Personal data protection in banking: banks, finance companies, e-wallets and fintech

1. Who must comply with data protection in banking in Vietnam?

Data protection in banking applies to every organisation or individual active in finance, banking and credit information, to use the wording of Article 27 of Law 91/2025/QH15. This includes:

• Commercial banks and foreign bank branches: accounts, cards, lending, digital banking and bancassurance.
• Consumer finance and leasing companies: loan files, credit scoring and debt collection.
• Payment intermediaries and e-wallets: eKYC, transaction histories and linked accounts.
• Credit information bodies: the National Credit Information Centre (CIC) and credit information companies.
• Fintechs: credit scoring, data sharing through Open API and peer-to-peer (P2P) lending, including firms in the regulatory sandbox.

Data protection in banking is therefore not just a matter for commercial banks.

Almost all of the sector's main data is sensitive personal data under Clause 1, Article 4 of Decree 356/2025/ND-CP. That covers biometrics (Point dd), ID card images and electronic identity account details (Point i), and accounts, cards, transaction histories and credit information (Point k). Small fintechs and start-ups therefore cannot use the option to skip the DPIA and data protection staff (Clauses 2 and 3, Article 38 of Law 91/2025/QH15).

2. Article 27 of the PDPL and Article 8 of Decree 356: specific rules for data protection in banking

Article 27 of the Personal Data Protection Law No. 91/2025/QH15 sets four duties for organisations in the sector (Clause 1):

1. Fully apply the rules on sensitive data and the sector's safety and security standards.
2. Do not use credit information for scoring, rating or creditworthiness assessment without the customer's consent.
3. Collect only the data needed for credit information activities, from lawful sources.
4. Notify customers when bank account, financial, credit or credit information data is leaked or lost.

Credit information bodies must also prevent unauthorised access, use and disclosure, and have a solution to restore customer data if it is lost (Clause 2).

Article 8 of Decree 356/2025/ND-CP adds duties that no other sector has:

• An annual compliance review and a log of all personal data processing. Organisations must also apply the technical standards on data protection, de-identification and anonymisation (Clause 1).
• Mandatory content of consent requests (Clause 2): the purposes, including credit scoring or rating where relevant; the data sources and the parties that collect or share the data; the retention period; how to withdraw consent; and the deletion policy.
• Dual 72-hour breach notice (Clause 3): when sensitive data is leaked or lost, the organisation that collected it must notify both the A05 Department and the customers. The general duty in Article 23 of the PDPL is to notify only the A05 Department. Outside finance and banking, notice to data subjects within 72 hours applies only to location and biometric data (Article 29 of Decree 356/2025/ND-CP). See the 72-hour breach rule.

Sector-specific fines. Article 64 of Decree 330/2026/ND-CP penalises breaches in finance, banking and credit information. The amounts below are for organisations; individuals pay half:

• VND 50–70 million (Clause 1):

  • no notice, or notice after 72 hours, of a sensitive data leak, or an incomplete notice;
  • no processing log or no annual compliance review;
  • no data recovery solution, or technical standards not applied;
  • consent requests missing the information required by Clause 2, Article 9 of the PDPL.

  Credit information, credit scoring and credit rating services may also be suspended for 1 to 3 months.

• VND 70–100 million (Clause 2):

  • credit scoring or rating without consent;
  • a credit information body lacking anti-leak measures;
  • collecting more data than needed, or from unlawful sources.

  These services may also be suspended for 3 to 6 months.

3. Bank customer confidentiality under the Law on Credit Institutions

Banks had duties of bank customer confidentiality long before the PDPL. Specific rules in laws passed before the PDPL, such as the Law on Credit Institutions, still apply as long as they do not conflict with the PDPL's principles (Clause 2, Article 5 of the PDPL). Sector decrees and circulars also apply alongside it:

The anti-money laundering retention period is a legitimate reason not to delete data at once when a customer closes an account and asks for erasure (Point c, Clause 1 and Clause 5, Article 14 of the PDPL). See the right to erasure.

