Personal data protection in logistics: express delivery, last-mile, warehousing and freight forwarding

1. Who must comply with data protection in logistics in Vietnam?

Data protection in logistics applies to every business that receives, carries, stores, clears through customs, packs or delivers goods for customers, which is how Article 233 of the 2005 Commercial Law defines logistics services. Article 3 of Decree 163/2017/ND-CP lists the specific services:

• Express delivery and postal services (Clause 4) and last-mile delivery, whether couriers are employees or app-based partner drivers.
• Warehousing and fulfilment (Clause 8): storage, sorting and delivery for online sellers.
• Freight forwarding and customs brokerage (Clauses 5 and 6): exchanging consignee data with partners abroad.
• Road freight (Clause 12): trucks and tractor units fitted with journey monitoring devices.

Small logistics firms rarely qualify for the option to skip the DPIA and data protection staff. Clauses 2 and 3 of Article 38 of the PDPL and Article 41 of Decree 356/2025/ND-CP exclude businesses that directly process sensitive personal data or have processed data of 100,000 people or more. A delivery app that tracks drivers already processes sensitive data. In practice, data protection in logistics nearly always includes a DPIA filed with the A05 Department, Ministry of Public Security.

2. Marketplace, seller or carrier: who is responsible for data protection in logistics?

An online order passes through the marketplace, the seller, the carrier and often a last-mile subcontractor. The PDPL assigns roles by who decides the purpose and means of processing (Clauses 7 to 9, Article 2), much like the GDPR's controller and processor. See controller vs processor.

Three practical consequences:

• No data before a contract. A processor may receive personal data only after a data processing agreement with the controller (Point a, Clause 2, Article 37), so carriers taking API orders from small shops need processing terms in their standard terms. See data processing agreements.
• The controller stays liable. The marketplace or seller must choose a suitable processor and is liable to the data subject for damage (Points dd and g, Clause 1, Article 37).
• Handing data to a carrier is not a sale. A transfer to a processor under Point d, Clause 1, Article 17 of the PDPL is not a sale even if a fee is paid (Clause 2, Article 17). The transfer agreement must set out purpose, data types, duration, deletion and responsibilities (Clause 1, Article 7 of Decree 356/2025/ND-CP); missing responsibility terms are fined VND 20–30 million (Point a, Clause 1, Article 52 of Decree 330/2026/ND-CP).

The seller can rely on performing its agreement with the buyer (Point d, Clause 1, Article 19 of the PDPL). Vietnam has no broad "legitimate interests" basis like Article 6(1)(f) GDPR.

3. Which sector laws shape data protection in logistics?

Data protection in logistics does not rest on the PDPL alone. Specific rules in laws passed before the PDPL still apply as long as they do not conflict with its principles (Clause 2, Article 5 of the PDPL).

Law on Post 2010: confidentiality of postal information

The Law on Post No. 49/2010/QH12 is still in force, and the articles below have not been amended. "Information on the use of postal services" covers the content of postal items and the names, addresses and phone numbers of senders and recipients (Clause 15, Article 3), which is almost everything on a shipping label.

• Unlawful disclosure of this information is prohibited (Clause 6, Article 7).
• Postal businesses may not disclose it except when a competent authority requests it in writing in the cases set out in Clauses 2 and 3 of Article 14 (Clause 10, Article 29).
• Senders and recipients are entitled to information security (Clause 2, Article 30).

The Law on Post is being revised: the Ministry of Science and Technology is finalising a draft for the National Assembly's October 2026 session.

Law on E-commerce 2025: duties of e-commerce logistics providers

The Law on E-commerce No. 122/2025/QH15, in force since 1 July 2026, includes Article 34 on logistics providers supporting e-commerce:

• Provide data on their services when a competent authority requests it (Clause 3), a transfer permitted under Point dd, Clause 1, Article 17 of the PDPL.
• Let users track the journey: warehouse location and pick-up and delivery times (Clause 6). The law does not require the tracking page to show the recipient's name or phone number.

Road traffic law

Clause 2, Article 35 of the Law on Road Traffic Order and Safety No. 36/2024/QH15, as amended by Law No. 118/2025/QH15 (in force since 1 July 2026), requires commercial freight vehicles and tractor units to carry journey monitoring devices and driver image recorders. The same clause states that data from driver image recorders must be processed in line with the law on personal data protection, and Clause 18a, Article 9 of that law (added by Clause 2, Article 7 of Law No. 118/2025/QH15) prohibits using such data to infringe honour, private life or personal secrets.

4. How do order details leak, and how do you stop it?

Order data leaks are the defining risk of data protection in logistics in Vietnam: scammers who know a recipient's name, phone, item and COD amount pose as couriers demanding extra fees. Delivery recipient data typically escapes from five places:

1. The shipping label, readable by anyone who handles the parcel.
2. Courier chat groups sharing exported order lists.
3. Call centres where staff can look up any order.
4. Tracking pages and APIs that show name, phone and address for a sequential tracking number.
5. Insiders who sell order lists.

The matching legal duties:

• Print only what is needed. Data may be processed only within a specific purpose (Clause 2, Article 3 of the PDPL); processing beyond what is necessary is fined VND 20–40 million (Point a, Clause 1, Article 39 of Decree 330/2026/ND-CP).
• Block unlawful collection from your own systems. Both controllers (Point h, Clause 1, Article 37) and processors (Point dd, Clause 2, Article 37) carry this duty, and tracking pages and APIs are part of those systems.
• Control internal sharing. Organisations need a process to control sharing between departments and measures against staff sharing data with third parties (Clause 4, Article 7 of Decree 356/2025/ND-CP); lacking them is fined VND 20–30 million (Point b, Clause 1, Article 52 of Decree 330/2026/ND-CP).

