Vietnam's Personal Data Protection Law, in force since 1 January 2026 (building on Decree 13/2023/ND-CP), turns careful handling of personal data into an obligation rather than a nice-to-have. Websites, sales software, CRMs and mobile apps – any system storing customers' names, phone numbers or emails – should be reviewed.
Technical points to review now
- Data minimisation: store only the fields the business really needs.
- Consent: forms should state the purpose clearly and record the user's consent.
- Access control: staff should only see data within their job scope.
- Encrypt sensitive data and use HTTPS across the whole system.
- Keep access logs to trace incidents.
- Have a process to delete or correct data when users request it.
More than compliance
Well-governed data reduces the risk of leaks and builds trust with customers and partners – especially foreign partners who take the topic very seriously.
This article is technical guidance only; businesses should also consult legal experts. Dai Thanh Soft can help review and upgrade your software to meet data-protection requirements.