CCTV data protection in Vietnam: installing cameras under the PDPL (Law 91/2025), rules and penalties
Installing surveillance cameras under the PDPL means collecting, recording audio and video of, and processing the images and sound of individuals in public places or on the premises of offices and business establishments. It must comply with Personal Data Protection Law No. 91/2025/QH15; for recording in public places and public activities, Article 32 sets the cases in which recording needs no consent, the notice obligation, purpose limitation and the retention period.
Personal Data Protection Law No. 91/2025/QH15 & Decree 330/2026/ND-CP
Official legal texts
Key takeaways for businesses
- Video recording in public places or of public activities may be carried out without the individual's consent in the cases listed in Clause 1, Article 32, but people must be notified that they are being recorded (Clause 2, Article 32), for example by a clearly visible sign or electronic notice (Point a, Clause 1, Article 71 of Decree 330/2026/ND-CP).
- Camera systems with integrated facial recognition (face recognition AI) process sensitive biometric data: the no-consent exception in Clause 1, Article 32 does not automatically cover this; valid consent or another legal basis is needed, data subjects must be told that their sensitive data is being processed, and the risks must be analysed in the DPIA dossier.
- Cameras should not be installed in private spaces (toilets, changing rooms, medical examination rooms, personal rest rooms) because of the risk of intruding on private life; image data may be stored only for as long as necessary under Clause 4, Article 32.
What does CCTV data protection in Vietnam require of a camera system?
Complying with CCTV data protection in Vietnam under the PDPL is a mandatory review item for every agency and organisation that operates a security system. Security camera systems (CCTV) are everywhere in modern society: shopping centres, office towers, banks, schools, hospitals, production and business facilities and residential areas. Although they play an important role in maintaining security and order and preventing crime, continuous audio and video recording also carries a risk of directly infringing citizens' right to privacy, right to their image and the confidentiality of their private life.
Previously, many organisations installed cameras at will and freely exploited the footage without any clear governing rules. To close this legal gap, Article 32 of Personal Data Protection Law No. 91/2025/QH15 for the first time sets out a dedicated legal framework on "Protection of personal data obtained from audio and video recording in public places and public activities". It sets the mandatory standards for CCTV data protection in Vietnam that every agency, business and building management board must implement.
2026 update: from 01/07/2026, internet-connected surveillance cameras circulated in Vietnam must also meet the national technical regulation on cybersecurity under Circular 48/2026/TT-BCA; in addition, Decision 502/QD-TTg (28/03/2026) approves the plan for connecting and sharing surveillance camera data of individuals and organisations with the surveillance camera centres of commune-level police. Businesses investing in new camera systems should review these requirements as well.
1. Two legal tiers of CCTV data protection in Vietnam
Based on the technology used and the way data is processed, camera systems fall into 2 legal groups with very different levels of regulation:
- Traditional security cameras (ordinary CCTV): Record only ordinary optical video for real-time viewing (live view) or local storage for review after a security incident, fire or theft. The footage is basic personal data. For this group, when recording in public places for a purpose listed in Clause 1, Article 32, the business does not need individual consent but must still meet the public notice obligation in Clause 2, Article 32.
- Smart cameras using artificial intelligence (AI facial recognition cameras): Camera systems that use algorithms to analyse facial anthropometric features (face matching), scan profiles to take staff attendance automatically, track the shopping behaviour of VIP customers, or raise alerts about strangers. In that case, the extracted data is sensitive personal data (biometric data under Clause 3, Article 2 of Law 91 and Point dd, Clause 1, Article 4 of Decree 356/2025/ND-CP). The exception in Clause 1, Article 32 does not automatically allow camera footage to be used for facial recognition: Article 71 of Decree 330/2026/ND-CP penalises using data from public surveillance cameras for automatic facial recognition to build personal profiles without the data subject's valid consent. The business needs valid consent or another legal basis, must tell data subjects that their sensitive data is being processed (Point h, Clause 1, Article 43 of Decree 330/2026/ND-CP), must apply the biometric data safeguards in Clause 4, Article 31 of Law 91, and must assess the risks in a DPIA dossier submitted to the specialised personal data protection authority (the A05 Department, Ministry of Public Security).
2. When audio and video may be recorded without consent under Article 32
Under Clause 1, Article 32 of Law 91/2025/QH15, agencies, organisations and businesses may record audio and video and process personal data in public places and public activities without the data subject's consent in the following cases:
- To perform national defence tasks, protect national security, ensure social order and safety, or protect the lawful rights and interests of agencies, organisations and individuals (for example: building security, warehouse protection, loss prevention in supermarkets).
- Sound, images and identifying information obtained from public activities, including conferences, seminars, sports competitions, art performances and other public activities, provided this does not harm the honour, dignity or reputation of the data subject.
- Other cases provided by law.
