Personal data protection in insurance: insurers, agents, brokers and bancassurance
Data protection in insurance in Vietnam has two layers of rules. The first is Article 26 of the Personal Data Protection Law No. 91/2025/QH15 (PDPL), which has specific rules for the insurance business. The second is the customer confidentiality duties in the Law on Insurance Business No. 08/2022/QH15. Underwriting and claims files are full of health and financial data, which is sensitive personal data under Decree 356/2025/ND-CP. Insurers, agents, brokers and banks selling insurance therefore all need customer consent, a DPIA dossier and tight control over sharing data with partners.
Personal Data Protection Law No. 91/2025/QH15 (Article 26); Decree 356/2025/ND-CP; Decree 330/2026/ND-CP (Article 62); Law on Insurance Business No. 08/2022/QH15, amended by Law 139/2025/QH15 (Articles 20, 22, 129, 137); Circular 67/2023/TT-BTC, amended by Circular 96/2026/TT-BTC (Article 53); Decree 174/2024/ND-CP
Official legal texts
- Law 91/2025/QH15 — Government e-portal (official Vietnamese text)
- Decree 356/2025/ND-CP — Government e-portal (official Vietnamese text)
- Decree 330/2026/ND-CP — Government e-portal (official Vietnamese text)
- Law on Insurance Business No. 08/2022/QH15 — Government policy portal (official Vietnamese text)
- Circular 67/2023/TT-BTC — Official Gazette (official Vietnamese text)
Key takeaways on data protection in insurance
- Point a, Clause 1, Article 26 of Law 91/2025/QH15 requires the customer's consent throughout the collection and processing of personal data in the insurance business, except in the cases in Clause 1, Article 19.
- Insurers, agents and brokers all owe a duty of customer confidentiality (Point i, Clause 2, Article 20; Point i, Clause 2, Article 129; Point a, Clause 2, Article 137 of the 2022 Law on Insurance Business). Information may only be disclosed with the customer's consent or at a competent authority's request.
- Transferring customer data to reinsurance partners must be stated clearly in the contract with the customer (Clause 4, Article 26 of the PDPL). A breach is fined VND 50–70 million for an organisation (Point a, Clause 1, Article 62 of Decree 330/2026/ND-CP).
Personal data processed in insurance
| Data group | Examples | Classification |
|---|---|---|
| Identity and contact details of the policyholder and insured | Name, date of birth, personal ID number, address, phone number, relationship to the beneficiary | Basic |
| Health data | Health declarations, medical underwriting results, medical records and hospital invoices in claims files | Sensitive |
| Financial and insurance transaction data | Declared income, bank account for benefit payments, premium history, policy values, claims history | Sensitive |
| ID card images and electronic identity accounts | Photos of the citizen ID card when signing in an app, VNeID log-ins | Sensitive |
| Sales call recordings | Audio recording made when the buyer signs a unit-linked insurance application | Basic |
| Location and behavioural data | Telematics data for usage-based motor insurance, wearable data in wellness programmes | Sensitive |
Classified under the lists in Articles 3 and 4 of Decree 356/2025/ND-CP. The same information may be classified differently depending on the context of processing.
1. Who must comply with data protection in insurance in Vietnam?
Data protection in insurance applies to every organisation or individual involved in the life of an insurance policy, not only insurers:
- Life, non-life and health insurers: applications, underwriting results and claims files.
- Reinsurers: they receive data about insured persons from ceding insurers to assess risk.
- Insurance agents (individual and corporate): they collect customer information when advising and submitting applications.
- Banks selling insurance (bancassurance): as corporate agents, they use data on deposit and loan customers.
- Brokers and ancillary service providers: loss adjusting, claims administration (TPA), consulting and risk assessment.
- Insurtech platforms and online sales apps: user accounts, eKYC and behavioural data.
Health data and data on a customer's insurance transactions with an insurer are both sensitive personal data (Points d and k, Clause 1, Article 4 of Decree 356/2025/ND-CP). The option for small enterprises and start-ups to skip the DPIA and data protection staff therefore rarely applies in this sector, because it excludes organisations that directly process sensitive data (Clauses 2 and 3, Article 38 of Law 91/2025/QH15).
