The Personal Data Protection Law will officially come into effect in 2026.
The Personal Data Protection Law, effective from January 1, 2026, opens up a range of new rights for users and forces businesses to change how they collect and process information.
What types of personal data are there?
According to the Personal Data Protection Law, personal data is information in numerical or other forms that helps identify a specific person. This data includes basic personal data and sensitive personal data as categorized by the Government.
Basic personal data reflects personal information and background frequently used in transactions and social relationships. Sensitive personal data is directly linked to privacy, and its violation can seriously affect the legitimate rights and interests of individuals and organizations.
The Personal Data Protection Law will officially come into effect in 2026.
From January 1, 2026, the Law on Personal Data Protection will come into effect nationwide. This marks the first time that citizens have been fully recognized by law as having the right to control their personal data in the digital environment, especially the right to request businesses to delete or remove collected information.
The Law on Personal Data Protection clearly defines users as data subjects with the right to decide on the information related to them. All activities involving the processing of personal data by organizations and businesses must prioritize the interests of users and comply with strict legal principles.
Users have control over their personal data.
According to the Personal Data Protection Act, from 2026 onwards, users have the right to know how their data is being collected and processed. Users can consent, disagree, or withdraw their previously granted consent for the processing of their personal data.
In addition, users can view, edit, or request the editing of personal information; request the provision, deletion, or restriction of data processing; and submit objections when they disagree with the way their data is used. The law also opens up mechanisms for complaints, denunciations, lawsuits, and claims for compensation when personal data rights are violated.
In parallel with user rights, the Personal Data Protection Law obligates organizations and businesses to receive, review, and implement requests to delete data, remove information, or cease processing personal data when users withdraw their consent.
Cases where data can be processed without consent.
The Law on Personal Data Protection also specifies certain special situations that allow organizations and businesses to process personal data without the user's consent. These include urgent cases aimed at protecting the life, health, honor, dignity, rights, and legitimate interests of individuals or others.
Furthermore, personal data may be processed to protect the legitimate interests of the State, agencies, and organizations against potential infringements; to serve in addressing emergencies, preventing riots, terrorism, crime, or other violations of the law as stipulated by current regulations.
Social media platforms are facing stricter verification requirements and user tracking restrictions.
One notable point of the Personal Data Protection Law is that social media platforms and online communication services are prohibited from requiring users to provide images or videos containing all or part of their identification documents to verify their accounts.
These platforms must allow users to opt out of data collection and sharing, and provide the option to opt out of tracking usage without consent. Unauthorized eavesdropping, recording calls, or reading text messages is prohibited, except as otherwise provided by law.
The Law on Personal Data Protection requires social media platforms to publicly disclose their privacy policies, clearly explaining how data is collected, used, and shared; and to create mechanisms for users to access, edit, delete data, and establish privacy settings. Protecting the personal data of Vietnamese citizens when transferring data abroad is also mandated as a compulsory obligation.
The illegal buying and selling of personal data is strictly prohibited.
The Law on Personal Data Protection defines the illegal buying and selling of personal data as an absolutely prohibited act. Activities that exploit the pretext of protecting personal data to commit illegal acts, process data improperly, or use personal data for illegal purposes are all subject to severe penalties.
With the Personal Data Protection Law officially coming into effect in 2026, the digital environment in Vietnam is expected to become more transparent, safer, and empower users with more control over their own data.