and compliance reviews. Employees should be informed of their data confidentiality responsibilities, particularly those who have direct access to customer and employee data.

In conclusion, compliance with personal data protection regulations is not merely a legal requirement but also an important factor in corporate risk management and the development of business credibility.

Legal Grounds:

1. Law on Personal Data Protection No. 91/2025/QH15 dated 26 June 2025, effective from 1 January 2026.

2. Decree No. 356/2025/ND-CP dated 31 December 2025 of the Government, detailing certain provisions and measures for the implementation of the Law on Personal Data Protection, effective from 1 January 2026.

3. Other relevant legal instruments governing personal data protection and administrative sanctions in the field of data.

Disclaimer: This article is intended for general legal information purposes only and does not constitute legal advice in relation to any specific case.