SOME KEY ISSUES OF THE 2025 LAW ON PERSONAL DATA PROTECTION (PART I)
The 2025 Law on Personal Data Protection (Law No. 91/2025/QH15), passed by the 15th National Assembly on 26 June 2025 and officially effective from 01 January 2026, marks a significant turning point in perfecting the legal framework for individual privacy rights in Vietnam. This is the first legal document to comprehensively regulate activities related to the collection, storage, processing, and protection of personal data. The enactment of this law not only enhances the protection of users’ rights in the digital environment but also establishes stringent legal standards, imposing higher requirements on businesses in data governance.
I. Definition, scope of regulation, and subjects of application of the Law on Personal Data Protection
According to Article 2.1 of the 2025 Law on Personal Data Protection, personal data means digital data or information in other forms that identifies or helps identify a specific individual, including basic personal data and sensitive personal data. Personal data, once de-identified, is no longer considered personal data.
The Law on Personal Data Protection applies to the following entities:
– Vietnamese or foreign agencies, organizations, and individuals in Vietnam;
– Foreign agencies, organizations, and individuals directly involved in or related to the processing of personal data of Vietnamese citizens and people of Vietnamese origin with undetermined nationality residing in Vietnam who have been issued identity certificates.
Thus, it can be seen that the Law clearly defines the scope and subjects of application comprehensively and is not limited to the territory of Vietnam. At the same time, it extends responsibilities to foreign entities involved in the processing of personal data of Vietnamese citizens.
II. Rights of data subjects under the Law on Personal Data Protection
According to Article 4.1 of the 2025 Law on Protection of Personal Data, personal data subjects have the following rights:
– Inform of personal data processing activities;
– Agree or disagree, request to withdraw consent for the processing of personal data;
– Access, rectify or request the rectification of personal data;
– Request the provision, deletion, or restriction of processing of personal data; and to object to the processing of personal data;
– Complaints, denunciations, lawsuits, and claims for damages in accordance with the law.
– Request competent authorities or agencies, organizations, individuals involved in personal data processing to implement measures and solutions to protect their personal data in accordance with the law.
These regulations demonstrate that the Law grants data subjects a comprehensive and clearly defined set of fundamental rights to control their personal information. Beyond the rights of access and rectification, data subjects can proactively intervene, object, request data protection and apply sanctions within the framework of the law.
III. Prohibited acts under the 2025 Law on Personal Data Protection
Similar to other existing legal instruments, the Law on Personal Data Protection also specifically stipulates prohibited acts in order to establish a clear legal framework and ensure effective enforcement in practice.
According to Article 7 of the 2025 Law on Personal Data Protection, seven groups of prohibited acts have been established to prevent and deter the misuse of personal data, thereby clearly defining the legal boundaries in data processing activities. The prohibited acts include:
– Processing personal data to oppose the State of the Socialist Republic of Vietnam, affecting national defense, national security, social order and safety, the legitimate rights and interests of agencies, organizations, individuals;
– Obstructing personal data protection activities;
– Taking advantage of personal data protection activities to commit violations of the law;
– Processing personal data in violation of the law;
– Using another person’s personal data, or allowing others to use one’s own personal data to commit acts that violate the law;
– Buying or selling personal data, except as otherwise provided by law;
– Appropriating, intentionally disclosing, losing personal data.
Depending on the nature, extent, and consequences of the violation, acts infringing on personal data protection regulations may be subject to various sanctions, including administrative penalties, criminal prosecution, and the obligation to pay damages in accordance with the law.
The above is TNTP’s article on some key issues of the 2025 Law on Personal Data Protection. TNTP hopes that this article has provided useful legal information to Esteemed Readers.
TNTP & Associates International Law Firm
0944892906