When an insider sells order data. Selling and deliberately disclosing personal data are prohibited (Clauses 6 and 7, Article 7 of the PDPL). Selling personal data is fined at 2 to 10 times the proceeds, or, where there are no proceeds, VND 70 million to 1 billion by number of people affected, rising to VND 1–3 billion where the sale harms national defence, security or the other interests listed in Point dd (Clauses 1 and 3, Article 53 of Decree 330/2026/ND-CP).

5. Driver location data, delivery photos and cameras: how far can you go?

Driver location data

Location determined through positioning services is sensitive data (Point h, Clause 1, Article 4 of Decree 356/2025/ND-CP), and drivers must be told that it is sensitive (Clause 4, Article 6); failing to do so is fined VND 30–50 million (Point h, Clause 1, Article 43 of Decree 330/2026/ND-CP). The rules depend on the driver's status:

• Employed couriers: tracking must be lawful and known to the employee (Point a, Clause 3, Article 25 of the PDPL). Tracking or cameras without notice are fined VND 50–70 million (Point c, Clause 2, Article 61 of Decree 330/2026/ND-CP). See employee personal data.
• App-based partner drivers: they are not employees, so Article 31 applies: no location tracking without consent unless an authority requests it or a law provides otherwise (Point a, Clause 3), and the app must offer tracking options (Point b, Clause 3). Tracking without consent is fined VND 70–150 million, with possible suspension of the tracking platform for 3 to 6 months (Point a, Clause 2 and Point b, Clause 3, Article 70 of Decree 330/2026/ND-CP).
• Trucks with mandatory journey monitoring: tracking required by traffic law is covered, but in LexData's view using the same driver location data to cut pay is a new purpose needing notice and its own basis.

If driver location data leaks, affected people must be told within 72 hours (Article 29 of Decree 356/2025/ND-CP), with no GDPR-style "high risk" threshold.

Delivery photos and cameras

• Proof-of-delivery photos may be kept only as long as their purpose requires (Clause 3, Article 3 of the PDPL); over-retention is fined VND 20–40 million (Point c, Clause 1, Article 39 of Decree 330/2026/ND-CP). Upload them straight to the system, not the courier's phone.
• Warehouse and counter CCTV must be known to employees (Point a, Clause 3, Article 25) and signposted in customer areas (Clause 2, Article 32 of the PDPL). See CCTV and camera surveillance.

6. Data protection in logistics across borders: when is a transfer dossier needed?

Moving data to storage abroad, to an organisation abroad, or onto a platform abroad to process data collected in Vietnam are all cross-border transfers (Clause 1, Article 20 of the PDPL). The transferor must file an impact assessment dossier on Form No. 09 with the A05 Department within 60 days of the first transfer (Clause 2, Article 20), unless exempt. Logistics has its own exemption: providing personal data across borders to sign contracts or carry out procedures for cross-border transport and logistics (Point dd, Clause 3, Article 17 of Decree 356/2025/ND-CP, implementing Point d, Clause 6, Article 20 of the PDPL).

A contract and security measures are still needed for exempt flows. No dossier is fined VND 30–50 million; no binding contract or adequate security, VND 50–100 million (Clauses 1 and 2, Article 56 of Decree 330/2026/ND-CP). A transfer without a dossier that leads to a leak of data on 10,000 or more Vietnamese citizens is fined 1% to 5% of the previous year's revenue in Vietnam (Clause 3, Article 56). See cross-border data transfer.

7. Five common risks in data protection in logistics

These are the situations LexData sees most often when reviewing data protection in logistics:

• Full phone number and COD value on the shipping label; masking the number is the cheapest fix.
• Order lists sent to couriers on messaging apps with no transfer agreement.
• Unlimited call-centre look-ups with no access log.
• Driver apps tracking 24/7 because SDKs keep sending location after drivers go offline.
• Group TMS hosted abroad without a dossier, on the mistaken belief that the transport exemption covers every flow.

8. Data protection in logistics: obligations and fines at a glance

Each row is an item in a data protection in logistics programme. Amounts are for organisations; individuals pay half (Clause 1, Article 7 of Decree 330/2026/ND-CP).

A carrier acting as processor must tell the marketplace or seller promptly when it finds a breach (Clause 1, Article 23 of the PDPL); failing to do so is fined VND 10–20 million (Point a, Clause 1, Article 54 of Decree 330/2026/ND-CP). See the 72-hour breach rule and our outsourced DPO service, which covers breach handling.

9. Data protection in logistics for foreign-invested carriers and forwarders

International express carriers, foreign-invested forwarders and regional fulfilment hubs usually meet four differences from group standards:

• Filings with the regulator: the DPIA and the cross-border dossier go to the A05 Department, a step with no direct GDPR equivalent. See the PDPL summary and Decree 356/2025/ND-CP.
• A narrow exemption: Point dd, Clause 3, Article 17 of Decree 356/2025/ND-CP covers shipment-level flows, not the group TMS or a regional data warehouse.
• Drivers are Vietnamese citizens: in foreign-invested road freight, 100% of drivers must be Vietnamese citizens (Point g, Clause 3, Article 4 of Decree 163/2017/ND-CP).
• Postal confidentiality: regional headquarters should not have open access to Vietnamese sender and recipient data (Clause 10, Article 29 of the Law on Post).

LexData prepares DPIA and cross-border transfer dossiers and provides PDPL compliance consulting for logistics businesses. Fines above follow Decree 330/2026/ND-CP.