Vietnam releases first draft of new Law on Personal Data Protection
09 October 2024
On September 24, 2024, the government of Vietnam released the first draft of a new Law on Personal Data Protection (PDPL). The draft law was developed by the Ministry of Public Security and is now open for public consultation until November 24, 2024.
More comprehensive and stringent than the current Personal Data Protection Decree (PDPD), the draft PDPL was designed to unify regulations concerning legal terms related to personal data and its protection, identify data subjects’ rights and obligations and improve and enhance regulations for personal data protection.
It covers marketing services, behavioural and targeted advertising, big data processing, artificial intelligence, cloud computing, employee monitoring and recruitment, banking and finance, social networks and media services. The draft law also addresses specific categories of personal data, including health and insurance data, location data, biometric data, credit data and children’s data.
These regulations are embodied in 68 articles in seven chapters.
One of these articles specifically governs personal data processing by social networks and media service providers. Notable obligations include notice and consent, restriction on user verification methods, cookie and user monitoring opt-out, and prohibition against eavesdropping and wiretapping.
Manh Hung Tran | Head of IP & Tech Practice @ BMVN (alliance with Baker McKenzie), Hanoi.
The draft PDPL also stipulates a separate opt-in and opt-out regime for processing personal data in marketing services and behavioural and targeted advertising. In addition, it restricts the scope of data that can be processed for these purposes. “Certain personal data are subject to heightened regulations under the draft PDPL, such as children’s data, biometric data and location data. Notice and consent are among the requirements that one must adhere to when processing these types of personal data,” said Manh Hung Tran, head of the IP and technology practice group at Baker McKenzie Vietnam in Hanoi.
In terms of Consent and Legal Bases for Processing, Tran said that requirements for consent are inconsistently scattered across various articles. He explained: “On the one hand, the draft PDPL retains the general requirements for consent and the circumstances where consent is exempted, similar to the PDPD. On the other hand, certain context- and data-specific regulations explicitly require consent without any exceptions. It therefore remains unclear how other legal bases for data processing, such as contract performance, would apply in these instances. The GDPR-typed legitimate interest has not yet been recognized under the draft PDPL as a lawful ground for personal data processing.”
Vietnam’s National Assembly is expected to adopt the draft PDPL in May 2025. It may take effect beginning January 1, 2026. 
- Espie Angelica A. de Leon
