Data protection by industry starts with knowing what personal data each industry handles and which sector rules it answers to. These guides set out what Law No. 91/2025/QH15 requires, the typical risks and a practical roadmap for each industry, for Vietnamese and foreign-invested businesses alike.
Data protection in real estate is an obligation for every developer, brokerage, agent and property manager in Vietnam. Real estate businesses collect personal data at every stage: lead generation, deposits, sale and purchase contracts, mortgage applications, handover and building operations. The biggest risk is buying and selling customer lists and cold-calling without consent, which Law No. 91/2025/QH15 prohibits. Next come copies of citizen ID cards, bank account information, CCTV and facial recognition in managed buildings.
Data protection in healthcare is stricter than in other industries. Almost everything a healthcare provider does involves health data, a sensitive category of personal data under Decree 356/2025/ND-CP. Hospitals, clinics, pharmacies and MedTech apps therefore cannot use the DPIA and DPO relief for small businesses, and must also comply with Article 26 of Law No. 91/2025/QH15 and the medical confidentiality rules of the Law on Medical Examination and Treatment.
Data protection in education is mostly about student data protection. Most learners in kindergartens, schools and language centres are children under 16. Education providers must therefore apply Article 24 of Law No. 91/2025/QH15: parents exercise rights on the child's behalf, children aged 7 or over must also consent before their private information is published, and age must be verified under Decree 330/2026/ND-CP. Student health records, classroom cameras and facial recognition attendance add sensitive data on top.
Data protection in manufacturing is mostly about employee data. A factory with a few thousand workers holds HR files, health check results, fingerprints or face templates for time attendance and CCTV footage of every person. Much of this is sensitive data under Decree 356/2025/ND-CP, so factories must follow the employment rules in Article 25 of Law No. 91/2025/QH15, prepare a DPIA, and file a separate dossier when HR data goes to a parent company abroad.
Data protection in insurance in Vietnam has two layers of rules. The first is Article 26 of the Personal Data Protection Law No. 91/2025/QH15 (PDPL), which has specific rules for the insurance business. The second is the customer confidentiality duties in the Law on Insurance Business No. 08/2022/QH15. Underwriting and claims files are full of health and financial data, which is sensitive personal data under Decree 356/2025/ND-CP. Insurers, agents, brokers and banks selling insurance therefore all need customer consent, a DPIA dossier and tight control over sharing data with partners.
Data protection in banking in Vietnam has its own rules in Article 27 of the Personal Data Protection Law No. 91/2025/QH15 (PDPL) and Article 8 of Decree 356/2025/ND-CP. They include an annual compliance review, a log of all processing activities, consent before credit scoring, and notice to both the A05 Department and the customer within 72 hours when sensitive data is leaked. Banks, finance companies, e-wallets and fintechs must also meet the customer confidentiality duties of the Law on Credit Institutions and the State Bank's circulars on biometrics and Open API.
Data protection in hospitality in Vietnam starts at the front desk. Accommodation providers must report every overnight guest to the police under Article 30 of the Law on Residence, and file a temporary residence declaration for foreign guests under Article 33 of the Law on Entry, Exit, Transit and Residence of Foreigners. Processing hotel guest data for these filings needs no consent under Clause 1, Article 19 of the Personal Data Protection Law No. 91/2025/QH15 (PDPL), but only within what those laws require. Passport copies, card data, hotel CCTV, OTA and booking-engine data flows, systems hosted abroad and loyalty programmes each need their own legal basis and controls.
Data protection in logistics in Vietnam centres on three kinds of data: delivery recipient data printed on every shipping label, driver location data from apps and trackers, and order data passed to partners, including partners abroad. Express carriers, last-mile delivery firms, warehouses and freight forwarders must comply with the Personal Data Protection Law No. 91/2025/QH15 (PDPL), keep postal information confidential under the 2010 Law on Post, and meet the duties of e-commerce logistics providers under the 2025 Law on E-commerce.
Data protection in SaaS in Vietnam starts with splitting two roles. For the data customers put on the platform, the vendor is a data processor that may process it only under a contract (Clause 2, Article 37 of the Personal Data Protection Law No. 91/2025/QH15, the PDPL). For its own account, billing and product analytics data, the vendor is a controller. Cloud rules, a certificate regime for processing services (Decree 356/2025/ND-CP), cross-border dossiers and data localisation under the Law on Cybersecurity No. 116/2025/QH15 come on top.
