Updated: 23 September 2026<\/p>\n
Names, phone numbers, delivery addresses and purchase histories may be personal data when linked to an individual. Sellers must manage them throughout ordering, delivery, after-sales support and marketing. A privacy policy has little practical value if staff still share customer files through uncontrolled accounts.<\/p>\n
Personal Data Protection Law No. 91\/2025\/QH15 dated 26 June 2025 and Decree No. 356\/2025\/ND-CP dated 31 December 2025 both took effect on 1 January 2026. Review them when collecting and processing customer information. [1][2]<\/p>\n
Assessment must reflect collected data, purposes, parties' roles and processing grounds. Do not assume that an \u201cI agree\u201d box resolves every operation, or that receiving an order permits every use of the information.<\/p>\n
Before adding a form field, identify its purpose, users and retention period. Requesting identity documents for an ordinary product delivery needs a suitable reason and legal basis; do not collect them merely because a template includes the field.<\/p>\n
Separate transaction data from analytics or marketing data. A phone number needed for delivery contact does not automatically show that the customer wants regular advertising calls.<\/p>\n
Article 28 of the Personal Data Protection Law sets consent requirements for processing customer data in advertising services and requires an opt-out method. Behavioural or personalised advertising also requires assessment of relevant implementing rules. [1][2]<\/p>\n
Record the data source, time of choice, notice shown and withdrawal method. Do not buy phone lists and treat a seller's verbal assurance as sufficient grounds for use.<\/p>\n
When sharing a list with an advertising agency, clarify purposes, usage limits, access and end-of-contract handling. A tool's ability to accept an upload does not mean the upload is permitted.<\/p>\n
Identify necessary delivery data, authorised users and secure exchange methods. Provider agreements should set processing purposes, safeguards, incident notification responsibilities and retention or deletion at service end.<\/p>\n
An order list sent to a large chat group may be downloaded beyond work needs. Individually assigned accounts, restricted permissions, export limits and prompt revocation when staff leave provide better controls.<\/p>\n
The Law recognises rights including deletion requests, processing restrictions and consent withdrawal within its scope. Apply relevant exceptions and other retention duties rather than automatically delete transaction records that must legally be retained. [1][2]<\/p>\n
The process should verify the requester, identify relevant data, assess retention grounds and communicate the outcome. If some records must remain, explain which and restrict their use to the proper purposes.<\/p>\n
Information collected and its purposes.<\/p>\n
Possible recipients and sharing scope.<\/p>\n
Retention periods or the criteria used to set them.<\/p>\n
How customers submit data requests.<\/p>\n
Contact details and complaint handling methods.<\/p>\n
Access management measures appropriate to operations.<\/p>\n
These areas should also be checked against Article 5 of Decree No. 248\/2026\/ND-CP dated 30 June 2026 on e-commerce platform privacy policies. [3]<\/p>\n
That cannot be assumed. Identify each party's role, legal duties and processing agreement. The shop should still monitor the purposes for which its provider uses data.<\/p>\n
Do not use publication of customers' phone numbers, addresses or identity documents as pressure. Preserve evidence, use appropriate resolution channels and assess legal grounds before any personal data disclosure.<\/p>\n
Restrict unauthorised access, retain logs, identify affected scope and activate the response procedure. Assess notification duties for the specific circumstances rather than simply change passwords and ignore consequences.<\/p>\n
[1] Personal Data Protection Law No. 91\/2025\/QH15 dated 26 June 2025, particularly Articles 4, 9, 19 and 28.<\/a><\/p>\n [2] Decree No. 356\/2025\/ND-CP dated 31 December 2025.<\/a><\/p>\n