Generative AI and personal data in Vietnam meet the moment your system sends a prompt to a model hosted abroad. When a customer types a name, phone number, order history or a health complaint into an AI chatbot, and your backend forwards it to the ChatGPT API, the Claude API or the Gemini API, personal data collected in Vietnam is being processed on a platform outside Vietnam. That is a cross-border transfer under Article 20(1)(c) of Law 91/2025/QH15 on Personal Data Protection, and it brings a transfer dossier, a contract with the model vendor and notices to users.
None of this stops a foreign-invested company from using an LLM API. It changes what has to be in place before go-live, and Decree 356/2025/ND-CP adds duties that apply specifically to AI systems, including an annual compliance assessment that many groups have not budgeted for. This guide covers customer-facing chatbots and internal copilots; the obligations under the AI Law itself are covered in our guide to the Vietnam AI law.
Is an LLM API call a cross-border transfer?#
Yes, in the ordinary case. Article 20(1) of Law 91 lists three kinds of cross-border transfer, and the third is the one that fits an API call: an organisation in Vietnam or abroad "using a platform outside the territory of Vietnam to process personal data collected in Vietnam" (point c). Article 17(1)(c) of Decree 356 describes the same situation as processing personal data collected in Vietnam and sending it to a platform outside Vietnam for further processing.
Three objections come up in almost every project, and none of them changes the answer:
- "The data only sits on the vendor's server for a few seconds." The provisions turn on where the processing happens, not how long the data stays. A prompt processed abroad and discarded is still processed abroad.
- "We use the vendor's Singapore or EU region." A regional endpoint outside Vietnam is still outside Vietnam. Region choice matters for your risk assessment, not for whether Article 20 applies.
- "The vendor is only a processor." Article 20 applies to the party that transfers. Your Vietnamese entity, as controller, prepares and files the dossier whether the recipient is a processor or not.
Unlike the GDPR, Vietnam has no adequacy decisions or standard contractual clauses that make a transfer lawful by themselves. The core mechanism is a cross-border transfer impact assessment dossier filed with the A05 Department of the Ministry of Public Security; the handbook entry on cross-border data transfer sets out the general rules.
Chatbot, copilot or RAG: which data actually leaves Vietnam#
The legal analysis depends on what reaches the prompt, so start by mapping the data flows of each AI use case rather than the vendor. Typical set-ups in a foreign-invested company look like this:
| Use case | Personal data that typically reaches the LLM API | Points to check |
|---|---|---|
| Customer-facing AI chatbot on the website, app or Zalo | Whatever customers type: names, phone numbers, addresses, order numbers, complaints, sometimes health or payment details | Transfer dossier; notice at the chat window; automated-processing opt-out (Article 10(3) Decree 356) |
| Retrieval-augmented chatbot over CRM, tickets or order records | Records pulled from your systems into the context window, often far more than the customer typed | Data minimisation in the retrieval layer; same dossier must describe the retrieval flow |
| Internal copilot used by staff (drafting, summarising, search) | Employee data, but also customer and supplier data that staff paste in | The employee-data exemptions do not cover customer data pasted into prompts |
| HR assistant processing only staff data | Employee records, CVs, performance notes | Possible exemptions: Article 20(6)(b) Law 91 (employee data stored on cloud) and Article 17(3)(d) Decree 356 (cross-border HR management under labour rules); confirm the facts fit before relying on them |
The HR row is the only one where an exemption is realistic, and even there the wording is narrow: Article 20(6)(b) covers an organisation storing its own employees' data on a cloud service, and Article 17(3)(d) covers transfers for cross-border HR management under labour rules, regulations and collective agreements. A copilot that drafts customer emails is not an HR tool, and the exemption list in Article 17(3) of Decree 356 does not mention AI or analytics.
Who is the controller when your AI chatbot runs on someone else's model?#
Law 91 defines the controller as the party that decides the purposes and means of processing, and the processor as the party that processes on the controller's instruction "through a contract" (Article 2(7) and (8)). For an AI chatbot your Vietnamese entity decides why the conversation is processed and which model handles it, so it is the controller, or controller and processor if it also runs the processing itself (Article 2(9)). The model vendor is a processor only to the extent it acts on your instructions under contract.
Two situations need care:
- The parent company holds the enterprise contract. Many groups buy ChatGPT API or other LLM API access centrally. The Vietnamese subsidiary is still the party transferring Vietnamese data, so it needs its own contractual link to the recipient: either a contract with the vendor or an intra-group agreement that flows the vendor terms down. The same issue arises for other group SaaS; see foreign SaaS in Vietnam.
