What is personal data processing in Vietnam? 12 typical activities under Law 91/2025
Personal data processing is any activity that affects personal data, including one or more of the following: collection, analysis, aggregation, encryption, decryption, editing, deletion, destruction, de-identification, provision, publication and transfer of personal data, and other activities affecting personal data.
Personal Data Protection Law No. 91/2025/QH15
Official legal texts
Key takeaways for businesses
- Personal data processing is any activity that affects personal data, including one or more of the following: collection, analysis, aggregation, encryption, decryption, editing, deletion, destruction, de-identification, provision, publication, transfer and other activities affecting personal data.
- Processing covers the entire information lifecycle; even merely 'storing' data on a server or in the cloud is a processing activity, falling under 'other activities affecting personal data' in Clause 6, Article 2 and governed by Article 18 of Law 91/2025.
- Every processing activity must comply with the principles in Article 3 of Law 91/2025 (compliance with the law, within scope, for specific and clear purposes) and have the data subject's consent, except in the cases not requiring consent under Article 19 or where the law provides otherwise.
What is personal data processing in Vietnam under the Personal Data Protection Law?
What counts as personal data processing in Vietnam is the core question a business must answer to define the scope of its compliance responsibilities. Under Clause 6, Article 2 of the Personal Data Protection Law No. 91/2025/QH15, personal data processing is any activity that affects personal data, including one or more of the following: collection, analysis, aggregation, encryption, decryption, editing, deletion, destruction, de-identification, provision, publication and transfer of personal data, and other activities affecting personal data.
This provision covers the entire lifecycle of information within a business, from the moment it arises until it is completely destroyed:
12 activities and 4 typical stages of personal data processing
A typical 4-stage processing chain:
- Stage 1 - Intake & collection: Collection through website forms, mobile apps, recruitment processes, CCTV systems or transfers from partners.
- Stage 2 - Storage & management: Storage on cloud/on-premise servers, encryption, decryption, access control permissions and backups.
- Stage 3 - Analysis & use: Data analysis, report aggregation, editing records, provision or transfer to third-party processors.
- Stage 4 - End of lifecycle: De-identifying data, deletion following the data subject's withdrawal of consent, or permanent destruction once the purpose has been fulfilled.
Frequently asked questions
Is simply keeping an Excel file of customers on a computer considered data processing?
Yes. Recording and storing files containing personal data on a computer, hard drive or in the cloud are all acts of personal data processing (collection and 'other activities affecting personal data' under Clause 6, Article 2; storage must be protected under Clause 1, Article 18 of Law 91/2025).
Do we need users' permission to copy data from an old server to a new one?
If the copying serves the same purpose originally consented to and does not change the privacy policy, consent does not need to be obtained again (consent remains valid until the data subject changes it, Point c, Clause 4, Article 9), but technical security must be ensured. If the new server is located abroad or run by an outside provider, the cross-border transfer obligations (Article 20) and the agreement with the processor (Article 37) must also be considered.
The Vietnamese original of this entry has been reviewed for legal accuracy against the Personal Data Protection Law No. 91/2025/QH15 and current implementing legislation. This English edition is an unofficial translation for reference; the official legal texts are in Vietnamese.
Meet the LexData teamGo further with LexData
Personal Data Protection Compliance Consulting for Businesses
Work with our lawyers on the filings and documents, end to end.
Learn about the service