In Vietnam, connecting to and verifying information through the VNeID application has officially become a core form of digital identification, serving as the “digital identity” of each citizen in the electronic environment. However, as identity data is shared and utilized in the digital environment, businesses and organizations must also ensure that user data is properly managed and used.
1. Personal data protection: From “recommendation” to “mandatory requirement”
Effective from January 1, 2026, the Personal Data Protection Law No. 91/2025/QH15 establishes a new legal framework for the collection, processing, and protection of personal data.
Subsequently, Decree No. 320/2026/ND-CP, effective from September 28, 2026, further requires the connection and use of electronic identification and authentication across multiple sectors. Specifically:
- Transaction accounts across 12 sectors are required to be linked to and authenticated with VNeID.
- 206 types of documents are required to be integrated into VNeID.
- Businesses are not allowed to request users to re-submit documents when carrying out procedures.
However, authentication through VNeID does not mean that organizations have the right to use all citizens’ data for every purpose.
Under Vietnam’s Personal Data Protection Law, users have the right to know and request transparency regarding:
- What data is used for authentication or service registration.
- The purpose and scope of data use.
- Whether the data is provided or shared with third parties.
The measures used to protect data against unauthorized access, use, or disclosure.
Therefore, businesses and organizations also need to implement the necessary platforms and systems to safeguard users’ rights regarding the sharing of personal data, while supporting record-keeping and reporting when required.
2. Legal compliance needs to be translated into technical controls
Personal data protection cannot stop at internal procedures or written policies. Vietnam’s personal data protection regulations have established clearer requirements regarding organizational responsibilities in cases involving personal data breaches and cybersecurity incidents.
Specifically, the 2025 Personal Data Protection Law together with Decree No. 330/2026/ND-CP provides for administrative penalties in the areas of cybersecurity and personal data protection.
Depending on the nature and severity of the violation, organizations and individuals may face:
- Administrative penalties in accordance with applicable regulations.
- Mandatory remedial measures.
- Criminal liability if the conduct meets the legal elements of a criminal offense.
The collection, storage, use, provision, or sharing of data for improper purposes, without an appropriate legal basis, or without adequate data protection measures may also expose organizations to unnecessary legal risks.
3. What should businesses and organizations do to ensure user data security when integrating with VNeID?
When data generated through electronic identification and authentication is incorporated into business processes, the responsibility for protecting that data does not stop at the point of connection with VNeID.
Companies and organizations need to establish end-to-end data control mechanisms covering data collection, transmission, processing, storage, sharing, and the destruction or deletion of data in accordance with applicable regulations.
Businesses should:
- Collect data for the correct purpose and identify the data required for each business process.
- Implement access control, authorization, strong authentication, and access logging to reduce the risk of unauthorized data use.
- Protect data through encryption, cryptographic key management, access control, monitoring, and abnormal behavior detection.
- Control the responsibilities of relevant parties and ensure that data processing is aligned with the applicable legal basis and defined purpose.
- Maintain evidence and audit trails to identify who accessed the data, when the access occurred, what data was accessed, and what actions were performed.
Proactively protecting users’ personal data is not only a legal requirement but also an opportunity for businesses to strengthen risk management, prevent fraud, and protect their long-term reputation.
To meet the requirements for personal data protection, strong authentication, and traceability when integrating with VNeID, businesses need a security architecture capable of maintaining control throughout the entire data lifecycle.
With more than 22 years of experience in cybersecurity and digital trust, SAVYINT provides a comprehensive Digital Trust & Cybersecurity ecosystem with solutions such as Multi-Factor Authentication (MFA), Strong Customer Authentication (SCA), FIDO2 Identity, Post Quantum Identity & Authentication, Transaction Signing, data encryption, Tokenization, and API Security.
These solutions help businesses strengthen access control, protect sensitive data, and enhance their ability to meet requirements for data security, traceability, and regulatory compliance in Vietnam.
Contact with SAVYINT experts HERE.
