LAW ON PERSONAL DATA PROTECTION 2025 – KEY NEW PROVISIONS AND PRACTICAL IMPACTS

In the context of rapid digital transformation, personal data has increasingly become a “special asset” closely associated with privacy, human rights, and national security. The promulgation of the Law on Personal Data Protection (adopted in 2025 and effective from 1 January 2026) marks a significant shift from a regulatory framework governed by decrees to a comprehensive statutory regime, featuring stricter requirements and stronger enforcement mechanisms.

Below are the key highlights of the Law and the critical issues that enterprises, organizations, and individuals should pay close attention to.

1. Absolute Prohibition on the Trading of Personal Data

One of the fundamental principles of the Law on Personal Data Protection 2025 is the absolute prohibition of the buying and selling of personal data in any form, as well as any unlawful exploitation or use of such data.

This provision aims to put an end to the widespread underground market for personal data, which has resulted in numerous adverse consequences, including fraud, invasion of privacy, and asset misappropriation. Accordingly:

· Personal data is no longer treated as a “commodity” that may be traded;

· All data processing activities must be based on a valid legal ground, in particular the explicit and informed consent of the data subject;

· Intermediary entities that unlawfully collect or exploit personal data will be subject to strict legal liability.

2. Fines of up to 5% of Turnover for Violations Related to Cross-Border Data Transfers

The 2025 Law introduces severe financial sanctions, approaching international standards such as the EU General Data Protection Regulation (GDPR). Specifically, organizations that violate regulations on cross-border transfers of personal data may be subject to fines of up to 5% of their turnover in the immediately preceding fiscal year.

This reflects a strict regulatory stance on outbound data flows, particularly in light of:

· The widespread use by enterprises of servers, platforms, and data-processing services located outside the territory of Vietnam;

· The increasing risks of personal data leakage and misuse.

Enterprises are therefore required to comprehensively review their data transfer activities, conduct impact assessments, establish internal control mechanisms, and ensure full compliance with legal requirements prior to any cross-border data transfer.

3. Obligation to Delete Employees’ Personal Data upon Termination of Employment

The Law on Personal Data Protection 2025 imposes new obligations on employers in the context of employment relationships. Accordingly, enterprises must delete the personal data of employees after the termination of their employment contracts, except where:

· Specialized laws provide otherwise (e.g., requirements on retention of employment or social insurance records); or

· There is another lawful agreement between the enterprise and the employee.

This provision seeks to prevent enterprises from retaining or using former employees’ personal data beyond what is necessary, thereby enhancing privacy protection and reinforcing individuals’ control over their personal data.

4. Stricter Obligations for Social Networks and Digital Platforms

The 2025 Law establishes clear limits on the operations of social networks and digital service platforms, including:

· Prohibiting platforms from requiring users to provide images or videos of identity documents for account verification, unless otherwise required by law;

· Prohibiting any act of eavesdropping, reading messages, recording audio or video, or collecting other private data without the lawful consent of users.

These rules are intended to strengthen the protection of privacy in the digital environment and to compel technology platforms to adjust their business models in a manner that respects personal data rights.

5. Impacts and Recommendations

The Law on Personal Data Protection 2025 is not only a tool for protecting individuals but also establishes a new compliance benchmark for enterprises. In the coming period, organizations should:

· Review all processes relating to the collection, processing, and storage of personal data;

· Update privacy policies, employment contracts, and agreements with customers and partners;

· Train personnel and establish dedicated functions or governance mechanisms for personal data protection.

Early and comprehensive compliance will not only help enterprises mitigate legal risks but also enhance their reputation and build user trust in the digital economy.

Conclusion

The Law on Personal Data Protection 2025 represents a major advancement in the protection of privacy in Vietnam, featuring stringent requirements and robust sanctions. While it poses significant challenges, it also offers opportunities for enterprises to restructure their operations in a transparent, sustainable manner aligned with international standards./