3. Mandatory public notice obligation (Clause 2, Article 32)
Law 91/2025/QH15 sets a principle of full transparency: being exempt from consent does not mean recording may be done covertly. Under Clause 2, Article 32, the organisation that records is responsible for:
"Giving notice or using another form of information so that the data subject knows they are being recorded by audio or video, unless otherwise provided by law."
In practice, this means the business should install camera warning signs (CCTV notice signage) in an open, easily visible position at the entrance or boundary, before a person steps into the camera's field of view. Point a, Clause 1, Article 71 of Decree 330/2026/ND-CP fines recording in public spaces or customer service areas without a physical sign or electronic notice in an easily noticeable position. The law does not prescribe the sign's content; good practice is a clear camera symbol, the purpose of recording (for example: 'Security cameras in operation to protect property') and the unit that manages the system.
4. Purpose limitation and retention period for camera data
Under Clauses 3 and 4, Article 32:
- Camera data may only be processed and used in line with the purpose originally notified; it is strictly prohibited to extract footage on one's own initiative to post on social media, ridicule employees or customers, or provide it to third parties for commercial purposes.
- Retention period for video data: The law requires data to be kept only for as long as necessary for the stated purpose and then destroyed; it does not set a specific number of days. Common practice: 15 to 30 days for offices and shops; 60 to 90 days for vaults and banks. Once the period under the internal rules expires, the system should be configured to delete or overwrite automatically, rather than storing data indefinitely.
Ordinary security cameras vs AI facial recognition cameras under the PDPL
| Criterion | Security surveillance camera (ordinary CCTV) | AI facial recognition camera (FaceID) | Legal basis under Law 91/2025 |
|---|---|---|---|
| Data classification | Basic personal data (identifying images) | Sensitive personal data (biometrics) | Clauses 2 & 3, Article 2 of Law 91 |
| Consent requirement | No consent needed in the cases in Clause 1, Article 32; notice under Clause 2 is still required | Valid consent or another legal basis is needed; notify the data subject that sensitive data is being processed | Article 32, Article 9 & Clause 1, Article 11 of Law 91; Articles 43 and 71 of Decree 330/2026 |
| DPIA dossier | Assessed in the organisation's general DPIA dossier | The risks of the biometric algorithm should be assessed in depth in the DPIA dossier | Article 21 of Law 91 & Decree 356/2025 |
| Installation areas | Entrances, corridors, car parks, checkout counters | High-privilege access control doors, attendance points | Clause 1, Article 32 of Law 91 |
| Areas to avoid (recommendation) | Changing rooms, toilets, medical rooms | Changing rooms, toilets, private spaces | Right to private life (Civil Code) & principles in Article 3 of Law 91 |
| Retention period | Kept for as long as necessary under internal rules (recommended 15 to 30 days; vaults and banks 60 to 90 days) | Recommended: delete the template once its purpose ends (for example when an employee leaves, unless otherwise agreed or provided by law) | Clause 4, Article 32 of Law 91 (principle of necessary retention period); Point c, Clause 2, Article 25 of Law 91 |
| Access to extraction | Only security staff authorised in writing | Two-layer encrypted access rights, audit log trail | Data protection measures under Law 91/2025 & Decree 356/2025/ND-CP |
5. A 5-step guide to bringing a business's camera system into compliance
To ensure the business's entire camera surveillance system operates in line with the rules on CCTV data protection in Vietnam, organisations should carry out the following 5 steps right away:
Step 1: Review installation positions and remove cameras from 'prohibited zones'
Survey the entire camera layout of the business. Check the angle of every camera: lenses must not point straight at employees' computer keyboards or private rest rooms. Immediately remove any camera installed in toilets, changing rooms, bathrooms, medical rooms or other personal living areas.
Step 2: Design and install compliant camera notice signs
Put up camera warning signs at all office entrances, reception lobbies, car park entrances and sales areas. The sign should include:
- A clear camera symbol that is easy to recognise from a distance.
- The words: "SECURITY CAMERA SURVEILLANCE AREA".
- Purpose: Ensuring order and safety and protecting the business's property.
- The managing unit and a contact channel for personal data protection matters (with a QR code linking to the camera privacy policy on the website).
Step 3: Issue rules on managing and operating the camera system
The business should issue an internal camera operation policy (CCTV policy) with the following mandatory content:
- A clear list of job titles authorised for live view, and of the persons authorised to play back and export recorded data (playback/export).
- A strict prohibition on employees using personal phones to film the security camera screen and circulate the footage.
- Procedures for sealing and handing over video clips upon an official written request from the police or a court.
Step 4: Set up automatic deletion and overwrite cycles (auto-retention)
The IT/technical team should configure the recorders (DVR/NVR) or cloud storage system to delete or overwrite video automatically on a preset cycle (for example, exactly 30 days). Check the storage logs periodically to ensure the system does not accumulate old recordings beyond the necessary period.
