Legal review: 15 October 2026 · Đọc tiếng Việt
Before uploading images, video or voice recordings to an AI avatar platform, a business should establish where the data goes, who uses it and for what purposes. A convenient demonstration can involve storage, modelling, remote support or reuse that the marketing team has not considered.
Images, voices and biometric data
Article 3 of Decree 356/2025/ND-CP lists personal images as basic personal data. Voice recordings connected with, or capable of identifying, a person also require assessment as personal data. Biometric information must be examined separately under Article 31 of the Personal Data Protection Law and Article 4 of Decree 356.
Not every image or audio file becomes sensitive biometric data simply because AI software processes it. Conversely, where technology extracts biological characteristics to identify, authenticate or distinguish individuals, describing the input merely as a media file does not resolve the corresponding protection requirements.
Map the process from source recording to publication
Map collection, upload, processing, avatar creation, video generation, storage, sharing and deletion. For each step, identify the organisation, location, resulting data and authorised users. Include backups, logs, customer support records and any person-specific model.
Determine controller, processor, combined controller-processor and third-party roles from actual activities. The contractual label “provider” does not settle the data role. If a platform reuses recordings for its own purposes, assess that activity separately from generating an avatar on the customer’s instructions.
Project-specific generation is different from shared-model training
Ask whether data may improve a general model, test products or serve other customers. Review actual settings and contract terms rather than relying solely on a sales statement that customer data is not used.
Where consent is the processing basis, Article 9 of the Personal Data Protection Law requires consent appropriate to each purpose. Permission to use an image in one campaign does not automatically include training for another purpose. Establish retention periods and a process for data subject requests.
When should cross-border transfers be assessed?
Article 17 of Decree 356 covers transfers of data collected or stored in Vietnam to servers outside Vietnam or cloud services supplied by providers abroad; transfers from Vietnam to foreign recipients; and transfers of data collected in Vietnam to platforms abroad for further processing.
Check storage and processing locations, recipients and actual support or sharing flows. The website language, trading name or nationality of a provider’s shareholders is not a sufficient test.
Article 20 of the Personal Data Protection Law and Articles 17–18 of Decree 356 address transfer impact assessments and exemptions. Uploading an employee’s recording to an advertising tool should not automatically be treated as exempt cross-border HR management. An exemption from a transfer assessment, where applicable, does not remove every data protection obligation.
Distinguish two assessment dossiers
- Personal data processing impact assessment: considers the processing, purposes, parties, risks and safeguards under Article 21 of the Law and Article 19 of Decree 356, subject to applicable exemptions and transitional provisions.
- Cross-border transfer impact assessment: separately considers the transfer, recipients and protection after transfer under Article 20 of the Law and Article 18 of Decree 356, where no exemption applies.
For cases subject to these requirements, Decree 356 provides corresponding submission periods of 60 days from commencement of processing or cross-border transfer. This does not authorise processing without a legal basis or safeguards during that period. Preparation and retention of the dossier must follow the applicable requirements from the relevant starting point.
Questions for the platform provider
- Who is the contracting entity, and which subprocessors are involved?
- Where are data, backups and person-specific models stored and processed?
- Can the data be used for further training or other purposes?
- Who can access, export or generate content with the avatar?
- How are derived data and backups handled following a deletion request?
- What documents, evidence and incident support will be available?
KM UNION can review the legal obligations, processing agreements and relevant dossier content, coordinating with technical specialists so that descriptions match the actual data flows and safeguards. The advisory scope depends on the provider and the project.
Legal sources
- Civil Code 91/2015/QH13 — Article 32
- Personal Data Protection Law 91/2025/QH15
- Decree 356/2025/ND-CP
- AI Law 134/2025/QH15 — Articles 11, 35
- Decree 142/2026/ND-CP — Articles 16–19
Reviewed on 15 October 2026. This article provides general information and does not replace advice for a particular person, contract or project. Check the actual documents, applicable dates and transitional rules. English explanations are for reference; the authoritative Vietnamese legal texts apply. Contact KM UNION to agree a formal advisory scope.
Related articles
- Real-Person AI Avatar Contracts in Vietnam: Six Key Issues
- Employee and Influencer AI Avatars: Image and Voice Rights in Vietnam
- AI Avatar Provider Contracts: Approval, Labels and Exit in Vietnam
Contact KM UNION: legal@kmunion.vn · 0932 124 427.
