What types of sensitive personal data include?

Lawyer Ho Thu Trang, YouMe Law Company Limited answers:

Clause 3, Article 2 of the 2025 Law on Personal Data Protection (effective from January 1, 2026) stipulates as follows: Sensitive personal data is personal data associated with personal privacy, when infringed, it will directly affect the legitimate rights and interests of agencies, organizations, and individuals, which are listed by the Government.

Article 4 of Decree No. 356/2025/ND-CP stipulates that sensitive personal data includes:

a) Data disclosing racial origin, ethnic origin;

b) Views on politics, religion, and beliefs;

c) Information about private life, personal secrets, family secrets;

d) Health condition;

e) Biometric data, genetic characteristics;

e) Data revealing personal sexual life and sexual orientation;

g) Data on crimes and law violations collected and stored by law enforcement agencies;

h) The location of the individual is determined through the positioning service;

i) Information on the login name and password to access the personal electronic identification account; image of ID card, citizen ID card, identity card;

k) Login name, access password of bank accounts; bank card information, transaction history data of bank accounts; financial and credit information and information on operations, financial, securities, and insurance transaction history of customers at credit institutions, foreign bank branches, payment intermediary service providers, securities, insurance, and other authorized organizations;

l) Data tracking behavior, activities of using telecommunications services, social networks, online communication services and other services in cyberspace;

m) Other personal data that is required by law to be kept secret or to have strict security measures.

2. In the process of processing sensitive personal data, agencies and organizations must establish regulations on delegation of access limits, processing procedures and security measures.

Thus, from January 1, 2026, the above data is considered sensitive personal data.

It's a bit of a bit of a bit of a bit of a bit of a bit.

It's a bit of a bit of a bit of a bit of a bit of a bit.