- The vendor uses data for its own purposes. If API inputs may be used for model training, product improvement or retained for the vendor's own monitoring, the vendor is deciding a purpose of its own for that use. Check the current API terms, the data processing addendum and any opt-out or zero-retention option your plan offers, and record the result in the dossier. Vendor terms change, so re-check them at each dossier update rather than relying on what was true at launch.
The general distinction is explained in controller vs processor.
What the vendor contract for generative AI and personal data in Vietnam must cover#
Three provisions of Decree 356 set out what a contract with an LLM API provider has to contain, and they overlap:
- Transfer agreement (Article 7(1)). A controller handing personal data to a processor (Article 17(1)(d) Law 91) must agree in writing on the purpose, the categories of data subjects and data, the processing period and deletion after the purpose is fulfilled, the legal basis, each party's protection duties, responsibility for data subject rights, and cooperation if a breach is found.
- Cloud service terms (Article 12(2)). Where the processing runs on a cloud service, which an LLM API typically does, the contract must state compliance with Vietnamese data protection law and the provider's data protection contact, map the data flows and each party's role, set security measures, require immediate notice of changes affecting the data, respect processing periods and deletion, and support data subject rights. Data on the cloud must be encrypted at rest and in transit, with strict access control (Article 12(4)).
- Dossier evidence (Article 18(2)(b)). A copy of the contract or transfer document binding the transferring and receiving parties is a mandatory part of the transfer dossier.
A standard vendor data processing addendum written for the GDPR usually covers security, sub-processors and breach notice, but rarely names Vietnamese law, the Vietnamese data protection contact or Vietnam's deletion and rights mechanics. A short Vietnam addendum or an intra-group agreement usually closes the gap; the data processing agreement entry lists the core clauses.
Not having a binding contract with the recipient, or not allocating responsibility for data subject rights after the transfer, is fined at VND 50 to 100 million (Article 56(2)(a) of Decree 330/2026/ND-CP). Fines in the personal data section of Decree 330 are set for organisations; individuals pay half (Article 7(1)).
Generative AI and personal data in Vietnam: sensitive data in prompts and output#
Customers do not filter what they type. Decree 356's list of sensitive personal data (Article 4(1)) includes several items that turn up in support conversations: health status (point d), images of national ID cards (point i), and bank card details, bank transaction history and customers' financial information held at banks, payment intermediaries, securities and insurance firms (point k). A sensitive personal data item in a prompt has three consequences:
- Notice at consent. When consent is sought for processing sensitive data, the data subject must be told that the data is sensitive (Article 6(4) Decree 356).
- Transfer safeguards. Transferring sensitive data requires encryption, anonymisation and other security measures during the transfer (Article 7(2)).
- Loss of small-enterprise relief. A small enterprise or start-up that directly processes sensitive data cannot opt out of the impact assessment duties (Article 38(2) Law 91). This matters less for most foreign-invested subsidiaries, but it catches start-ups building on LLM APIs.
A masking layer that replaces names, phone numbers, ID numbers and emails with placeholders before the API call, then restores them in the response, is the most effective technical control. It reduces what leaves Vietnam; it does not make the transfer disappear. Free text defeats pattern matching (names without diacritics, addresses described in words, symptoms), and the dossier has to describe what can still get through. Only data that has been de-identified to the point that it no longer identifies anyone falls outside the analysis, and that is a conclusion to document, not assume.
The output side matters too. Inference results that can identify, or help identify, a specific person must be protected as personal data (Article 10(2) Decree 356), so stored chatbot transcripts and AI-generated customer summaries belong in the retention and access policy.
What users of an AI chatbot must be told#
Article 56(2)(b) of Decree 330 fines, at VND 50 to 100 million, failing to ensure the data subject's consent to the purpose of a cross-border transfer or failing to notify data subjects that their data is transferred abroad, the receiving organisation and the purpose of processing. In practice the chat window needs a short notice before the first message: the conversation is processed by an AI system operated by a named provider outside Vietnam, for a stated purpose, with a link to the privacy notice. If you rely on consent, Article 6 of Decree 356 requires a verifiable method, storage of the consent, and no pre-ticked boxes or ambiguous wording (Article 6(1) to (3)).
Whether every chatbot conversation needs consent, or whether some can rest on performing an agreement with the data subject (Article 19(1)(d) Law 91), for example a customer asking about their own order, is a judgement to make per use case. The notice duty applies either way.
