Privacy law in Vietnam – Website users’ information
Users’ information as personal information
Under Vietnamese laws, users’ information such as names, email addresses, passwords and date of birth could be classified as “personal information” (thông tin cá nhân). In particular,
(a) Under Decree 72/2013, personal information is defined as information which is attached to the identification of the identity and personal details of an individual including name, age, address, people's identity card number, telephone number, email address and other information as stipulated by law;
(b) Under Circular 25/2010, personal information means information sufficient to precisely identify an individual, which includes at least one of the following details: full name, birth date, occupation, title, contact address, email address, telephone number, identity card number and passport number. Information of personal privacy includes health record, tax payment record, social insurance card number, credit card number and other personal secrets. Circular 25 applies to the collection and use of personal information by websites operated by Vietnamese Government authorities. Circular 25 is not directly applicable to the collection and use of personal information by websites operated by non-Government entities. However, the provisions of Circular 25 could be applied by analogy. In addition, it is likely that a non-Government entity will be subject to the same or more stringent standards than those applicable to a Government entity; and
(c) Under Decree 52/2013, personal information is information contributing to identifying a particular individual, including his/her name, age, home address, phone number, medical information, account number, information on personal payment transactions and other information that the individual wishes to keep confidential, excluding work contact information and other information that the individual himself/herself has published in the mass media.
Users’ information as “secret of private life”
The Civil Code provides that an individual’s rights to “secrets of his/her private life” (bí mật đời tư) must be respected and shall be protected by law”. The Civil Code does not define what constitutes a secret of private life. However the following provisions may shed some lights on the meaning of secret of private life:
(a) Decree 185/2013 defines “personal secrets” of a consumer to mean information pertaining to personal consumers in which consumers or relevant organizations or individuals have applied security measures, if such information is disclosed or used without their prior consents, such disclosure or use will cause negative effects on their health, lives, properties or other physical or mental damages to consumers.
(b) Decree 52/2013 seems to suggest personal secrets to mean personal information that the relevant person wishes to keep confidential; and
(c) Circular 25/2010 considers health record, tax payment record, social insurance card number, credit card number and other personal secrets to be personal secrets.
In addition, in Vietnamese, the word “secrets” (bí mật) is usually understood as something which is being kept confidential and which is not disclosed to outsiders. The word “private life” (đời tư) is usually understood as something that relates to one person only rather than things that are public or known to others.
In light of the above, if the user does not take measures to keep his user’s information confidential then such information may arguably not be regarded as “secrets of private life”. If this were the case, they would not be subject to the protection conferred by Article 38.1 of the Civil Code. In practice, other than passwords, an individual generally does not keep his/her name, email addresses or, except for very limited circumstances, date of birth confidential. Therefore, in general, passwords could be considered as secret of private life.
Users’ information as State secret
The Ordinance on State Secrets defines State secrets as “information on cases, affairs, documents, objects, venues, time, speech, carrying important contents in the fields of politics, national defense, security, external affairs, economy, science, technology and other fields, which the State does not publicize or has not yet publicized and the disclosure of which will cause harm to the State of the Socialist Republic of Vietnam”. The definition of State secrets is very broad and general may cover certain personal information of certain individuals. For example,
(a) unpublished details of high ranking State and political leaders may be regarded as “top secrets”;
(b) “information concerning deposits and other deposited property of customers at credit institutions”, and “customer codes used for identifying individual payment cards of the payment card users, credit cards and other types of cards used in banking operations; and passwords of computer users for remote access systems in banking sectors may be regarded as secret; and
(c) personal data of various State officials (especially those at high level positions or those working in sensitive sectors or organizations) may be regarded as secret.
Therefore, in theory, in certain limited scenario, website users’ information collected by a website operator may constitute State secret under Vietnamese law.
The Government officially issued Decree 342/2026/ND-CP dated 3 September 2026, detailing the Commercial Law and the Law on Foreign Trade Management on the sale and purchase of goods and activities directly related to the sale and purchase of goods by foreign investors and foreign-invested enterprises (FIEs) in Vietnam (Decree 342/2026).
Effective from 18 October 2026, Decree 342/2026 replaces Decree 09/2018/ND-CP (Decree 09/2018), which has governed the Business License and Retail Outlet License regime since 2018. However, FIEs holding Business Licenses and Retail Outlet Licenses issued before 18 October 2026 may continue the licensed activities under their existing licences.