Artificial Intelligence (AI) is gradually becoming a global technological trend, offering numerous benefits while also posing significant legal challenges. The collection, analysis, and processing of personal data (“PD”) by AI systems may result in usage beyond the original intended purposes, thereby increasing the risk of leakage of sensitive personal information and infringing upon individuals’ privacy rights. In response to this reality, Vietnamese law is progressively developing a legal framework to safeguard personal data.
In this article, BLawyers Vietnam outlines key legal provisions under Vietnamese law concerning the protection of privacy rights for individuals and organizations in the context of AI-driven personal data collection, aggregation, and processing.
1. Current Legal Framework in Vietnam for Privacy and Personal Data Protection in the AI Environment
On December 7, 2022, the Ministry of Information and Communications (now the Ministry of Science and Technology) issued Decision No. 2259/QD-BTTTT on the national strategy for the development and application of artificial intelligence through 2030. One of the core development principles emphasized in this document is a human-centric approach to AI development.
Accordingly, it is essential to balance the benefits that AI brings to various sectors and industries with the need to ensure the safety of AI products and services, while also avoiding violations of ethical standards and human values during AI implementation.
To implement this principle and in response to the strong wave of digital and technological transformation, Vietnam has introduced pioneering legal instruments in the field of personal data protection, such as:
- Decree No. 13/2023/NĐ-CP, effective from 01 July 2023;
- Law on Data 2024, effective from 01 July 2025.
Before the above documents were issued, the protection of personal data and the responsibility to protect personal data appeared sporadically in many different legal documents, such as the Civil Code, the Law on National Security, the Law on Cyber Security, etc. Although the foundation for personal data protection was established, these regulations were not specifically designed to deal with the scale and speed of collecting, synthesizing, and processing personal data that AI brings.
2. Law on Personal Data Protection 2025 (“LoPDP 2025”) and principles of data processing in the AI environment
The LoPDP 2025 is expected to take effect from 01 January 2026, with many outstanding and notable regulations to help organizations and individuals be safer when collecting, synthesizing, and processing information through AI applications, while minimizing legal risks. Article 30 of the LoPDP 2025 specifically stipulates the general principles of protecting personal information in the AI environment as follows:
- Personal information in the AI environment must be processed for the right purpose and limited to the necessary scope, ensuring the rights and legitimate interests of the subject of personal information;
- The processing of personal information in the AI environment must comply with the provisions of this Law and other relevant legal provisions, in accordance with the ethical standards and customs of Vietnam;
- Systems and services using AI must be integrated with appropriate personal information security measures; must use appropriate authentication and identification methods and access authorization to process personal information;
- The processing of personal information using AI must be classified according to the level of risk to have appropriate personal information protection measures;
- Must not use or develop AI processing systems that use PD to harm national defense, security, social order and safety, or infringe upon the life, health, honor, dignity, or property of others.
The provisions in section (ii) contribute to affirming that the processing of PD in the AI environment must comply with the provisions of the LoPDP 2025 and other relevant legal provisions. Accordingly, there is an issue that needs to be highlighted: The processing, collection, analysis, and synthesis of PD must have the consent of the PD subject, specifically:
- Agreeing, disagreeing, or requesting to withdraw consent to allow the processing of personal data is one of the important rights of the PD subject.
- This consent must be expressed in a clear, specific manner, printable, and copyable in writing, including in electronic form or verifiable format. Most importantly, silence or non-response is not considered consent.
However, a great deal of AI software today collects, analyzes and processes PD silently, without requiring explicit permission from users. However, AI is not allowed to process PD without the consent of the PD subject.
For example, developers often store the content of exchanges between users and AI to train models in the future. This poses a great risk if users accidentally provide sensitive personal data, as this data can be exploited or displayed to other users.
Therefore, before AI developers update their compliance policies with the LoPDP 2025, each individual and organization needs to proactively protect their information, avoid sharing sensitive data, basic personal information, employment information or business secrets via AI platforms to minimize the risk of leakage or abuse.
3. Solutions from BLawyers Vietnam
We support the following issues:
- Consulting on compliance with personal data laws according to current Vietnamese law;
- Drafting privacy policies and terms of use of AI;
- Supporting the handling of complaints or disputes related to data; and
- Other relevant issues.
The above is not official advice from BLawyers Vietnam. If you have any questions or suggestions about the above, please contact us at info@blawyersvn.com. BLawyers Vietnam would love to hear from you.
Date: 23 September 2025
Writer: BLawyers Vietnam
