Who is a data subject in Vietnam? Definition and examples

Who is a data subject? This concept separates the person whose information is processed from the unit that collects, stores or uses that information. In Vietnamese law the term is chu the du lieu ca nhan, commonly rendered in English as data subject. This handbook entry explains how to identify data subjects through examples; it does not replace the guidance on submitting requests or handling complaints.

Who is a data subject in Vietnam under current law?

Clause 5, Article 2 of Law 91/2025/QH15 provides: A data subject is the person whom personal data reflects. The Law took effect on 01/01/2026 under Clause 1, Article 38. That definition is the direct legal basis for this entry; the scenarios below are LexData's illustrative examples.

To understand the word "reflects", ask: what does this information say, and about whom? A medical examination form describes a patient's health. A timesheet records an employee's working hours. In each case, the person described is the one to identify, even though they did not create the document themselves.

Must a full name be shown before the data subject can be identified?

Not necessarily. Clause 1, Article 2 also covers information that helps identify a specific person. For example, a transcript may show only student codes, but the school holds a table matching codes to identities. Removing the name column is not enough to conclude that the transcript no longer relates to individuals.

Conversely, do not assume that every number or technical code can identify a person. Look at the context and whether the information can be linked. You can read more about the concepts of personal data and data de-identification to tell them apart.

Examples of data subjects in common relationships

Customer and delivery recipient

Lan orders a gift for Minh and enters Minh's phone number and address for delivery. Lan is the one placing the order, but the recipient information reflects Minh. If the order also stores Lan's account and purchase history, the document contains information about both people. You cannot identify every data subject based only on who clicked the button to submit the form.

Employee and emergency contact

Huong's personnel file contains her father's phone number for use when needed. The work-related entries reflect Huong; the contact person's name and phone number also reflect Huong's father. The fact that an employee supplied a relative's details does not by itself resolve every legal requirement for using that information.

Student and the person registering on their behalf

Parents enter their child's name, academic results and health status in an enrolment file. The child is the data subject of that information. The parents' payment or contact details may reflect the parents themselves. A shared file does not mean every data field belongs to one person.

Distinguishing the data subject from the controller and the processor

The roles below are defined in Clauses 5, 7, 8 and 9, Article 2 of Law 91/2025/QH15. The table helps distinguish the concepts; the role of a given unit in a specific transaction must be determined from its actual activities and contracts.

A person can be an employee who processes customer files at work and, at the same time, the data subject of their own personnel file. A role must therefore be tied to the set of information and the activity under consideration. See also the difference between a controller and a processor.

Can a company be a data subject in Vietnam?

Under the definition in Clause 5, Article 2, the concept refers to the human being reflected, not a legal entity. Distinguish information about a company from information about the individuals who work there. The business name on a contract is different from the name, signature or phone number of its representative.

For example, a B2B contract may contain personal information about the signatory on each side. The fact that the contract is signed between two organisations does not strip that information of its personal character. Nor should a company be called a "data subject" merely because it paid to build, or currently manages, a database.

Does a representative replace the data subject?

Distinguish the person the information reflects from the person entitled to act on their behalf. Clause 2, Article 24 of Law 91/2025/QH15 provides that a legal representative exercises rights on behalf of the groups named in that article, including children and certain cases relating to civil act capacity, except in the cases of processing without consent set out in Clause 1, Article 19.

For example, when a representative exercises rights over a child's file, the child remains the person the information reflects. The representation does not turn the child's academic or health information into the representative's information. It cannot be inferred that any relative or anyone who fills in a form is entitled to act on the data subject's behalf in every case.

Where are the rights and obligations of data subjects set out?

Clause 1, Article 4 of Law 91/2025/QH15 sets out six groups of rights: to be informed; to decide on consent; to access and rectify; to request provision, deletion or restriction of, or to object to, processing; to use complaint, denunciation, litigation and compensation mechanisms; and to request protective measures. This is a summary; read the article itself to determine its full content.

Clauses 2 and 3 of Article 4 also set out obligations and principles for exercising these rights. Having rights over one's own information does not mean being able to demand any action while disregarding the law, a contract or the lawful rights of others. For a separate discussion, see the handbook entry on data subject rights.

Article 5 of Decree 356/2025/ND-CP specifies the procedures and time limits for each group of requests. Distinguish responding to a request from completing it; do not apply one common time limit to every right. This section places the concept within the legal framework; it is not a detailed operating procedure.

Common misunderstandings about the data subject in Vietnam

• Confusing them with the provider: a person who sends a list may be sending information about many other people.
• Confusing them with the record holder: having access to a file does not determine whom its contents reflect.
• Counting only customers: examples can include delivery recipients, job applicants, employees or contact persons.
• Assuming one person per file: an order or contract may contain several groups of information linked to different individuals.

When using the term in documents, state clearly which group of people is meant, rather than writing "users" for all the data. Businesses that need to identify these groups across multiple systems can consider our personal data protection compliance consulting service.