#30 Personal data: 03 things to know about personal data from early 2026

Hello and welcome back to The Lawyers Talk, the official podcast channel of BLawyers Vietnam. My name is Huynh Kim Thanh, and with me today is Ms. Le Thi Thanh Ha. We are happy to have you with us again for today’s episode. In this episode, we will be talking about the Law on Personal Data Protection 2025, or so-called PDPL, a new law that was officially passed on 26 June 2025 and will come into effect on 1 January 2026.

Recently, on 29 November 2025, the Government also issued Decision No. 2623/QD-TTg approving the implementation plan for this Law. Therefore, in this episode, we will raise three questions. For each question, we will look at it from two perspectives: what the law provides, and what is happening in practice, so that you can better prepare before this Law comes into force.

Guest

Hello everyone, my name is Ha, and the first question that I think everyone should pay attention to is:

1. What is personal data, and how many main subjects are regulated under the Law?

Under the PDPL, the concept of personal data is provided in Clause 1, Article 2 of this Law. To put it simply, personal data is divided into two categories: basic personal data, and sensitive personal data. These two categories are stipulated respectively in Clause 2 and Clause 3 of Article 2 of the PDPL, and will be further specified in detail according to lists to be issued by the Government in the future. At this stage, we can generally understand them as follows:

1. Basic personal data refers to personal data reflecting common personal identity and background information, which is frequently used in transactions and social relationships; and
2. Sensitive personal data refers to personal data closely related to an individual’s privacy, and when infringed, may directly affect the lawful rights and interests of agencies, organizations, or individuals.

In addition, the PDPL also regulates subjects involved in the processing of personal data, consisting of 04 main subjects, which are:

1. Personal data controller: this is the party that decides the purposes and means of processing personal data, and in practice, this role is usually enterprises;
2. Personal data processor: this is the party that carries out the processing of personal data at the request of, or under a contract with, the personal data controller;
3. Personal data controller and processor: this is the party that combines the two roles mentioned above; and
4. Third party: this is a party other than the three subjects mentioned above, which also participates in the processing of personal data.

Host

In practice, we often see a very common issue, and that is when many enterprises are not fully aware of which role they are playing under the PDPL. A lot of businesses believe that: “If the data is stored on another party’s system, then that party should be responsible for it”.

To give a specific example, a school may manage student information by hiring a third party to provide a CRM (Customer Relationship Management) system. This is a common system used to store information such as students’ or parents’ phone numbers, home addresses, or details about classes and students’ levels. In these situations, businesses or organizations often assume that the responsibility for personal data protection has been transferred to the service provider.

However, when this is reviewed under the PDPL, if the business still decides what the data is collected for and how it is used, then from a legal perspective, that business is still considered a personal data controller and remains legally responsible for that personal data.

Guest

2. What should businesses pay attention to when collecting personal data?

Under the PDPL, when collecting personal data, the first and most important point that businesses need to pay attention to is compliance with the 06 principles of personal data protection as stipulated in Article 3 of the PDPL. Among these 06 principles, there are 02 important principles that you should pay attention to when collecting personal data. These are:

1. First, personal data may only be collected and processed within an appropriate scope and for specific and clear purposes, and such collection and processing must comply with applicable laws; and
2. Second, businesses must ensure the accuracy of personal data, and such data must be corrected, updated, or supplemented when necessary; personal data should also be stored only for a period appropriate to the purpose of processing.
   For example, in cases where a job applicant is not recruited or an employment contract with an employee is terminated, the employer is required to delete or destroy the personal data of that applicant or employee, unless otherwise provided by law.

In addition to complying with the above principles, personal data may only be collected with the consent of the data subject, unless otherwise provided by law. Accordingly, the consent of the data subject is specifically regulated in Article 9 of the PDPL, which can be summarized as follows:

1. First, the consent of the data subject is only valid when it is given voluntarily and based on the data subject being fully informed of the following information:
   • the type of personal data being processed;
   • the purpose of processing;
   • who the personal data controller or the personal data controller and processor is; and
   • the rights and obligations of the data subject.
2. Second, consent must be expressed in a clear and specific way, meaning that the consent must be given in a writing form that can be verified.
3. Third, consent must comply with the principles set out under the PDPL, for example: consent must be given separately for each processing purpose; the content of consent must not be tied to mandatory conditions requiring agreement to other purposes beyond the agreed scope; and silence or non-response of the data subject must not be considered as consent, etc.

From this, the drafting of the notice and the request for consent from data subjects play a very important role for businesses.

Host

From a practical perspective, we have observed that legal risks related to personal data often arise at the very first stage of data collection. A fairly common situation is that businesses collect a large amount of personal data without clearly identifying what that data is actually necessary for, and without distinguishing which data needs to be collected and which data is unnecessary. This, in effect, indirectly violates the principles of personal data protection.

With regard to obtaining the consent of data subjects, in practice, this is often carried out in a very formalistic manner, such as:

1. Combining multiple different data processing purposes into a single consent notice, making the content lengthy and unfocused; or
2. Using very long, general, and difficult-to-understand wording, causing data subjects to give their consent without actually reading the content.

As a result, when a dispute arises or when competent authorities conduct an inspection, businesses may face difficulties in explaining and proving that: the consent was given voluntarily and with sufficient understanding, and the collection of personal data did not go beyond the stated purposes of the business.

Therefore, the drafting of consent-related content as well as the establishment of a proper consent process is a very important part of the overall personal data processing framework.

Guest

3. What should businesses pay attention to when transferring personal data across borders?

In the current business climate, the cross-border transfer of personal data is a very common activity, especially for businesses that are foreign-invested enterprises.

Under the PDPL, the transfer of personal data across borders is not prohibited. However, businesses are required to fulfil certain obligations towards the Vietnamese state authorities. Specifically, pursuant to Articles 20 and 21 of the PDPL, when transferring personal data across borders, businesses are required to carry out an impact assessment for cross-border personal data transfer and complete this assessment within 60 days from the date of the first cross-border transfer of personal data. Accordingly, businesses are required to strictly comply with this procedure.

Of course, not all cross-border transfers of personal data are subject to this obligation. Under the PDPL, the following cases are not required to carry out such an assessment, including:

1. cross-border transfers of personal data carried out by competent state authorities;
2. in cases where an agency or organization stores the personal data of its employees on cloud computing services;
3. in cases where the data subject personally transfers his or her own personal data across borders; and
4. Other cases as prescribed by the Government.

Host

Thank you, Ha. And that brings us to the end of today’s podcast. If you find this topic useful, or if you have any questions or concerns, please feel free to leave a comment below so that we can support you. For more information about BLawyers Vietnam, we invite you to visit our website, which is shown below The Lawyers Talk podcast screen.

Thank you for listening, and see you next time!

The above is not official advice from BLawyers Vietnam. If you have any questions or suggestions about the above, please contact us at info@blawyersvn.com. We would love to hear from you.

Date: 29 December 2025