Legal review: 15 October 2026 · Đọc tiếng Việt
A real-person AI avatar contract should define image and voice permissions, the permitted use of a digital replica and responsibility for personal data. A business using avatars for product presentations, training or customer support should review the service agreement alongside the individual’s permission and the data protection documentation.
Approval of a sample video does not necessarily authorise every future script. The following six issues help turn a general permission into a workable project arrangement.
1. Image rights and permission to use a voice
Article 32 of Vietnam’s Civil Code 2015 generally requires consent to use an individual’s image. Commercial use requires remuneration unless otherwise agreed. The provision also contains conditional exceptions. A publicly available photograph does not automatically authorise a business to create an advertising avatar.
For voice cloning, check rights in the recording and the legal basis for processing personal data. Describe recording, synthesis, image generation and publication separately. An earlier filming agreement or employment contract should not be assumed to cover a digital replica capable of delivering new statements.
2. Scope of use and remuneration
Specify purposes, products, platforms, territory, languages and duration. Distinguish permission to create an avatar from permission to sublicense it, supply it to other clients or resell content.
Clarify which permissions the agreed remuneration covers. Does internal training include public advertising? Who approves new products, languages or distribution channels, and how will the commercial terms be revisited? These matters require project-specific agreement rather than an assumed universal licence.
3. Input data and further model training
Article 3 of Decree 356/2025/ND-CP lists personal images as basic personal data. An identifiable voice also needs assessment under personal data law. Not every recording is sensitive biometric data: examine the information, technology and identification purpose against Article 31 of the Personal Data Protection Law and Article 4 of Decree 356.
Document the data, purposes, recipients and retention periods. Where consent is the basis, Article 9 of the Personal Data Protection Law 2025 requires appropriate, purpose-specific consent. Commercial exploitation rights do not replace a lawful processing basis. Training a shared model or improving services for other customers requires a separate assessment.
4. The provider and processing locations
Identify the contracting entity, subprocessors, storage locations, access permissions and change-notification process. A broad statement that a platform is secure does not establish who may reuse recordings or a voice model.
Map actual data flows where foreign servers, platforms or recipients are involved. Assess Article 20 of the Personal Data Protection Law and Articles 17–18 of Decree 356, including applicable exemptions from cross-border transfer impact assessment. Provider nationality alone is not the whole test: consider actual transfer, storage and processing, including cloud services supplied by a provider abroad.
5. Scripts, publication and AI labels
Assign responsibility for entering scripts, approving the final version and publishing it. Image permission does not replace advertising compliance, factual verification or clearance of third-party rights. Keep approved scripts, released versions and a process for corrections and removal requests.
Article 11 of AI Law 134/2025/QH15 and Articles 16–18 of Decree 142/2026/ND-CP distinguish machine-readable technical marking from notices and visible labels. Publicly distributed AI content simulating a real person’s appearance or voice requires assessment of the recognisable-label obligation. Exclusively internal content not supplied to the public is one visible-label exemption under Article 18(4); image and data obligations still need consideration.
The AI Law took effect on 1 March 2026 and Decree 142 on 1 May 2026. Article 35 grants systems operating before 1 March 2026 a compliance period of 18 months in healthcare, education and finance, or 12 months for other systems. Identify the relevant system and operating date; a new project should not automatically claim this transition.
6. Exit arrangements and incidents
Who disables the avatar, stops new generation and deals with existing videos when cooperation ends? Agree return or deletion of data, backup treatment, completion deadlines and evidence, subject to applicable retention duties. Deleting source files alone does not establish that all derived data or voice-generation capability has been removed.
Allocate incident contacts, notification, corrective action and legal responsibility for unauthorised use or data incidents. Review the agreement with the individual, the provider contract and any customer terms together before launch.
How KM UNION can assist
KM UNION can review image permissions, AI avatar agreements, personal data obligations and content approval procedures, coordinating with technical specialists on data flows, access suspension and exit arrangements. The engagement defines its scope, responsibilities and deliverables in writing for the particular project.
Legal sources
- Civil Code 91/2015/QH13 — Article 32
- Personal Data Protection Law 91/2025/QH15
- Decree 356/2025/ND-CP
- AI Law 134/2025/QH15 — Articles 11, 35
- Decree 142/2026/ND-CP — Articles 16–19
Reviewed on 15 October 2026. This article provides general information and does not replace advice for a particular person, contract or project. Check the actual documents, applicable dates and transitional rules. English explanations are for reference; the authoritative Vietnamese legal texts apply. Contact KM UNION to agree a formal advisory scope.
Related articles
- Employee and Influencer AI Avatars: Image and Voice Rights in Vietnam
- AI Avatars and Personal Data in Vietnam: Before You Upload
- AI Avatar Provider Contracts: Approval, Labels and Exit in Vietnam
Contact KM UNION: legal@kmunion.vn · 0932 124 427.
