What is basic personal data in Vietnam? Categories and plain examples

What basic personal data is is a common question when a business creates customer forms or manages employee files. Understanding it correctly helps you know which information is being collected, avoid asking for too much and distinguish it from the sensitive category.

What is basic personal data in Vietnam under current rules?

Clause 2, Article 2 of Law 91/2025/QH15 defines this category by reference to elements of personal identity and background that are common in transactions and social relationships. The specific list is in Article 3 of Decree 356/2025/ND-CP. You can check the digitally signed text in the Official Gazette of the Government.

For example, a shop that stores a buyer's name, phone number and delivery address is processing basic personal data. Whether it is stored in a paper notebook or in software does not change its character as personal information. If the scope is unclear, read the entry what is personal data before classifying.

What does basic personal data include?

Article 3 lists 11 groups. Below is a paraphrase to check against when taking an inventory of basic personal data; read the full original text when applying it:

• Full name at birth and any other names used.
• Date of birth; date of death or of going missing.
• Gender.
• Place of birth, place of birth registration, permanent residence, temporary residence, current place of residence, place of origin and contact address.
• Nationality.
• Personal images.
• Phone number, personal identification number, passport number, driving licence number and vehicle licence plate number.
• Marital status.
• Family relationships, such as parents, children, wife or husband.
• Information about an individual's digital accounts.
• Other information that identifies or helps identify a person and does not fall under Article 4 on the sensitive category.

Are email addresses and phone numbers personal data?

Phone numbers are listed directly. An email address linked to a specific individual can also help identify that person. By contrast, a shared business mailbox needs to be assessed in light of its context and accompanying information; do not assume that every email address reflects an individual.

How do an ID number and an ID card image differ?

The personal identification number belongs to the basic category. However, images of the identity card, the citizen identity card (CCCD) and the people's identity card (CMND) are on the sensitive list under Point i, Clause 1, Article 4. A form that asks users to upload a photo of their card therefore needs to be assessed differently from a form that only asks for the number.

Basic personal data in Vietnam versus sensitive personal data

Both categories are protected by law. The sensitive category is more closely tied to privacy and carries corresponding protection requirements. You cannot conclude that a file contains only basic personal data because it is called a "customer list"; look at each column and its actual content.

What should a business do when collecting basic information?

1. Collect only what serves a specific purpose

For a call-back request form, a name and phone number may be enough. Date of birth, marital status or an ID card image usually need a separate reason. Write down the purpose next to each field and remove fields that are not needed. This is how the principle of limiting the scope of processing in Article 3 of the Law is put into practice.

2. Determine the legal basis for processing and consent

Basic personal data is not exempt from the requirement to have a legal basis for processing. When relying on consent, users must be told the type of information, the purpose, the processing entity and their related rights and obligations. Under Article 9, silence is not consent; each purpose must be stated clearly. See also the rules for obtaining consent.

For example, agreeing to provide an address for delivery does not automatically allow advertising to be sent indefinitely. If relying on a case where consent is not required, the business must check the legal conditions for the specific activity, not simply state in general terms that the data serves its business.

3. Limit access and retention

Assign access by job: delivery staff need the address, while account managers need other information. Avoid sharing spreadsheets through public links. Set a retention period that fits the purpose and legal obligations, then schedule reviews and delete or otherwise deal with the data once it is no longer needed.

4. Control the recipients of data

When passing a list to a shipping company or software vendor, determine their role, scope of use and protection responsibilities. The contract should clarify access rights, incident handling and the return or deletion of data. See the data processing agreement (DPA) to prepare suitable terms.

Common classification mistakes

The first mistake is treating publicly available information as free to use for any purpose. The second is merging health history or financial information into a contact list and still applying ordinary protection. The third is assuming that small businesses do not need to protect basic personal data in Vietnam. Each obligation and each specific exemption condition must be assessed.

To start, pick one form currently in use and check four points: what is being collected, what it is collected for, who can see it and when storage stops. If the entire customer or HR data flow needs reviewing, businesses can consider LexData's compliance consulting service.

If staff regularly collect information through forms or handle customer files, personal data protection awareness training helps the team practise classifying information and spotting data fields that are not needed for their work.