4. Biometrics and eKYC: the most sensitive data in digital banking

Since 1 January 2025, State Bank circulars have required biometric matching against the chip ID card or VNeID before customers can transact electronically:

• Payment accounts: cash withdrawals and electronic payments are allowed only after the ID document and biometric data have been matched (Point c, Clause 5, Article 17 of Circular 17/2024/TT-NHNN).
• Bank cards: cards may be used for electronic transactions only after matching is complete (Clause 6, Article 16 of Circular 18/2024/TT-NHNN).
• E-wallets: matching is required before electronic transactions (Point c, Clause 6, Article 25 of Circular 40/2024/TT-NHNN).
• Online transactions: certain transfers require biometric authentication under Circular 50/2024/TT-NHNN, as amended by Circular 77/2025/TT-NHNN.

As a result, every bank and e-wallet now holds biometric data on millions of customers. Clause 4, Article 31 of Law 91/2025/QH15 requires physical security for storage and transmission equipment, restricted access, and monitoring systems to detect intrusions. Under Article 29 of Decree 356/2025/ND-CP, affected customers must be notified within 72 hours if biometric data is leaked.

5. Credit information, Open API and fintech

Credit scoring needs its own consent

Credit information is a competitive asset for finance companies and fintechs. The PDPL requires consent for credit scoring and rating (Point b, Clause 1, Article 27), and the consent request must name scoring as a purpose (Point a, Clause 2, Article 8 of Decree 356/2025/ND-CP). Alternative data collected for scoring, such as contact lists, call logs and app behaviour, must also pass the test of "only necessary data, from lawful sources" (Point c, Clause 1, Article 27). Over-collection is fined VND 70–100 million.

Open API: clear consent and access for at most 180 days

Circular 64/2024/TT-NHNN (effective 1 March 2025) governs banks sharing individual customer data with third parties through Open API:

• It requires clear, voluntary and affirmative consent from the customer (Clause 6, Article 3).
• Banks must give customers a tool to see and withdraw consent (Clause 5, Article 11).
• Access lasts at most 180 days unless otherwise agreed (Clause 6, Article 11).
• Banks connected before the Circular took effect must fully comply before 1 March 2027.

Fintechs in the regulatory sandbox

Decree 94/2025/ND-CP (effective 1 July 2025) allows controlled testing of three solutions: credit scoring, data sharing through Open API, and peer-to-peer lending. Its data conditions include:

• P2P lending platforms must keep their IT and data storage systems in Vietnam and keep customer data confidential (Point d, Clause 2, Article 11).
• Internal rules must cover customer confidentiality and measures against leaks of personal information (Clause 6, Article 22).

Joining the sandbox does not exempt a fintech from the PDPL's rules on data protection in banking.

6. Five common risks in data protection in banking

These are the situations LexData sees most often when advising on data protection in banking.

• Loan telesales using bought lists. Many sellers of consumer loans and credit cards work through partners that use customer lists of unknown origin. This is a textbook case of selling personal data, which carries fines of up to 10 times the revenue.
• Debt collectors contacting unrelated people. Collectors call reference contacts, colleagues and relatives and reveal the debt. This processes data beyond its purpose and may breach bank customer confidentiality.
• Third-party SDKs in banking apps. Advertising and analytics SDKs send device and behavioural data outside the bank. Online behavioural tracking data is sensitive (Point l, Clause 1, Article 4 of Decree 356/2025/ND-CP).
• Staff looking up customer data outside their duties. The processing log required by Clause 1, Article 8 of Decree 356/2025 is the tool for catching this, not just a compliance duty.
• Keeping ID card images and eKYC videos indefinitely. eKYC records must be kept for the anti-money laundering retention period, but they should not sit in operational systems with broad access.

7. Data protection in banking: obligations and fines at a glance

8. Data protection in banking for foreign-invested institutions

Wholly foreign-owned banks, foreign bank branches and foreign-invested finance companies often run fraud detection, CRM, credit risk analytics or card processing from regional hubs. Each of these flows is a cross-border transfer under Article 20 of the PDPL that needs an impact assessment dossier filed with the A05 Department within 60 days.

Three differences from group standards often come up when applying data protection in banking in Vietnam:

• Customers must be notified of a breach within 72 hours, without the GDPR's "high risk" threshold.
• A compliance review is mandatory every year.
• P2P lending platforms in the sandbox must store data in Vietnam.