What is data subject consent? Consent requirements in Vietnam under the PDPL

What is consent? Consent requirements in Vietnam under the Personal Data Protection Law

What counts as consent and which consent requirements in Vietnam apply are the most basic questions a business faces when it builds forms to collect customer data. Under Article 9 of Law 91/2025/QH15, consent is one of the most important legal bases for processing. For consent to be legally valid, the business must meet the principle of Voluntary – Specific – Transparent – Withdrawable.

To distinguish between giving information and recording a customer's choice, see what a personal data processing notice is, with an example of how it is presented on a consultation request form.

The conditions for valid consent in Article 9 of Law 91/2025

Article 9 of Law No. 91/2025/QH15 sets out the consent requirements in Vietnam in three layers.

1. Voluntary and informed (Clause 2). Consent is only valid if it is given voluntarily and the data subject clearly knows:

• the type of personal data processed and the purpose of processing (Point a);
• the controller or controller-processor (Point b);
• the data subject's rights and obligations (Point c).

2. Clear form (Clause 3). Consent must be expressed in a clear and specific way that can be printed or copied in writing, including in electronic form or a verifiable format. Article 6 of Decree 356/2025/ND-CP details this. Accepted methods are writing, recorded phone calls, SMS consent syntax, email, websites, platforms and apps with a technical consent mechanism, and other printable or copyable methods (Clause 1). Each must make it possible to verify who consented, when and to what. The controller must store consent and bears the burden of proof in a dispute (Clause 2). It may not set consent as the default or give confusing instructions (Clause 3). When asking for consent to process sensitive data, it must tell the data subject that the data is sensitive (Clause 4).

3. Four principles (Clause 4).

• Consent is given for each purpose (Point a).
• Consent must not be bundled with a mandatory condition to agree to other purposes outside the agreement (Point b).
• Consent remains valid until the data subject changes it or as provided by law (Point c).
• Silence or no response is not consent (Point d).

Consent requirements in Vietnam vs GDPR

Many FDI groups start from a GDPR consent framework. The concepts are close, but some differences matter in practice.

The last row matters most. In Europe, activities such as fraud analytics, direct marketing to existing customers or group-wide HR reporting often rely on legitimate interests. Law 91 has no general equivalent of Article 6(1)(f) GDPR. The closest case, Point a, Clause 1, Article 19, is limited to protecting rights or interests against an infringing act where necessary, and the party relying on it must prove it. For many of these activities, consent is the practical basis in Vietnam.

How to collect consent that meets consent requirements in Vietnam

• Web and app forms: use unticked boxes, one per purpose (for example: marketing emails, sharing with partners, transfer abroad). Place the short notice next to the boxes and link to the full privacy notice.
• Cookie banners: offer "accept" and "reject" with equal prominence, and do not load non-essential tracking before a choice is made. Do not block ordinary content behind consent to advertising.
• Paper forms in stores and branches: separate signature fields or tick boxes per purpose, and a copy or photo for the customer.
• Call centres: a script that states the required information, a clear "yes" from the customer, and a stored recording linked to the customer record.
• Employees: consent is only one option, and the power imbalance in employment makes "voluntary" harder to show. Check whether the processing is covered by the employment contract or by law first. See employee personal data in Vietnam.

Whatever the channel, keep a consent log: who agreed, to which purposes, when, through which channel and which version of the notice they saw. Decree 330/2026/ND-CP fines organisations VND 30–50 million for processing without valid consent, for bundling consent, for setting consent as the default, for consent that cannot be verified, for failing to keep a consent log or prove consent, and for not telling data subjects that their sensitive data is being processed. Treating silence as consent, or deliberately continuing to process after a request to stop, carries VND 50–70 million (Article 43).

Special cases: children and sensitive data

• Children: the legal representative exercises the child's rights as data subject, except in the cases in Clause 1, Article 19. Processing a child's data to publish or disclose information about the private life or personal secrets of a child aged 7 or over requires the consent of both the child and the legal representative (Clause 2, Article 24). Decree 330/2026/ND-CP goes further when setting fines: VND 30–50 million for not verifying a child's age before processing, for processing data of a child under 7 without the legal representative's consent, and for processing data of a child aged 7 or over without the consent of both (Clause 1, Article 60). See children's personal data in Vietnam.
• Sensitive data: when asking for consent, the business must tell the data subject that the data is sensitive (Clause 4, Article 6 of Decree 356/2025/ND-CP). See sensitive personal data in Vietnam for the list of categories.
• Finance, banking and credit information: when asking for consent, these businesses must state the purposes (including credit scoring and rating where relevant), the data sources and parties involved, the retention period, and how to withdraw consent and how data is deleted (Clause 2, Article 8 of Decree 356/2025/ND-CP).

Withdrawing consent under Article 10

Withdrawing consent is one of the data subject's rights (Point b, Clause 1, Article 4), and consent remains valid only until the data subject changes it (Point c, Clause 4, Article 9). Article 10 sets the procedure: the right to request withdrawal or restriction applies except in the cases in Article 19 or where the law provides otherwise (Clause 1). The request is made in writing, including electronically or in a verifiable format (Clause 2). The controller must carry it out and require its processors to do the same (Clause 3).

Decree 356/2025/ND-CP sets the timeline in Clause 2, Article 5: respond within 2 working days, then carry out the withdrawal within 15 days, or 20 days where a processor or third party is involved. The deadline can be extended once by no more than 15 days, with reasons given to the data subject. Withdrawal does not make earlier processing unlawful (Clause 4, Article 10). Build the same withdrawal path into every channel where consent is collected, so that withdrawing is no harder than agreeing. For the full set of rights, see data subject rights in Vietnam. The procedure, the exceptions and the fines are covered in withdrawal of consent.

When consent is not required: Clause 1, Article 19 of Law 91/2025

1. Urgent situations to protect the life, health, honour, dignity, or lawful rights and interests of the data subject or of another person; or where necessary to protect the legitimate rights or interests of the business itself, of another person, or of the State or an agency or organisation against an infringing act. The party relying on this case must prove it (Point a).
2. Emergencies and national security: responding to a state of emergency; responding to threats to national security that do not yet warrant declaring a state of emergency; preventing and combating riots and terrorism; preventing and combating crime and violations of law (Point b).
3. Activities of state agencies and state management activities as provided by law (Point c).
4. Performance of an agreement between the data subject and the relevant agency, organisation or individual as provided by law (Point d).
5. Other cases provided by law (Point dd).

For a detailed analysis of each case, the supervision obligations under Clause 2, Article 19 and a comparison matrix, see the handbook entry Processing personal data without consent.

Consent obtained under Decree 13/2023

Businesses that collected consent under the former Decree 13/2023/ND-CP do not need to start again. Processing that was already under way with consent, or under an agreement, before 1 January 2026 may continue without asking again (Clause 1, Article 39 of Law 91/2025). New purposes, new data types or new recipients added after that date must meet the consent requirements in Vietnam under Law 91.

Checklist: consent requirements in Vietnam

1. List every purpose for which you collect data and decide whether each one relies on consent or on a case in Article 19.
2. Make sure each consent request states the data types, purpose, controller and the data subject's rights.
3. Use separate, unticked choices for each purpose, including transfers abroad.
4. Keep a consent log that can be printed or exported.
5. Offer a withdrawal path in every channel and meet the Decree 356 deadlines.
6. Review consent wording whenever a new purpose, vendor or country is added.

To help staff understand the difference between each purpose of use and how to record customers' choices, businesses can consider DPO training and personal data protection awareness training. The practical content is designed around the forms and scenarios of each department.