The Law on Personal Data Protection takes effect from January 1, 2026. Notably, the Law reserves Article 30 to regulate "Protection of personal data in big data processing, artificial intelligence, blockchain, virtual universe, cloud computing":
1. Personal data in the big data environment, artificial intelligence, blockchain, virtual universe and cloud computing must be processed for the right purpose and within the necessary scope, ensuring the legitimate rights and interests of the personal data subject.
2. The processing of personal data in the big data environment, artificial intelligence, blockchain, virtual universe and cloud computing must comply with the provisions of this Law and other relevant legal regulations; in accordance with Vietnamese ethical standards and fine customs.
3. Systems and services using big data, artificial intelligence, blockchain, virtual universe and cloud computing must be integrated with appropriate personal data security measures; must use appropriate authentication and identification methods and access decentralization to process personal data.
4. Personal data processing using AI artificial intelligence must be classified according to the level of risk to have appropriate measures to protect personal data.
5. Do not use or develop large data processing systems, artificial intelligence, blockchain, virtual universe, cloud computing that use personal data to harm national defense, national security, order, social safety or infringe on the life, health, honor, dignity, and property of others.
6. The Government shall specify this Article.
The law also stipulates the rights of personal data subjects including: Being aware of personal data processing activities; Agreeing or disagreeing, requesting to withdraw consent to allow personal data processing; Viewing, editing or requesting personal data editing; Requesting to provide, delete, restrict personal data processing; sending requests to protest personal data processing;
Complaints, denunciations, lawsuits, and requests for damage compensation in accordance with the law; Request competent authorities or agencies, organizations, and individuals related to personal data processing to implement measures and solutions to protect their personal data in accordance with the law.