Decree 356 adds a separate duty for automated processing. The controller must inform the data subject about automated processing, explain how the algorithm works and its effect on their rights and interests, and give them options not to participate (Article 10(3)). For a support chatbot the practical answer is a plain-language explanation and a visible route to a human agent. Missing the explanation or the opt-out mechanism is fined at VND 50 to 70 million each (Article 67(2)(a) and (b) Decree 330).
The AI Law adds its own transparency rule: chatbots must be designed so users know they are interacting with AI (Article 11(1) of Law 134/2025/QH15). One notice at the chat window can serve both laws if it covers the AI disclosure, the provider, the location and the human route.
Decree 356 rules on generative AI and personal data in Vietnam#
Article 10(5) of Decree 356 lists protection measures for organisations using AI systems: systems meeting cybersecurity and data protection standards, monitoring and accountability to data subjects, early warning of cyber threats, controls against misuse of AI, and a compliance assessment against data protection rules once a year (point dd). Data subjects must also be able to correct, anonymise or delete their profiles even where the platform stores behavioural history (Article 10(6)).
These are not abstract. Decree 330 fines processing personal data in an AI system without the annual compliance assessment at VND 20 to 50 million (Article 67(1)), and fines at VND 50 to 70 million failing to classify the AI system by risk level in order to set appropriate data protection measures (Article 67(2)(d)), failing to protect inference results that identify a person (point dd), and failing to apply suitable authentication and access control in the system (point g). Law 91 itself requires processing by AI to be classified by risk level (Article 30(4)).
Do these duties reach a company that only deploys someone else's model? In LexData's reading, yes. Article 67(1) of Decree 330 targets the act of "processing personal data in an AI system", not the role of developer, and Article 10(5) of Decree 356 addresses organisations generally. A chatbot that sends customer messages to an LLM API processes personal data in an AI system, even though the model belongs to the vendor. Neither text prescribes a form for the assessment, so the workable approach is to fold it into the annual compliance report that the data protection department or officer already prepares under Article 14(1)(c) of Decree 356, with a dedicated AI section covering each AI system, its risk classification, the measures applied and the evidence kept.
Generative AI and personal data in Vietnam: the dossier, the DPIA and model switches#
A chatbot or copilot on a foreign model usually triggers two filings, both within 60 days:
- Cross-border transfer impact assessment dossier. Prepared on Form 09 with the contract copy and your data protection policies (Article 18(2) Decree 356), and one original filed with the A05 Department within 60 days of the first transfer (Article 20(2) Law 91; Article 18(4) Decree 356). The dossier must describe the vendor as recipient, the data that can reach the prompt, retention and deletion, and the safeguards. The step-by-step process is in our cross-border data transfer impact assessment guide.
- Personal data processing impact assessment (DPIA). The controller files it within 60 days of the first processing (Article 21(1) Law 91); an existing DPIA must be updated to cover the chatbot or copilot. Small enterprises and start-ups may opt out for 5 years from 1 January 2026, unless they provide processing services, directly process sensitive data or process data of a large number of data subjects (Article 38(2)); that relief never covered the transfer dossier. See what is a DPIA.
Switching from one LLM provider to another, adding a second model, or using the data for a new purpose is a change of processor or purpose. Decree 356 handles these through the six-monthly update from the first filing (Article 20(1)(a) and (b)); reorganisation and changes to your data protection service provider trigger an update within 10 days (Article 20(2)).
Failing to prepare the transfer dossier, or to file it within 60 days, is fined at VND 30 to 50 million (Article 56(1)(a) and (b) Decree 330). If a company transfers without a dossier, or conceals or misdeclares data flows, and this leads to personal data of 10,000 or more Vietnamese citizens being exposed or lost, the fine is 1% to 5% of the previous year's revenue in Vietnam, with a VND 200 million to 3 billion scale where that percentage comes to less than VND 3 billion or there is no Vietnamese revenue (Article 56(3) and (4)). For a chatbot that logs every conversation, the leak scenario is not theoretical.
Before go-live, the order that works for most projects is: map what reaches the prompt and the retrieval layer; check the LLM API plan's training, retention and region settings and sign or flow down a Vietnam-compliant addendum; build the masking layer and test it on real conversations; put the AI and transfer notice and the human route in the chat window; update the DPIA and file the transfer dossier within 60 days; and put the system into the annual Article 10(5) review. If the chatbot is branded as your own, also run through the provider duties under the AI Law, including risk classification and the Article 35 transition for systems launched before 1 March 2026, in our Vietnam AI law guide.
LexData prepares the transfer dossier and DPIA for AI deployments, reviews LLM vendor terms against Vietnamese law and drafts the user-facing notices through its DPIA and cross-border transfer dossier service.
