Updated: 23 September 2026
An “I agree” box does not automatically make every use of data lawful. Under Article 9 of the Personal Data Protection Law, consent must be voluntary, informed and expressed in a verifiable way. Businesses need to design both the notice and the recording process rather than simply add a checkbox to a form.
What information valid consent requires
Individuals must know the data categories, processing purposes, controller or controller-cum-processor, and relevant rights and obligations. Article 9 requires clear, specific consent; Article 6 of Decree No. 356 explains how it may be expressed. Silence or failure to respond is not consent.
Where there are several purposes, individuals must be able to choose by purpose. Using a phone number for delivery and using it for marketing, for example, require separate analysis. Avoid bundling everything into a statement so broad that readers cannot tell how their data will be used.
Consent is not the basis for every activity
Article 19 provides for processing without consent in defined circumstances and subject to conditions, including protection of life, health, rights and interests; state authority activities; performance of agreements with data subjects; and other statutory cases. Reliance on an exception requires a legal basis, safeguards and accountability.
Businesses should not copy the GDPR concept of legitimate interests into a Vietnam policy and treat it as a general basis for all processing. The basis must come from the law that actually applies. When relying on performance of an agreement, explain how the processing relates to an agreement with the data subject concerned.
Manage marketing data separately
Article 28 regulates personal data use in advertising and marketing. Consent must address marketing content, method, format, frequency and opt-out arrangements. Behavioural tracking for targeted advertising must also meet that article's requirements.
A customer's agreement to receive order updates does not mean consent to every advertising campaign. When a customer opts out, the status needs to be synchronised with relevant messaging tools. Calls, emails and text messages may also be subject to channel-specific advertising and anti-spam rules in addition to data protection law.
Does every website cookie require a consent form
The word cookie alone cannot determine the answer. Examine whether the collected information is personal data, its actual purpose, identifiability, recipients and processing basis. Article 29 sets requirements for social networks and online communications services; Articles 9, 19 and 28 must still be assessed against the particular activity.
A website may need to distinguish login session data from behavioural tracking for advertising. This classification supports legal assessment; it does not mean all technical cookies are automatically exempt or all cookies are prohibited.
Retain evidence and manage purpose changes
Records should include the time, information displayed, individual choices, notice version and later changes. If a new purpose exceeds the consent obtained, reassess the legal basis before proceeding. There must be a process for receiving and implementing consent withdrawals; the effects on earlier processing and other retention obligations must be determined under the law.
Does a partner agreement provide a separate processing basis
Distinguish two kinds of agreement. Article 19(1)(d) concerns performance of the data subject's own agreement with the relevant agency, organisation or individual in accordance with law. A contract between businesses instead allocates work and responsibilities; the provider's signature does not replace the individual's consent or another valid processing basis.
Similarly, publicly visible data is not automatically available for every use. A business collecting information from websites to build marketing lists must still check its basis, purposes and individuals' rights. If the material includes intellectual property or contractually confidential information, the corresponding usage rights also need review.
How far a website choice must reach
Suppose a user rejects personalised advertising. The business should check whether that choice stops data being sent to advertising tools or merely dismisses the notice. If a partner processes data overseas, transfer documentation also becomes relevant. If AI analyses behaviour, review any new purpose and responsibilities for the AI system.
Before placing a consent template on a website, compare it with actual data flows and settings. The articles on AI data use and cloud computing explain two situations commonly overlooked after consent is collected.
Frequently asked questions
Can a purchased customer list immediately be used for advertising? No. Article 7(6) prohibits buying and selling personal data unless otherwise provided by law. Article 17 specifies transfers not classified as buying or selling data; lawful receipt still does not provide a basis for every advertising purpose.
Is “I agree to all policies” sufficient? That wording does not by itself meet Article 9's requirements for information, specificity and choice by purpose.
Legal sources
Personal Data Protection Law No. 91/2025/QH15
Decree No. 356/2025/ND-CP implementing personal data protection requirements
Law No. 131/2025/QH15 amending the Intellectual Property Law, effective from 1 April 2026
Sources checked through 23 September 2026.
Related articles
Article 02 Vietnam Personal Data Protection Law and Business Responsibilities in 2026
Article 05 Overseas Cloud and CRM Services and Vietnam Data Transfer Filings
Article 17 Using Customer and Employee Data in AI under Vietnamese Law
Article 21 Vietnam Personal Data Protection Templates and How to Use Them