Step 5: Include video recording in the data inventory and the DPIA dossier submitted to the A05 Department (Ministry of Public Security)
Record the camera system as a formal data processing operation in the internal record of processing activities (RoPA) and analyse the physical and technical security measures in the DPIA dossier under Article 21 of Law 91/2025/QH15.
6. Penalties for breaching CCTV data protection in Vietnam under Decree 330/2026/ND-CP
Violations of the rules on protecting personal data obtained from audio and video recording in public places are sanctioned under Article 71 of Decree 330/2026/ND-CP, with fines ranging from VND 10,000,000 to 50,000,000 for organisations (individuals who commit a violation face half that amount), depending on the conduct and its severity:
- Recording audio or video in public places without giving the required notice: A fine of VND 10,000,000 to 20,000,000.
- Extracting or disseminating camera footage, or exploiting it commercially, without authorisation: A fine of VND 30,000,000 to 50,000,000, together with confiscation of the exhibits and means used in the violation and the remedial measure of being required to delete and destroy the unlawfully collected data beyond recovery; where damage is caused, compensation is also payable under civil law.
- Other violations (use for a purpose other than the one notified, installation that intrudes on private life, failure to destroy data when the period expires...): Depending on their nature, such acts may be considered under Article 71 or other relevant articles of Decree 330/2026/ND-CP (for example, Article 39 on breaches of data protection principles: processing for a purpose other than the one determined, or storing data longer than necessary), along with civil liability towards the person whose rights were infringed.
Legal assessment from lawyer Ho Thi Ha Nhi
"Many businesses and retail chains simply assume that because it is their property, they can install as many cameras as they like. However, under Article 32 of Law 91/2025/QH15, the line between protecting property and unlawfully collecting data lies in posting public notice signs and limiting camera angles. Without clear signs, all of that recording risks being treated as improper data collection, sanctioned under Article 71 of Decree 330/2026/ND-CP, and it weakens the evidential value of the data itself if a dispute arises."
Contact lawyer Ho Thi Ha Nhi to review your business's camera system →
When deploying a camera system, especially one with recognition features or connected to external storage services, the personal data impact assessment dossier service helps review information flows and dossier obligations. The scope is assessed against the actual system; it is not assumed that every camera installation requires the same type of dossier.
Frequently asked questions
Does a company that installs cameras in its employees' office need each employee's consent?
An internal office is usually not a public place, so the company cannot automatically rely on the exception in Clause 1, Article 32. Cameras that monitor employees are a technological or technical measure used in managing employees: under Clause 3, Article 25 of Law 91, such a measure may only be applied in accordance with the law, while safeguarding employees' rights and interests, and on the basis that employees clearly know about it. The company needs to identify a legal basis for processing (consent, or a case under Clause 1, Article 19 where its conditions are met, for example performing an agreement with the employee under Point d), limit the purpose to protecting property, avoid filming employees' private screens, and should post a notice sign and issue workplace monitoring rules that employees are informed of in advance. If the cameras include FaceID timekeeping or productivity tracking, the biometric data is sensitive data: employees must be told that their sensitive data is being processed (Point h, Clause 1, Article 43 of Decree 330/2026/ND-CP), and a valid legal basis for processing is needed.
Can a customer whose wallet was stolen in a restaurant demand to view the camera footage?
The restaurant should not let the customer view the full camera screen directly, because the video also contains images of many other customers (infringing third parties' data protection rights). The standard procedure is for the restaurant to have a security staff member extract only the clip directly relevant to the incident or, better still, hand the video file over to the police who handle the theft.
Does a household that installs a camera at its front door facing a public alley breach the PDPL?
An individual who installs a camera at their front door for personal purposes and household security does not breach the law if the camera mainly covers the boundary of their own property. However, if the camera points straight into a neighbour's window or living room and seriously affects their private life, the household may face a claim under the Civil Code provisions on the right to privacy of personal life.
May a security services company keep a client's camera footage after the contract ends?
No, unless the contract or the law provides otherwise. The security services company acts as the processor and may only process data in accordance with its contract with the controller (Point b, Clause 2, Article 37 of Law 91/2025/QH15). When the security contract ends, the controller (the building owner) requires the processor to delete and destroy the data (Clause 3, Article 14); good practice is for the contract to provide in advance for handing over all data and system passwords and deleting all backup copies.
The Vietnamese original of this entry has been reviewed for legal accuracy against the Personal Data Protection Law No. 91/2025/QH15 and current implementing legislation. This English edition is an unofficial translation for reference; the official legal texts are in Vietnamese.
Meet the LexData teamGo further with LexData
Compliance Consulting for Camera Installation and CCTV Monitoring
Work with our lawyers on the filings and documents, end to end.
Learn about the service