2. Article 26 of the PDPL: specific rules for data protection in insurance
Article 26 of the Personal Data Protection Law No. 91/2025/QH15 covers health information and the insurance business in a single article. Insurers need to know four rules:
- Consent throughout collection and processing, except in the cases in Clause 1, Article 19 (Point a, Clause 1). Consent must be given for each purpose and cannot be bundled with other purposes (Clause 4, Article 9). See what is consent.
- Healthcare providers may not give patient data to health or life insurers unless the patient asks in writing or a case under Clause 1, Article 19 applies (Clause 2). This rule directly affects the claims process.
- Insurance apps must fully comply with data protection rules (Clause 3).
- Transfers of personal data to reinsurance partners must be stated clearly in the contract with the customer (Clause 4).
When asking for consent to process health data, the insurer must also tell the customer that the data is sensitive (Clause 4, Article 6 of Decree 356/2025/ND-CP).
Sector-specific fines. Article 62 of Decree 330/2026/ND-CP penalises breaches involving health information and the insurance business. The amounts below are for organisations; individuals pay half:
- VND 50–70 million: transferring customer data to partners in insurance or reinsurance business without stating it clearly and transparently in the contract with the customer (Point a, Clause 1). Processing may also be suspended for 1 to 3 months.
- VND 70–100 million: a healthcare provider giving patient data to a health or life insurer without the patient's written request (Clause 2). Processing may also be suspended for 3 to 6 months.
3. Insurance customer confidentiality under the Law on Insurance Business
The Law on Insurance Business No. 08/2022/QH15 (amended by Law 139/2025/QH15, effective 1 January 2026) set duties of insurance customer confidentiality before the PDPL existed. Under Clause 2, Article 5 of the PDPL, these rules continue to apply alongside it:
Insurance customer confidentiality duties in the 2022 Law on Insurance Business
| Who | Duty | Legal basis |
|---|---|---|
| Insurer | Keep confidential the information provided by the policyholder and insured; disclose only at a competent authority's request or with their consent | Point i, Clause 2, Article 20 |
| Insurer | Keep insurance contract files as required by law | Point h, Clause 2, Article 20 |
| Insurance agent | Keep customer information secret, use it only for its purpose and not pass it to third parties without the customer's approval | Point i, Clause 2, Article 129 |
| Insurance broker | Keep confidential the information provided by customers and insurers | Point a, Clause 2, Article 137 |
| Policyholder | Provide complete and truthful information about the insured subject | Clause 1, Article 22 |
The policyholder's duty of disclosure (Article 22) is why insurers may collect health declarations. However, under the scope-and-purpose principle in Clause 2, Article 3 of the PDPL, underwriting questions should cover only what is needed to assess the risk of the specific product. See data protection principles.
On sector penalties, Decree 174/2024/ND-CP fines individuals VND 20–40 million (VND 40–80 million for organisations) when a broker breaches its confidentiality duty (Point c, Clause 1, Article 23). The same fines apply when an ancillary service provider fails to keep customer information secret or misuses it (Point a, Clause 1, Article 27).
4. Bancassurance and sales recordings: hot spots for data protection in insurance
Article 53 of Circular 67/2023/TT-BTC (amended by Circular 96/2026/TT-BTC) has three rules that bear directly on customer data when unit-linked insurance is sold:
- Audio recording at signing: the moment the buyer signs the unit-linked application must be audio-recorded (Point dd, Clause 2). Recording private information requires the buyer's consent. The recording must be stored and protected for at least 5 years from the date the policy takes effect (Point c, Clause 5).
- No sales within 60 days of disbursement: banks may not advise on or offer unit-linked insurance within 60 days before and 60 days after full disbursement of a loan (Point c, Clause 3).
- No tying: buying insurance must not be a condition for using other bank services (Point a, Clause 3).
