Personal data protection in real estate: developers, brokerages, agents and property managers
Data protection in real estate is an obligation for every developer, brokerage, agent and property manager in Vietnam. Real estate businesses collect personal data at every stage: lead generation, deposits, sale and purchase contracts, mortgage applications, handover and building operations. The biggest risk is buying and selling customer lists and cold-calling without consent, which Law No. 91/2025/QH15 prohibits. Next come copies of citizen ID cards, bank account information, CCTV and facial recognition in managed buildings.
Personal Data Protection Law No. 91/2025/QH15 (Articles 7, 17, 20, 28, 31, 32); Decree 356/2025/ND-CP; Decree 330/2026/ND-CP; Law on Anti-Money Laundering No. 14/2022/QH15; Decree 91/2020/ND-CP on spam messages and calls
Official legal texts
- Law 91/2025/QH15 — Government e-portal (official Vietnamese text)
- Decree 356/2025/ND-CP — Government e-portal (official Vietnamese text)
- Decree 330/2026/ND-CP — Government e-portal (official Vietnamese text)
- Decree 91/2020/ND-CP on spam messages, emails and calls — Government e-portal (official Vietnamese text)
Key takeaways on data protection in real estate
- The biggest risk for data protection in real estate is trading real estate customer data. Buying and selling personal data is prohibited (Clause 6, Article 7 of Law 91/2025/QH15). Under Article 53 of Decree 330/2026/ND-CP, an organisation in breach is fined 2 to 10 times the proceeds; where there are no proceeds, the fine ranges from VND 70 million to VND 3 billion depending on the number of data subjects affected and the harm caused.
- Calling or texting prospects about a project is processing personal data for advertising: it requires the customer's consent, clear information on content, method and frequency, and a way to opt out (Clauses 3 and 5, Article 28).
- A property manager using facial or fingerprint recognition processes biometric data, a sensitive category: it needs residents' consent, physical security for devices, restricted access, and ideally an alternative such as a key card (Clause 4, Article 31).
Personal data processed in real estate
| Data group | Examples | Classification |
|---|---|---|
| Lead contact details | Name, phone number, email, needs and budget left through web forms, launch events and show units | Basic |
| Identity details in transaction files | Personal identification number, date of birth, residence, marital status, details of a co-owning spouse | Basic |
| Citizen ID card images, e-identity accounts | Photos of both sides of the ID card in deposit files, sale and purchase contracts, resident registration | Sensitive |
| Bank accounts, cards and transactions | Account numbers, bank statements, payment receipts for instalments, mortgage files | Sensitive |
| Biometric data | Faces or fingerprints used for lifts, entry gates and car parks | Sensitive |
| CCTV footage | Cameras in lobbies, corridors, car parks and show units (it becomes biometric data if the system performs facial recognition) | Basic |
Classified under the lists in Articles 3 and 4 of Decree 356/2025/ND-CP. The same information may be classified differently depending on the context of processing.
1. Who must comply with data protection in real estate?
Data protection in real estate applies to every business that handles real estate customer data, and Vietnam real estate data protection rules make no exception for foreign-invested companies. Personal Data Protection Law No. 91/2025/QH15 applies to every organisation processing personal data in Vietnam, including foreign-invested companies and foreign organisations processing the data of Vietnamese citizens (Clause 2, Article 1). In real estate, these groups process the most data:
- Project developers: buyers and co-owners, instalment payment records, mortgage files through partner banks.
- Brokerages, distributors and agents: lead lists, consultation history, call recordings, data from online advertising.
- Building and township managers: resident lists, access cards, CCTV, facial recognition, resident apps.
- Listing platforms and proptech: user accounts, search behaviour, location, landlord and tenant data.
Small businesses that do not directly process sensitive data may choose not to prepare a DPIA dossier or appoint a data protection function for five years (Clause 2, Article 38). In practice, however, most real estate businesses hold ID card images or bank account information, both sensitive categories under Article 4 of Decree 356/2025/ND-CP, so few qualify.
2. Five common risks for data protection in real estate
The five risks below are the situations LexData meets most often when advising on data protection in real estate. Each comes with its legal basis and the fine that applies.
Buying, selling and passing around customer lists
Lists of "villa owners", "VIP customers" or "buyers of other projects" traded on social media are the industry's biggest risk. Clause 6, Article 7 of Law 91/2025/QH15 prohibits buying and selling personal data. Article 53 of Decree 330/2026/ND-CP sets fines of 2 to 10 times the proceeds; where proceeds cannot be established, the fine depends on the number of data subjects affected, from VND 70 million to VND 1 billion, and up to VND 3 billion where the life, health or property of data subjects is harmed. The business may also be ordered to delete the data and notify every affected data subject.
A lawful transfer under Clause 1, Article 17, for example with the customer's consent or where a distributor processes data under a contract with the developer, is not buying or selling even if a fee is charged (Clause 2, Article 17). The line is drawn by the legal basis and the contract, not by whether money changes hands. Even so, a fee-charging transfer needs a transfer agreement and a mechanism for the customer to consent to each transfer (Clause 3, Article 7 of Decree 356/2025/ND-CP); without them, the transfer is penalised as unlawful buying or selling under Article 53 of Decree 330/2026/ND-CP.
