What is personal data in Vietnam? The definition under Law 91/2025/QH15

What is personal data in Vietnam under Law 91/2025/QH15?

What counts as personal data in Vietnam is the most fundamental concept in compliance management. Under Clause 1, Article 2 of the Personal Data Protection Law No. 91/2025/QH15, personal data is digital data or information in other forms that identifies or helps identify a specific person. The concept covers both the digital environment and physical records.

Decree No. 356/2025/ND-CP sets out the two sub-categories of personal data in Vietnam in detail, covered in the next two sections.

What does basic personal data include under Article 3 of Decree 356/2025/ND-CP?

Basic personal data comprises 11 groups of information:

1. Surname, middle name and given name at birth, other names (if any);
2. Date of birth; date of death or disappearance;
3. Gender;
4. Place of birth, place of birth registration, place of permanent residence registration, place of temporary residence registration, current place of residence, place of origin, contact address;
5. Nationality;
6. Images of the individual;
7. Phone number, personal identification number, passport number, driving licence number, vehicle licence plate number;
8. Marital status;
9. Information on family relationships (parents, children, spouse);
10. Information on the individual's digital accounts;
11. Other information associated with or helping to identify a specific person that is not covered by Article 4 of this Decree.

What does sensitive personal data include under Article 4 of Decree 356/2025/ND-CP?

Sensitive personal data comprises 12 groups of information:

1. Data revealing racial or ethnic origin;
2. Political, religious and belief views;
3. Information on private life, personal secrets and family secrets;
4. Health status;
5. Biometric data and genetic characteristics;
6. Data revealing an individual's sex life or sexual orientation;
7. Data on crimes and violations of law collected and stored by law enforcement agencies;
8. The individual's location as determined through location services;
9. Login names and passwords for the individual's electronic identification account; images of the identity card, citizen identity card or people's identity card;
10. Login names and passwords for bank accounts; bank card information and bank account transaction history; financial and credit information and information on customers' activities and transaction history in finance, securities and insurance at credit institutions, foreign bank branches, intermediary payment service providers, securities and insurance organisations and other licensed organisations;
11. Data tracking behaviour and use of telecommunications services, social networks, online media services and other services in cyberspace;
12. Other personal data that the law requires to be kept confidential or subject to strict security measures.

How do basic and sensitive personal data in Vietnam differ in practice?

The table below compares the two sub-categories by legal basis, scope, risk level, consent requirement, DPIA dossier and protection measures.

What should businesses handling personal data in Vietnam do now?

To manage personal data in line with the law and prevent violations, businesses should immediately take the following steps:

• Map data flows (data mapping): review and inventory all information flows collected from customers, app users and internal staff to separate the basic category clearly from the sensitive category.
• Standardise the consent mechanism: set up separate checkboxes for each processing purpose, never pre-ticked; make sure users receive a separate notice when sensitive data is collected.
• Complete the DPIA dossier on time: promptly prepare the impact assessment dossier and submit it to the specialised personal data protection authority within 60 days of the start of processing, unless the business is one that may opt out or is not required to comply under Clauses 2 and 3, Article 38 of Law 91/2025.