5 cases of processing without consent in Vietnam under Article 19

Processing without consent in Vietnam: the 5 exceptions under Article 19

Processing without consent is a special legal mechanism that resolves the tension between an individual's informational self-determination and society's pressing operational needs. The most fundamental principle of personal data protection law worldwide, and in Vietnam, is respect for individual self-determination: every act of collecting, analysing and sharing personal data must be based on the data subject's voluntary and transparent consent (under Article 9 of Law 91/2025/QH15). In economic and social life, however, applying this principle mechanically and absolutely would lead to serious deadlock: doctors could not give emergency treatment to unconscious patients, the police could not catch criminals, and businesses could not deliver goods to customers until they had completed a string of repetitive consent procedures.

To resolve this conflict, Article 19 of the Personal Data Protection Law No. 91/2025/QH15 establishes a mechanism for 'processing personal data in cases where the data subject's consent is not required'. It is one of the provisions of greatest practical value, providing a firm legal basis for the operations of state agencies and businesses while imposing strict oversight limits to prevent abuse.

1. Detailed analysis of the 5 consent exemptions under Clause 1, Article 19

Under Clause 1, Article 19 of Law 91/2025/QH15, personal data may be processed without the data subject's consent in exactly the following 5 cases:

Case 1: Urgent situations to protect life, health and legitimate interests (Point a)

This applies to protect the life, health, honour, dignity, or lawful rights and interests of the data subject or of another person in an urgent situation. It also covers the necessary protection of the lawful rights or legitimate interests of the organisation itself, of another person or of the State against an infringing act. Important note: the law provides that the controller, the processor, the controller-processor or the third party bears the responsibility to prove this urgent situation when requested.

Practical examples: a medical facility retrieves the medical history and blood type of a critically injured road accident victim without being able to wait for relatives to sign a consent form; or a bank's cybersecurity team analyses IP addresses and device IDs to isolate an attack aimed at taking over customer accounts.

Case 2: Emergencies and national security (Point b)

This applies to responding to a state of emergency; responding to threats to national security that do not yet warrant declaring a state of emergency; preventing and combating riots and terrorism; and preventing and combating crime and violations of law. In this case, telecommunications companies, banks and digital platforms may provide data at the valid request of the competent authority to support investigations without the account holder's consent.

Case 3: Activities of state agencies (Point c)

This applies where processing serves the activities of state agencies and state management activities as provided by law. Examples: the tax authority processes citizens' income data for tax finalisation; the social insurance agency manages social insurance contribution records; the statistics agency conducts a population census.

Case 4: Performance of an agreement by the data subject (Point d)

This is the most important legal basis for the business sector: processing data to perform an agreement between the data subject and the relevant agency, organisation or individual as provided by law. When a customer places an order on an e-commerce website or signs a consulting services contract, the business may process the customer's name, phone number, delivery address and payment details to deliver the goods and issue invoices without a separate consent step for fulfilling that order.

Case 5: Other cases provided by law (Point dd)

This covers other cases provided for by law, typically in specialised legislation (such as the Law on Credit Institutions, the Law on Anti-Money Laundering, the Law on Notarisation, etc.).

2. The obligation to set up 4 mandatory oversight mechanisms (Clause 2, Article 19)

Law 91/2025/QH15 makes it clear that processing without consent in Vietnam does not mean processing arbitrarily. Under Clause 2, Article 19, an organisation processing data under an exception must set up a comprehensive oversight mechanism with 4 components:

1. Internal procedures: Issue clear internal procedures and rules, and specify the responsibilities of each individual and department when processing data without consent.
2. Safeguards and risk assessment: Implement appropriate technical protection measures; regularly assess the risks that may arise to the rights and interests of data subjects.
3. Periodic checks and assessments: Carry out periodic reviews and audits of compliance with the law and with internal processing procedures.
4. Channels for feedback and complaints: Set up a mechanism to receive and promptly handle feedback and recommendations from state agencies and relevant organisations and individuals.

3. A 4-step review before relying on an Article 19 exception

To avoid being penalised by the authorities for unlawful processing, a business should follow a 4-step review process:

Step 1: Legal ground assessment

The legal team or the data protection officer (DPO) must compare the intended processing activity against the 5 cases in Clause 1, Article 19. Never stretch the concept of 'the legitimate interests of the organisation' to cover purely commercial, profit-seeking activities (such as selling customer data or marketing spam).

Step 2: Necessity & proportionality test

The business must be able to answer two core questions:

• Is this activity genuinely necessary to achieve a lawful objective? Is there a less privacy-intrusive way to achieve the same purpose?
• Has the scope of data collected been kept to the minimum necessary? If performing the contract only requires a phone number and a delivery address, the business must never also collect the customer's citizen identity card (CCCD) number or date of birth.

Step 3: Prepare a legal justification memo

Point a, Clause 1, Article 19 places the burden of proving an urgent situation on the controller, the processor, the controller-processor and the third party; Point b, Clause 3, Article 47 of Decree 330/2026/ND-CP penalises failing to prove the basis for processing without consent when the competent authority inspects. The business should therefore prepare an internal legal memo kept in its compliance file, recording: the reason for relying on Article 19, when processing started, the types of data used, the identity of the approver and the expected end date of the processing.

Step 4: Operate all 4 oversight mechanisms under Clause 2, Article 19

Update the business's record of processing activities (RoPA); restrict access rights to the staff directly handling the situation; open a dedicated email inbox (e.g. privacy@company.vn) to receive and resolve feedback from the data subjects concerned.

4. Legal risks of processing without consent in Vietnam and penalties under Decree 330/2026/ND-CP

Under Decree 330/2026/ND-CP, abusing or misapplying the rules on exceptions to consent will be dealt with under the corresponding provisions:

• Processing personal data without consent where the case does not fall under Article 19, setting consent as the default, treating silence as consent, or failing to properly perform obligations relating to consent: Article 43 — a fine of VND 30–50 million for organisations (Clause 1, covering both processing without consent and setting consent as the default); VND 50–70 million for treating silence as consent or intentionally continuing processing after the data subject has asked for it to stop or be restricted (Clause 2).
• Violating the rules on processing without consent: Article 47 — VND 10–20 million for failing to set up the oversight mechanisms under Clause 2, Article 19 (procedures, periodic checks, a feedback channel); VND 20–30 million for failing to implement appropriate protective measures, leading to data being leaked or lost, or failing to assess risks; VND 30–50 million for exploiting the cases in Clause 1, Article 19 to process data beyond the necessary purpose and scope, or failing to prove the basis when inspected.
• Violating the data protection principles, or collecting/providing data unlawfully while relying on an exception: considered under the other corresponding provisions of Decree 330/2026/ND-CP (e.g. Article 39 on the personal data protection principles, VND 20–60 million depending on the violation); where damage is caused, compensation is also payable under civil law.

Note: revenue-based penalties (1–5% of the preceding year's revenue in the Vietnamese market) apply only to certain cross-border personal data transfer violations under Article 56 of Decree 330/2026/ND-CP. See the details in the handbook entry Penalties for personal data protection violations.