Telesales and project promotion messages
Calling, texting or emailing people about a project uses personal data for advertising. Under Article 28 of Law 91/2025/QH15, the business must:
- Obtain the customer's consent, on the basis that the customer clearly knows the content, method, form and frequency of the promotion (Clause 3).
- Give the customer a way to refuse advertising, and stop as soon as asked (Clauses 3 and 5).
- Comply with the rules on spam messages and calls and with advertising law (Clause 4); see section 3 below.
Silence or no response is not consent (Point d, Clause 4, Article 9). Treating silence as consent is fined VND 50 to 70 million under Article 43 of Decree 330/2026/ND-CP.
Copies of citizen ID cards in transaction files
ID card images are sensitive data. Deposit files and sale contracts often travel through chat apps and sales staff's personal email, and stay on phones after staff leave. When processing sensitive data, the business must tell customers that the data is sensitive; failing to do so is fined under Article 43 of Decree 330/2026/ND-CP. Transferring sensitive data without safeguards such as encryption is fined VND 50 to 80 million (Article 52).
CCTV and facial recognition in buildings
Cameras in lobbies, car parks and customer service areas need clearly visible notices (Clause 2, Article 32 of Law 91/2025/QH15); failing to post them is fined VND 10 to 20 million under Article 71 of Decree 330/2026/ND-CP. If the system uses facial recognition, the data becomes biometric data and requires physical security for devices, restricted access and monitoring for intrusions (Point a, Clause 4, Article 31). Using camera footage for facial recognition or profiling without valid consent is fined VND 30 to 50 million (Clause 2, Article 71 of Decree 330/2026/ND-CP).
Sharing data between developer, distributors and property manager
A single project usually has several parties handling real estate customer data. Without deciding who is the controller and who is the processor, nobody knows who must answer a deletion request or report a leak. A transfer agreement that does not set out data protection responsibilities is fined VND 20 to 30 million (Clause 1, Article 52 of Decree 330/2026/ND-CP).
3. Sector rules on data protection in real estate
Spam messages and calls
Decree 91/2020/ND-CP is still in force and adds specific limits for real estate telesales, on top of the PDPL real estate rules above:
- Advertising messages, emails and calls may only be sent to people who have agreed in advance (Clause 2, Article 11).
- No more than 3 advertising text messages, 3 advertising emails and 1 advertising call to the same person within 24 hours, unless otherwise agreed (Clause 5, Article 13).
- Advertising messages only between 7:00 and 22:00, and advertising calls only between 8:00 and 17:00, unless otherwise agreed (Clause 6, Article 13).
- Records of recipients' consent and refusals must be kept for at least 1 year (Clause 7, Article 11).
Anti-money laundering
Real estate business (except leasing, subleasing and real estate consultancy) is a designated non-financial business under Point b, Clause 2, Article 4 of the Law on Anti-Money Laundering No. 14/2022/QH15. Businesses must identify their customers when providing real estate services (Point b, Clause 3, Article 9) and keep customer identification records for at least 5 years from the end of the transaction (Article 38).
Because this is a statutory duty, collecting identity documents for customer identification has its own legal basis, and records within the 5-year period need not be deleted as soon as a customer asks. The business must still state this purpose in its processing notice, use the data only for anti-money laundering, and delete it when the retention period ends (Point c, Clause 1, Article 14 of Law 91/2025/QH15). Customer identification files must not be reused to promote other projects.
4. Data protection in real estate: key obligations and legal bases
The table below summarises the main obligations. Each row is an item your plan for data protection in real estate should cover.
Obligations table: data protection in real estate in Vietnam
| Obligation | Legal basis | How it applies in real estate |
|---|---|---|
| Do not buy or sell personal data | Clause 6, Article 7, Law 91/2025; Article 53, Decree 330/2026 | No purchased lead lists; no staff selling data when they leave |
| Obtain consent before collection | Article 9, Clause 1 of Article 11, Law 91/2025 | Landing page forms, show unit sign-ups, launch events |
| Separate consent for advertising, with an opt-out | Article 28, Law 91/2025 | Telesales, SMS, messaging apps, project emails |
| Protect biometric data | Clause 4, Article 31, Law 91/2025 | Facial recognition for lifts, gates and car parks |
| Give notice of recording | Article 32, Law 91/2025; Article 71, Decree 330/2026 | Cameras in lobbies, corridors, show units |
| DPIA dossier filed with A05 within 60 days | Article 21, Law 91/2025; Form No. 10, Decree 356/2025 | Developers, brokerages and managers processing sensitive data |
| Cross-border transfer dossier | Article 20, Law 91/2025; Form No. 09, Decree 356/2025 | CRM or building software hosted abroad |
| Call and text only within set hours and limits | Articles 11 and 13, Decree 91/2020 | Calls 8:00–17:00, 1 call and 3 texts a day, unless otherwise agreed |
| Identify customers and keep records for 5 years | Articles 9 and 38, Law on Anti-Money Laundering 2022 | Sale and brokerage files; not reused for marketing |
| Breach notification within 72 hours | Article 23, Law 91/2025 | Leaked customer lists, ID files, resident data |
5. Data protection in real estate for foreign-invested companies
For foreign-invested developers and operators, Vietnam real estate data protection usually gets difficult where data leaves the country. Foreign-invested companies often use a group CRM, building management system or shared customer service centre hosted abroad. Using a platform outside Vietnam to process data collected in Vietnam is a cross-border transfer (Point c, Clause 1, Article 20 of Law 91/2025/QH15) and needs its own impact assessment dossier filed with the A05 Department within 60 days. A group privacy policy written for the GDPR also needs adjusting: Vietnamese law has no general "legitimate interests" basis like the GDPR, so marketing almost always requires consent.
