Decree 13/2023/ND-CP laid the foundation for personal data protection in Vietnam. Law 91/2025/QH15 on Personal Data Protection, effective 1 January 2026, and Decree 356/2025/ND-CP now give consent a stronger legal basis.
Consent must be specific to each purpose and cannot be bundled with unrelated purposes. Banks must be able to prove who consented, when and to what — and customers can withdraw consent at any time.
When asking for consent, banks must state the purposes (including credit scoring), retention periods, how to withdraw and how data is deleted. Credentials, card data, transaction history and credit information must be flagged as sensitive data.
Banks must also assess compliance yearly, log all processing activities, apply protection and anonymisation standards, and notify authorities within 72 hours of a leak of sensitive data. SAVIS Consent Management automates collection, storage, verification and withdrawal of consent across digital and physical channels.
Media contact: dichvuso@savis.vn