I. Legal basis

• Personal Data Protection Law 2025

II. Rights and obligations of data subjects

1. Rights of data subjects

Pursuant to Clause 1, Article 4 of the Personal Data Protection Law 2025, the rights of data subjects are clearly stipulated as follows: 

• To be informed of the processing of personal data;
• To give or withhold consent, and to request the withdrawal of consent for the processing of personal data;
• To access, rectify, or request the correction of personal data;
• To request the provision, deletion, or restriction of the processing of personal data, and to submit objections to the processing of personal data;
• To file complaints, denunciations, initiate lawsuits, or claim compensation for damages as prescribed by law;
• To file complaints, denunciations, initiate lawsuits, or claim compensation for damages as prescribed by law;

2. Obligations of data subjects

The Personal Data Protection Law 2025 also stipulates the obligations of data subjects as follows:

• To protect their own personal data;
• To respect and safeguard the personal data of others;
• To provide complete and accurate personal data in accordance with the law, contractual requirements, or upon giving consent for the processing of their personal data;
• To comply with the laws on personal data protection and participate in the prevention and combating of activities that infringe upon personal data.

III. Notable provisions in the Personal Data Protection Law 2025

1. Prohibition of the buying and selling of personal data

Pursuant to Article 7 of the Personal Data Protection Law, from 01 January 2026, the following seven (07) acts are strictly prohibited:

1. Processing personal data to act against the Socialist Republic of Vietnam, or in a manner that affects national defense, national security, social order and safety, or the lawful rights and interests of agencies, organizations, or individuals;
2. Obstructing activities for the protection of personal data;
3. Exploiting personal data protection activities to commit acts in violation of the law; 
4. Processing personal data in contravention of legal regulations;
5. Using another person’s personal data, or allowing others to use one’s personal data, to commit acts in violation of the law; 
6. Buying or selling personal data, except as otherwise provided by law;
7. Misappropriating, intentionally disclosing, or causing the loss of personal data.

2. Maximum penalty of up to 5% of the preceding year’s revenue for acts infringing upon personal data

Pursuant to Clause 4, Article 8 of the Law, the maximum administrative monetary penalty for an organization that violates the regulations on cross-border transfer of personal data is 5% of the organization’s revenue in the preceding year.

In cases where there is no revenue in the preceding year, or where the penalty calculated based on revenue is lower than the maximum monetary fine prescribed under Clause 5, Article 8, the penalty provided in Clause 5, Article 8 shall apply.

3. Enterprises are required to delete employees’ personal data upon the termination of the labor contract

Clause 2, Article 25 stipulates the responsibility of agencies, organizations, and individuals to protect personal data in the management and use of employees. Accordingly, enterprises, upon the termination of a labor contract, are obliged to:

• Comply with the provisions of this Law, labor and employment laws, data protection laws, and other relevant legal regulations;;
• Retain employees’ personal data for the period prescribed by law or as agreed upon;
• Delete or destroy employees’ personal data upon the termination of the labor contract, except in cases where otherwise agreed or provided by law.

4. Social media platforms are prohibited from requiring the submission of images or videos containing personal identification documents as a verification factor

Pursuant to Article 29, organizations and individuals providing social network services or online media services are obligated to:

• Clearly notify the content of personal data collected when a data subject installs and uses social network services or online media services; do not collect personal data unlawfully or beyond the scope agreed with the user.
• Do not require the submission of images or videos containing full or partial personal identification documents as an account verification factor.
• Provide users with the option to refuse the collection and sharing of data files (commonly referred to as cookies).
• Offer a “do not track” option, or allow tracking of social network or online media service usage only with the user’s consent.
• Do not eavesdrop, wiretap, record calls, or read text messages without the consent of the data subject, except as otherwise provided by law.
• Publicly disclose privacy policies, clearly explain the methods of collecting, using, and sharing personal data; provide users with mechanisms to access, correct, delete data, and set privacy controls for personal data; report violations of security and privacy; protect the personal data of Vietnamese citizens when transferring data across borders; and establish procedures to handle personal data protection violations promptly and effectively.

IV. Conclusion

The Personal Data Protection Law 2025 represents a significant step in strengthening the legal framework for privacy and personal data security in Vietnam, aligning it with international standards while also addressing the requirements of governance in the context of rapid digital transformation and the growth of the digital economy. The provisions of the Law not only clearly affirm the rights and obligations of data subjects, but also establish specific and stringent legal responsibilities for agencies, organizations, and enterprises in the collection, processing, storage, and transfer of personal data.

Notably, the prohibition on buying and selling personal data, the application of penalties of up to 5% of the preceding year’s revenue, the requirement to delete employees’ personal data upon termination of the labor contract, as well as the provision that social media platforms are prohibited from requiring images or videos of identification documents for account verification from 01 January 2026, demonstrate that personal data protection is positioned at the core of the legal framework, carries strong deterrent effect, and has a direct impact on corporate compliance activities.

In the coming period, to ensure full and effective compliance with the Personal Data Protection Law 2025, agencies, organizations, and enterprises need to proactively review and internal procedures for personal data protection; update privacy policies and mechanisms for obtaining and managing data subject consent; and simultaneously raise awareness and responsibility among employees and service users. Strict compliance with the provisions of the Law is not only a mandatory legal obligation but also a critical factor in building a safe and transparent digital environment, strengthening public trust, and promoting the sustainable development of Vietnam’s digital economy.

V. About Us, Hankuk Law Firm

■ Hankuk Law Firm – Introduction

The goal of the legal services provided by HANKUK LAW FIRM is to support businesses, investors, and people. Our organization employs skilled Korean lawyers, partners, and professionals to provide legal services to businesses related to corporations and litigation.

To support the startup process, our lawyers and staff provide a wide range of services, including business law consulting, tax and immigration law consulting, real estate services, business consulting, marketing and communications, human resources, product distribution, franchise options, etc. We provide expert advice on every aspect of your business needs.

To protect the legitimate rights and interests of our clients and achieve the best results, we provide legal advice and participate in civil lawsuits related to business, labor, marriage, family, and inheritance.

■ Contact us now

For reliable and effective legal advice, please contact HANKUK LAW FIRM now. We are committed to providing you with the best possible answers and our team of experienced lawyers has extensive knowledge in many legal fields. We are always here to provide the most competent and dedicated support, whether you are dealing with contractual issues, commercial disputes or need guidance on foreign investment. HANKUK LAW FIRM is honored to have assisted hundreds of domestic and international clients in skillfully resolving complex legal issues as their trusted legal partner. Do not let legal issues hinder your success. Let us accompany you towards legal achievement and comfort. For prompt guidance and support to ensure your rights are always maintained at the highest standards, contact HANKUK LAW FIRM now.

■ Contact Hankuk Law Firm:

Website: http://hankuklawfirm.com/en/  FB: https://www.facebook.com/hankuk.lawfirm  Tiktok: https://www.tiktok.com/@hankuklawfirm Youtube: https://www.youtube.com/@hankuklawfirm6375 Email:  info@hankuklawfirm.com   SĐT: 0942.339.063