Circular 67/2023 has no specific rule on banks sharing customer data with insurers, so bancassurance data flows must comply directly with the PDPL. In LexData's analysis, two situations must be kept apart:
- The bank acts as agent and collects the application when a customer chooses to buy. The bank processes data on the insurer's behalf, and the two need a data processing agreement.
- The bank uses deposit and loan customer data to select and approach prospects. This is a new purpose for the bank and needs separate consent. Handing a customer list to the insurer so that it can contact customers itself is a transfer of personal data, which must fit a case in Article 17 of the PDPL. Otherwise it risks being treated as selling personal data.
5. Five common risks in data protection in insurance
Agents keep their own customer lists
Individual agents often keep customer details on their phones, in notebooks or personal spreadsheets, and take them along when they move to another insurer. This is the biggest threat to insurance customer confidentiality. Insurers should provide a central customer management tool, require deletion of data in the agency contract when it ends, and check regularly.
Claims files sent through insecure channels
Health claims files contain medical records, prescriptions and hospital invoices. They are often passed by personal email or Zalo between the customer, agent, loss adjuster and claims administrator. Insurers should offer an online claims portal, role-based access, and DPAs with every loss adjuster and TPA.
Collecting too much health data
Using one health questionnaire for every product, including short-term accident cover, collects data beyond the purpose. Each product should have its own underwriting questions matched to the insured risk.
Transfers to reinsurers and group companies abroad
Facultative reinsurance often comes with the medical files of insured persons with high sums insured. This flow must be stated in the contract with the customer (Clause 4, Article 26). It is also a cross-border data transfer that needs its own impact assessment under Article 20 of the PDPL.
Insurtech using location and wearable data
Usage-based motor insurance and wellness programmes with wearables continuously collect location and health data. Clause 3, Article 26 requires insurance apps to comply fully with the rules. For location data, Point b, Clause 3, Article 31 requires app providers to inform users and give them location-tracking options.
6. Data protection in insurance: obligations at a glance
Data protection in insurance: obligations and legal basis
| Obligation | Legal basis | How it applies |
|---|---|---|
| Consent throughout collection and processing | Point a, Clause 1, Article 26 of Law 91/2025 | Applications, online sales apps |
| Tell customers that health data is sensitive | Clause 4, Article 6 of Decree 356/2025 | Health declarations, claims files |
| State transfers to reinsurance partners | Clause 4, Article 26 of Law 91/2025; Article 62 of Decree 330/2026 | Policy terms and contracts |
| Customer confidentiality | Articles 20, 129 and 137 of the 2022 Law on Insurance Business | Insurers, agents, brokers |
| Audio-record and keep recordings at least 5 years | Article 53 of Circular 67/2023/TT-BTC | Unit-linked insurance |
| File a DPIA with the A05 Department within 60 days | Article 21, Clauses 2 and 3 of Article 38 of Law 91/2025 | Anyone processing health or insurance transaction data |
| Appoint data protection staff or engage a provider | Clause 2, Article 33 of Law 91/2025 | Insurers, brokers, insurtechs |
| Cross-border transfer dossier | Article 20 of Law 91/2025; Form 09 of Decree 356/2025 | Overseas reinsurers, group systems |
| Report violations within 72 hours | Article 23 of Law 91/2025 | Leaks from policy or claims systems |
7. Data protection in insurance for foreign-invested insurers
Most life insurers in Vietnam are foreign-owned and use group systems for policy administration, automated underwriting, fraud detection and CRM, often hosted in a regional data centre. Each such system is a cross-border transfer that needs an impact assessment dossier. Unlike the GDPR, the PDPL has no adequacy mechanism: the business must prepare the dossier using Form 09 and file it with the specialised authority.
Foreign-invested insurers often miss two points when they apply group processes to data protection in insurance in Vietnam:
- The reinsurance clause in the customer contract.
- The rule that insurers cannot receive patient data from healthcare providers without the customer's written request.
Insight from lawyer Ho Thi Ha Nhi
"Insurers are used to confidentiality duties, but Law 91/2025/QH15 and Decree 330/2026/ND-CP have turned familiar clauses into concrete penalty risks. I recommend insurers review three things now: the reinsurance clause in their standard contract, the medical information release form in their claims files, and how agents are keeping customer lists."
