Updated: 23 September 2026<\/p>\n
AI tools can summarise records, retrieve information or support analysis. Where inputs contain personal data, businesses must assess both AI and personal data protection law. A paid account or enterprise edition does not replace these obligations.<\/p>\n
Article 30 of the Personal Data Protection Law and Article 10 of Decree No. 356\/2025\/ND-CP establish protection requirements for AI-related activities. Articles 3, 9 and 19 of the Law still determine principles, consent or qualifying grounds for processing without consent.<\/p>\n
For example, data collected to resolve complaints should not automatically be used to train a system serving other customers. Assess the notice scope, processing basis, provider role and new purpose. If only statistics are needed, consider reducing the data or using appropriately processed data. Replacing names with codes does not establish de-identification under Article 2 of the Personal Data Protection Law.<\/p>\n
Clarify whether the provider uses inputs, outputs or feedback for training; retention periods; support access; subcontractors; processing regions; and deletion and export mechanisms. These facts should be supported by service documentation, contracts and actual settings.<\/p>\n
Do not infer all processing behaviour from an option such as \u201cturn off history\u201d. For cloud services, also check Article 12 of Decree No. 356 on contracts, permissions and encryption in storage and transit.<\/p>\n
Article 20 of the Personal Data Protection Law covers using platforms outside Vietnam to process personal data collected in Vietnam. Map the flows before reaching a conclusion. Articles 17\u201318 of Decree No. 356 govern dossiers and exceptions; not all data in an HR tool benefits from the same exception.<\/p>\n
A new AI activity may also change the processing impact assessment dossier under Articles 21\u201322 of the Law. Updates must reflect actual changes and timing rules, rather than merely change a software name in the provider list.<\/p>\n
Article 25 of the Personal Data Protection Law regulates recruitment and employee management data. AI systems must also be assessed against Decision No. 33\/2026\/QD-TTg's high-risk list according to function and impact. A job description writing tool and a system influencing candidate selection may receive different classifications.<\/p>\n
Identify who reviews output, who can amend or disregard results and how affected individuals can report errors. This organises human responsibility; AI should not be treated as independently accountable for a business's decisions.<\/p>\n
Businesses can specify permitted input data, purposes, tools and situations requiring further assessment, while assigning access checks, logging and incident response. These are governance suggestions, not a universal mandatory checklist.<\/p>\n
When models, functions or providers change, reassess both data and AI classification. Articles 10\u201314 of the Artificial Intelligence Law and Decree No. 142\/2026\/ND-CP determine classification, notification, transparency and risk management duties.<\/p>\n
For HR records, check recruitment and employee management purposes and retention limits under Article 25 of the Personal Data Protection Law. For medical records, Articles 10 and 69 of the Law on Medical Examination and Treatment impose separate confidentiality and information-use requirements. Partner documents also require review of usage rights and confidentiality commitments. The same AI function can carry different requirements because its data sources differ.<\/p>\n
Anonymisation, encryption and de-identification are not synonymous. If a person can still be identified or the data helps identify them, personal data protection remains relevant. Removing personal information also does not remove intellectual property rights or trade secrets from the remaining material.<\/p>\n
Identify whether data resides in inputs, conversation history, document stores, logs or training datasets. Do not promise immediate complete deletion without understanding technical mechanisms and applicable retention duties. The process must address Article 14 of the Law and Article 5 of Decree No. 356 and involve parties processing the data.<\/p>\n
A useful preparation step is to test access or deletion requests using test data before expanding deployment. Results help check consistency between contract terms, individual notices and implementation capabilities. The business responsibility and reference template articles support further development of this process.<\/p>\n
Is removing a customer's name enough to upload a file to AI? No. Other content may still identify them. Assess re-identification and the complete processing basis.<\/strong><\/p>\n Does a provider's no-training commitment establish compliance? It addresses one issue. Purposes, individual rights, security, retention, contracts and transfers still require assessment.<\/strong><\/p>\n Personal Data Protection Law No. 91\/2025\/QH15<\/a><\/p>\n Decree No. 356\/2025\/ND-CP implementing personal data protection requirements<\/a><\/p>\n Artificial Intelligence Law No. 134\/2025\/QH15<\/a><\/p>\n Decree No. 142\/2026\/ND-CP implementing the Artificial Intelligence Law<\/a><\/p>\n Decision No. 33\/2026\/QD-TTg on the list of high-risk AI systems<\/a><\/p>\n Law on Medical Examination and Treatment No. 15\/2023\/QH15 \u2014 Articles 10 and 69<\/a><\/p>\n Law No. 131\/2025\/QH15 amending the Intellectual Property Law, effective from 1 April 2026<\/a><\/p>\n Sources checked through 23 September 2026.<\/em><\/p>\n Article 02 Vietnam Personal Data Protection Law and Business Responsibilities in 2026<\/a><\/p>\n Article 04 Vietnam Personal Data Processing Impact Assessment Requirements<\/a><\/p>\n Article 05 Overseas Cloud and CRM Services and Vietnam Data Transfer Filings<\/a><\/p>\n Article 16 Vietnam AI Law and System Risk Classification in 2026<\/a><\/p>\nLegal sources<\/h2>\n
Related articles<\/h2>\n