Insight from lawyer Ho Thi Ha Nhi
"For data protection in real estate, the first job is to clean up data sources, before drafting any privacy policy. A business needs to know where every phone number in its CRM came from and whether the person agreed to be called. A lead capture system built on clear consent reduces the risk of fines and helps the sales team reach people who are genuinely interested."
Data protection in real estate: implementation checklist
- Audit every source of real estate customer data in the CRM and on sales staff's phones; delete lists whose lawful origin or consent cannot be shown.
- Design lead capture forms (landing pages, events, show units) with a processing notice and a separate consent box for sales calls and messages about projects.
- Adopt an internal policy banning staff from buying, selling or sharing customer data; put confidentiality undertakings in employment contracts and freelance agent agreements.
- Sign data processing agreements (DPAs) or data sharing agreements between the developer, distributors, brokerages and the property manager, stating clearly who is the controller.
- Collect and keep ID card images only where needed (deposit, contract signing), in a system with access controls rather than in chat apps or personal email.
- In buildings: post CCTV notices, obtain consent at facial recognition enrolment, let residents use a key card instead, and set a retention period for footage.
- Prepare a DPIA dossier and file it with the A05 Department within 60 days; if the CRM or building management software is hosted abroad, also prepare a cross-border transfer dossier.
- Train sales staff, freelance agents and building managers regularly on data protection in real estate.
- Set up a channel for opt-outs, consent withdrawals and deletion requests, and sync the do-not-contact list across all telesales teams and agents.
FAQ: data protection in real estate in Vietnam
Is it a violation for a brokerage to buy a customer list from outside for telesales?
Yes. It is the most common PDPL real estate violation. Buying and selling personal data is prohibited by Clause 6, Article 7 of Law 91/2025/QH15, unless another law provides otherwise, and is sanctioned under Article 53 of Decree 330/2026/ND-CP. Calling the people on a purchased list also breaches the consent requirement for processing data for advertising (Clause 3, Article 28). Serious cases may lead to criminal liability.
May a developer share its customer list with a sales distributor?
Yes, if there is a basis under Article 17 of Law 91/2025/QH15, for example the customers' consent, or the distributor processing the data on the developer's behalf under a data processing agreement. The agreement should set out roles, data types, purposes, duration and deletion at the end. A lawful transfer under Clause 1, Article 17 is not treated as buying or selling data, even if a fee is charged (Clause 2, Article 17), but a fee-charging transfer must also meet the conditions in Clause 3, Article 7 of Decree 356/2025/ND-CP.
If an agent buys data on their own, is the company liable?
There is a real risk. The business is the controller of the data used in its operations and must apply appropriate management and technical measures and prevent unlawful collection (Points c and h, Clause 1, Article 37). The business should ban the practice, control what data enters the CRM, train staff and enforce discipline, so it can show it has met its responsibilities.
May a property manager require residents to register their face to use the lifts?
It should not be mandatory. Biometric data is sensitive; processing it needs residents' freely given consent, and consent must not be made a condition for other purposes (Point b, Clause 4, Article 9 of Law 91/2025/QH15). The manager should offer an alternative such as a key card and must apply the safeguards in Clause 4, Article 31.
If a customer asks to delete their transaction file and ID copy, must the company do so straight away?
Not necessarily. Customer identification records under the Law on Anti-Money Laundering No. 14/2022/QH15 must be kept for at least 5 years from the end of the transaction (Article 38), and contracts and accounting documents have their own retention periods. Where data cannot be deleted for a legitimate reason, the business must tell the customer (Clause 5, Article 14 of Law 91/2025/QH15), stop using the data for other purposes such as marketing, and delete it when the retention period ends.
What should a foreign-invested real estate company using an overseas CRM watch out for?
Using a platform outside Vietnam to process data collected in Vietnam is a cross-border transfer of personal data (Point c, Clause 1, Article 20 of Law 91/2025/QH15). The company must prepare a cross-border transfer impact assessment dossier using Form No. 09 of Decree 356/2025/ND-CP and file it with the A05 Department within 60 days of the first transfer.
Ho Thi Ha Nhi
Founding Lawyer, LexData Consulting · Ho Chi Minh City Bar Association
The Vietnamese original of this page has been reviewed against the Personal Data Protection Law No. 91/2025/QH15, its implementing decrees and the sector legislation cited. This English edition is an unofficial translation for reference; the official legal texts are in Vietnamese.
