What is sensitive personal data in Vietnam? The list in Article 4 of Decree 356/2025

What is sensitive personal data in Vietnam under Law 91/2025/QH15?

Sensitive personal data is the sub-category of information subject to the strictest protection regime. Under Clause 3, Article 2 of Law 91/2025/QH15, sensitive personal data is personal data closely tied to an individual's privacy which, if infringed, directly affects the lawful rights and interests of agencies, organisations and individuals; the Law provides the definition, while the specific list of sensitive personal data is set out in Article 4 of Decree 356/2025/ND-CP. In practice, if this data is infringed, leaked or used without authorisation, it may affect the data subject's honour, health, property and safety.

Organisations and businesses should therefore pay particular attention to identifying and classifying sensitive personal data and applying appropriate protection measures when processing it, to minimise the risks and consequences of data incidents.

Which groups of information count as sensitive personal data in Vietnam under Article 4 of Decree 356/2025/ND-CP?

Sensitive personal data comprises 12 groups of information:

1. Data revealing racial or ethnic origin;
2. Political, religious and belief views;
3. Information on private life, personal secrets and family secrets;
4. Health status;
5. Biometric data and genetic characteristics;
6. Data revealing an individual's sex life or sexual orientation;
7. Data on crimes and violations of law collected and stored by law enforcement agencies;
8. The individual's location as determined through location services;
9. Login names and passwords for the individual's electronic identification account; images of the identity card, citizen identity card or people's identity card;
10. Login names and passwords for bank accounts; bank card information and bank account transaction history; financial and credit information and information on customers' activities and transaction history in finance, securities and insurance at credit institutions, foreign bank branches, intermediary payment service providers, securities and insurance organisations and other licensed organisations;
11. Data tracking behaviour and use of telecommunications services, social networks, online media services and other services in cyberspace;
12. Other personal data that the law requires to be kept confidential or subject to strict security measures.

Note: the personal data of children, of persons who have lost or have limited civil act capacity, and of persons who have difficulty perceiving or controlling their behaviour is specifically governed by Article 24 of Law 91/2025/QH15.

What obligations apply when processing sensitive personal data in Vietnam?

The table below summarises the four groups of key obligations and their legal basis.

How should businesses manage and transfer sensitive personal data in Vietnam?

To comply fully with Law 91/2025/QH15 and Decree 356/2025/ND-CP, businesses must strictly implement the following:

• Establish internal rules: when processing sensitive personal data, agencies and organisations must put in place rules restricting access rights, processing procedures and security measures.
• Consent notice principle: when asking for consent to process sensitive personal data, the data subject must be informed that the data to be processed is sensitive personal data before collection begins.
• DPIA dossier requirements: when preparing a personal data processing impact assessment (DPIA) dossier, the dossier must clearly state the sensitive personal data processed, the categories of data subjects, the purposes of processing, the types of sensitive personal data processed and the corresponding processing activities, and the total number of types of sensitive personal data.
• Security during transfers: transfers of sensitive personal data require physical security measures for storage and transmission devices, encryption, anonymisation of personal data and other security measures during the transfer.

Once the categories of sensitive data have been identified, the business may need to assess risk across all of its processing activities. LexData's DPIA dossier service helps review obligations by role, processing scope and applicable exemptions, rather than relying only on the name of the data type.