HCMC — Vietnam will tighten controls on how social media platforms collect and use personal data under a new law taking effect on January 1, 2026.
The National Assembly has passed the Law on Personal Data Protection, which prohibits social media and online communication services from eavesdropping, recording calls or reading private messages without user consent, unless otherwise allowed by law.
The law also bans platforms from requiring users to provide photos or videos containing full or partial images of personal identification documents, such as ID cards or driver’s licenses, for account verification.
Service providers operating in Vietnam must clearly inform users of the types of personal data collected when services are installed and used. Data collection must be limited to the scope agreed with users and the stated purpose.
Platforms must allow users to refuse cookies and data-sharing files. They must also offer a “do not track” option or track user behavior only after receiving explicit consent.
The law requires platforms to publish transparent privacy policies. Users must be able to access, edit and delete their personal data, adjust privacy settings and report violations. Providers are also responsible for protecting personal data transferred overseas.
Penalties under the law are strict. Illegal trading of personal data can be fined up to 10 times the unlawful gains. If gains cannot be determined, or if the gain-based fine is lower than the general cap, the maximum fine is VND3 billion.
For violations involving cross-border data transfers, organizations can be fined up to 5% of revenue from the previous year. If there is no revenue, or if the revenue-based fine is lower, the maximum fine of VND3 billion applies.
A specialized agency under the Ministry of Public Security can order a halt to overseas data transfers if they pose risks to national defense or security.
