What is a privacy notice in Vietnam? Personal data processing notice content and an example
A personal data processing notice, commonly called a privacy notice in Vietnam, is content that explains to individuals which data is processed, for what purpose, which entity is responsible, and the related rights and obligations. This is a functional description of the notice; providing information does not by itself replace the data subject's consent.
Law 91/2025/QH15 and Decree 356/2025/ND-CP
Official legal texts
Key takeaways for businesses
- A notice helps data subjects understand the processing; consent expresses their choice to allow the processing. The two functions must be kept distinct.
- When obtaining consent, the information the data subject must clearly know is set out in Clause 2, Article 9 of Law 91/2025/QH15; specialised situations may carry additional requirements.
- The content must reflect actual activities. A long policy or a single catch-all tick box does not by itself prove valid consent.
What is a personal data processing notice? When filling in a consultation request form, customers need to understand who receives their information and how it will be used. The business must explain this, and must also identify the appropriate basis for processing.
What is a privacy notice in Vietnam?
In practice, a privacy notice is usually called a privacy notice or a personal data processing notice. This entry uses the term to describe the function of providing information; it does not treat it as a verbatim definition from Law 91/2025/QH15.
The relevant provisions are Point a, Clause 1, Article 4 on the right to be informed and Clause 2, Article 9 on the information the data subject must clearly know for consent to be effective. The person the information concerns is the data subject, who may be a customer, a job applicant or an employee.
Clauses 1 and 2, Article 42 of Decree 356/2025/ND-CP provide that the decree takes effect from 01/01/2026 and that Decree 13/2023/ND-CP ceases to be effective at the same time. Notice templates built under the old rules therefore need to be reviewed again.
Distinguishing the notice, the privacy policy and consent
Distinguish them by function. One document may contain both policy content and a notice section; its title does not determine whether it meets the requirements.
Three functions commonly encountered when collecting information
| Content | Function | Key distinction |
|---|---|---|
| Personal data processing notice | Explains the processing to the individual | Reading or receiving a notice does not in itself mean consent |
| Privacy/data protection policy | Sets out how the organisation manages, uses and protects information | Its scope may be wider than a single form or activity |
| Consent | Expresses the individual's permission to process their data | Must meet the legal conditions; it is not just the label on a tick box |
For example, a website placing a policy link below a form is one way of providing information. Obtaining consent still requires a separate, appropriate and verifiable mechanism. See also data subject consent. For the public policy page itself, see website privacy policy in Vietnam.
What must a privacy notice in Vietnam make clear?
Information required when obtaining consent
Clause 2, Article 9 of Law 91/2025/QH15 sets out three groups of information the data subject must clearly know when voluntarily consenting:
- Type of data and purpose: state the information processed and why it is used.
- Responsible party: identify the controller or the controller-processor.
- Rights and obligations of the data subject: explain the relevant content under the law; see data subject rights.
For instance, instead of 'collecting information for business purposes', the form can state that the name, email and question are used to respond to the consultation request. The roles of controller and processor must be correctly identified, rather than just naming the website's brand.
When seeking consent for sensitive data, the data subject must be informed that the data is sensitive under Clause 4, Article 6 of Decree 356. The finance, banking and credit information sectors have additional content under Clause 2, Article 8; do not apply a generic list to every activity.
Items worth adding to help readers understand
For ordinary forms, LexData recommends also explaining the data recipients, the retention period or the criteria for setting it, the contact channel and how to submit requests. This is a presentation suggestion; the specific obligations must be checked against the activity, the sector and the relevant law.
The information should match reality. If customer management software or an email provider receives the data, review that transfer flow. Retention periods need a basis; Clause 3, Article 3 provides that storage must be appropriate to the purpose, unless otherwise provided by law. Do not set one arbitrary period for all records.
Example notice on a consultation request form
Suppose Company A operates its own form to receive questions and replies by email. Below is an illustrative summary drafted by LexData; the business must complete the actual information and the rights and obligations section before using it.
Company A collects your full name, email and question in order to receive, contact you about and respond to your consultation request. Company A decides the purposes and means of processing and processes this information directly.
Before choosing to consent, please read the full notice on data recipients, retention periods, the related rights and obligations, and how to contact us to submit requests. Receiving newsletters about our services, if any, is presented as a separate choice.
When implementing it, replace 'Company A' with the actual entity and place a link to the full version where it is easy to see. For free-text fields, remind customers not to submit sensitive records or other people's information unless necessary.
If consent is relied on, the choice can be designed to allow the stated information to be used to respond to the request. Newsletter sign-up has a separate purpose. Points a and b, Clause 4, Article 9 require consent for each purpose and prohibit forcing consent to other purposes beyond the content of the agreement. Do not bundle everything into a single 'I agree to all policies' statement.
How should a privacy notice in Vietnam be presented and updated?
Place the information before the related choice
Clause 1, Article 11 requires consent before collection, unless otherwise provided by law. Where consent is relied on, display the summary and the full version before the consent action; check both mobile screens and paper forms.
Keep the content provided and the choices received
Clauses 1 and 2, Article 6 of Decree 356 require a method that can verify who consented, when, to what, and the storage of the consent. In practice, manage versions of the notice together with the corresponding choice records. A visit to the policy page does not by itself prove consent.
Review when activities change
When adding purposes, data or recipients, check the notice against the new activity and the basis for processing. If consent is relied on, check the scope already consented to; updating the policy page does not extend that scope by itself. Changing a contact address and adding a marketing purpose must be assessed differently.
Common mistakes when drafting a privacy notice in Vietnam
- Copying templates: listing data and purposes the business does not actually use.
- Confusing being informed with consenting: treating receipt of a notice or silence as agreement, contrary to the principle in Point d, Clause 4, Article 9.
- Stating rights without explaining how to exercise them: clearly indicate the contact channel and the corresponding procedure.
- Using one template for every activity: a Q&A form and an activity involving sensitive data need separate reviews.
Businesses that need to check their privacy notice in Vietnam against their forms, data flows and consent mechanism can consider LexData's personal data protection compliance consulting service. The work is built around actual activities and an agreed scope of advice.
Frequently asked questions
What is a 'privacy notice' called in Vietnamese?
It is usually called a privacy notice (thong bao quyen rieng tu) or a personal data processing notice (thong bao xu ly du lieu ca nhan). This entry explains the function of providing information under Vietnamese law and does not assume that every GDPR requirement applies.
If we already have a privacy policy, do we need a separate notice?
It depends on the content, how it is provided and the specific activity. The notice may be integrated into the policy if it meets the applicable requirements; the document's title does not by itself determine the level of compliance.
Does publishing a notice mean customers have consented?
No. When obtaining consent, Article 9 of Law 91/2025/QH15 and Article 6 of Decree 356/2025/ND-CP must be met. Providing information and recording consent are two different functions.
Does the notice apply to paper forms?
Information may be provided directly on the paper form or in an accompanying document. Where consent is relied on, the data subject must still clearly know the relevant information and express their choice by an appropriate, verifiable method.
If the purpose of processing changes, is it enough to amend the notice?
It cannot be concluded that amending the notice alone is enough. The basis for the new activity must be assessed; if consent is relied on, the new purpose must fall within the scope of valid consent, which is not extended simply by publishing a new policy.
The Vietnamese original of this entry has been reviewed for legal accuracy against the Personal Data Protection Law No. 91/2025/QH15 and current implementing legislation. This English edition is an unofficial translation for reference; the official legal texts are in Vietnamese.
Meet the LexData teamGo further with LexData
Personal data protection compliance consulting for businesses
Work with our lawyers on the filings and documents, end to end.
Learn about the service