What is data de-identification in Vietnam? Standards for data trading under Law 91

What is data de-identification in Vietnam under Personal Data Protection Law 91/2025?

What data de-identification in Vietnam means is a major question for technology and financial companies. Under Clause 11, Article 2 of Law 91/2025/QH15, data de-identification is the 'golden key' that opens up opportunities to commercialise data and train artificial intelligence (AI/Machine Learning) safely without breaching the law.

The legal definition is short: de-identification is "the process of changing or deleting information to create new data that cannot identify, or cannot help identify, a specific individual" (Clause 11, Article 2 of Law No. 91/2025/QH15). Clause 1 of the same Article adds the consequence: personal data that has been de-identified is no longer personal data. The test is therefore about the result, not the technique used. If a specific person can still be identified, directly or with help from other information, the data is still personal data.

De-identification vs pseudonymisation vs encryption

These three terms are often mixed up in vendor documentation and data-sharing contracts. The difference decides whether the Law still applies to the output.

Pseudonymisation and encryption are valuable security measures, and they reduce the harm of a leak. They do not take the data outside the scope of Law 91. The same logic applies under GDPR, where anonymous data falls outside the Regulation but pseudonymised data remains personal data.

Legal obligations when carrying out data de-identification in Vietnam

De-identification is listed among the processing activities in Clause 6, Article 2, so the organisation doing it is still processing personal data until the process is complete. Clause 6, Article 14 of Law 91/2025 sets three rules:

1. Control and supervision (Point a): the organisation must tightly control and supervise the de-identification process and prevent unauthorised access, copying, appropriation, disclosure or loss of personal data during the process.
2. No re-identification (Point b): data that has been de-identified must not be re-identified, unless the law provides otherwise. Re-identification can be fined VND 50–60 million under Point b, Clause 3, Article 51 of Decree 330/2026/ND-CP.
3. Compliance with other laws (Point c): de-identification must also comply with other relevant legislation, for example sector rules on banking secrecy or medical records.

Article 51 of Decree 330/2026/ND-CP sets the fines for organisations:

• VND 10–30 million for de-identifying without tight control and supervision, or without measures to prevent unauthorised access, copying, appropriation, disclosure or loss during the process (Points d and dd, Clause 1).
• VND 30–50 million where unauthorised access, copying, appropriation, disclosure or loss actually occurs during de-identification (Point d, Clause 2).
• VND 50–60 million for re-identifying data that has been de-identified, unless the law provides otherwise (Point b, Clause 3).

In practice, this means the business needs a legal basis for the de-identification step itself. It should also restrict who can access the raw data and the working files, and keep a record of the method used and the risk assessment carried out.

Common data de-identification techniques

• Data Masking & Suppression: Masking or completely removing identifying fields (citizen identity card (CCCD) number, phone number, email).
• K-Anonymity model: Ensuring that each record is always indistinguishable from at least k−1 other individuals in the dataset.
• L-Diversity & T-Closeness models: Ensuring diversity of sensitive attributes to resist inference attacks.
• Differential Privacy: Adding controlled mathematical noise to protect individual identities.
• Synthetic Data: Using a model to generate artificial data for a defined purpose; re-identification risk must be tested, and this should not be treated as a commitment to fully reproduce the source data.

When de-identified datasets feed AI or analytics projects, a personal data processing impact assessment helps document the remaining re-identification risk.

No single technique is enough on its own. Masking direct identifiers is usually the first step. Generalisation (age bands instead of dates of birth, province instead of street address) and suppression of rare values then deal with indirect identifiers. Noise or synthetic data are used where the output will be published or shared widely.

Testing whether data is really de-identified

Law 91 does not prescribe a test method, so businesses should document their own. International practice uses three questions:

• Singling out: can any record still be isolated as belonging to one person?
• Linkability: can records be linked with another dataset (public registers, social media, a partner's data) to identify someone?
• Inference: can a sensitive attribute of a person be deduced with high confidence?

A useful approach is to ask whether a motivated person with access to publicly available information could identify someone in the dataset. Repeat the test when the dataset is enriched, when it is shared with a new recipient, or when new public data sources appear. A dataset that passes today may fail after it is combined with something else.

Use cases: analytics, AI training and data trading

• Internal analytics and reporting: aggregated or de-identified dashboards reduce the number of staff who need access to personal data.
• AI and machine learning: training on de-identified data reduces legal risk, but models can memorise rare records. Where personal data is still used, Article 30 of Law 91/2025 requires processing to stay within the necessary scope and AI processing to be classified by risk level.
• Sharing with partners and researchers: a data-sharing agreement should prohibit re-identification and linkage with other data, and allow audits.
• Data exchanges: buying and selling personal data is prohibited unless a law provides otherwise (Clause 6, Article 7 of Law 91/2025), and Decree 356/2025/ND-CP requires personal data to be de-identified before it is traded on data exchanges (Clause 5, Article 7). A paid transfer on a data exchange without de-identification counts as unlawful buying and selling of personal data (Point e, Clause 1, Article 53 of Decree 330/2026/ND-CP). See selling personal data in Vietnam for the wider rules.

Checklist for data de-identification in Vietnam

1. Define the purpose and the minimum data the output needs.
2. Confirm the legal basis for the de-identification step and record it in your record of processing activities.
3. Classify the fields into direct identifiers, indirect identifiers and sensitive attributes.
4. Choose and combine techniques suited to how the output will be used and who will receive it.
5. Test re-identification risk for singling out, linkability and inference, and document the result.
6. Separate the raw data from the output, and limit access to both the raw data and any keys.
7. Bind recipients contractually not to re-identify or link the data.
8. Review regularly, especially before publishing, sharing or selling a dataset.