Data protection in insurance: implementation checklist
- Map data across the whole policy lifecycle: sales, underwriting, issuance, premium collection, claims, reinsurance and customer service.
- Review application forms and policy terms: consent for each purpose, a notice that health data is sensitive, and a clear statement that data is passed to reinsurance partners.
- Separate consent to marketing and cross-selling from the consent needed to issue the policy.
- Sign data processing agreements (DPAs) with corporate agents, partner banks, loss adjusters, third-party administrators (TPAs), call centres and cloud providers.
- Set rules for individual agents: no customer files on personal phones, no claims files in chat groups, and deletion of data when the agency contract ends.
- Store and protect unit-linked sales recordings for at least 5 years and use them only for the purposes Circular 67/2023/TT-BTC allows.
- File a DPIA dossier with the A05 Department within 60 days, plus a cross-border transfer dossier if data goes to a parent company, reinsurer or offshore server.
- Set up an incident response process and notify the A05 Department within 72 hours when a breach must be reported.
- Train agents, claims staff and bancassurance partners on data protection in insurance, especially sharing customer files through messaging apps.
FAQ: data protection in insurance in Vietnam
Can an insurer ask a hospital for a patient's medical records to settle a claim?
Only with the customer's written request or in a case under Clause 1, Article 19 of Law 91/2025/QH15. Clause 2, Article 26 bars healthcare providers from giving personal data to health or life insurers without the data subject's written request. A provider that breaches this is fined VND 70–100 million (Clause 2, Article 62 of Decree 330/2026/ND-CP). Claims files should therefore include a form, signed by the customer, requesting release of medical information.
May a bank use its list of borrowers to sell insurance?
The risk is high. Borrower data was collected to grant credit. Using it to offer insurance is a new purpose that needs separate consent under Article 9 of Law 91/2025/QH15. In addition, Point c, Clause 3, Article 53 of Circular 67/2023/TT-BTC bars banks from advising on or offering unit-linked insurance within 60 days before and after full disbursement of a loan. Point a, Clause 3 also forbids making the purchase of insurance a condition for using other bank services.
Is an individual insurance agent a data processor?
In most cases, yes in substance: the agent collects data on the insurer's behalf to conclude contracts. Point i, Clause 2, Article 129 of the 2022 Law on Insurance Business requires agents to keep customer information confidential, use it only for its purpose and not pass it to third parties without the customer's approval. If an agent uses its customer list to sell another insurer's products, it is deciding a new purpose on its own and risks a breach.
Are small insurers exempt from the DPIA requirement?
Usually not. Clauses 2 and 3, Article 38 of Law 91/2025/QH15 let small, start-up and micro enterprises skip the DPIA and data protection staff only if they do not directly process sensitive data. Health data and customers' insurance transaction data are both sensitive under Article 4 of Decree 356/2025/ND-CP, so insurers almost always have to comply.
Do unit-linked sales have to be video-recorded?
Circular 67/2023/TT-BTC requires audio recording, not video. The recording is made when the buyer signs the unit-linked insurance application (Point dd, Clause 2, Article 53). The insurer must store and protect the recording for at least 5 years from the date the policy takes effect (Point c, Clause 5, Article 53). Recordings contain the customer's voice and details, so they should be covered in the DPIA and access to them restricted.
What is needed to send customer data to an overseas reinsurer?
Three things. First, state the transfer to reinsurance partners in the contract with the customer (Clause 4, Article 26 of Law 91/2025/QH15). Second, prepare a cross-border transfer impact assessment under Article 20 and file it with the A05 Department within 60 days of the first transfer. Third, send only what the reinsurer needs to assess the risk, using de-identified or aggregated data where possible.
Ho Thi Ha Nhi
Founding Lawyer, LexData Consulting · Ho Chi Minh City Bar Association
The Vietnamese original of this page has been reviewed against the Personal Data Protection Law No. 91/2025/QH15, its implementing decrees and the sector legislation cited. This English edition is an unofficial translation for reference; the official legal texts are in Vietnamese.
