Tiếng Việt
中文 (中国)
日本語
The official entry into force of the Personal Data Protection Law marks a significant milestone in Vietnam’s legislative approach, recognizing personal data as an independent legal asset deserving comprehensive protection. However, recent incidents in which individuals unexpectedly discovered that they had been registered as company owners, incurred tax liabilities, or were even prohibited from leaving the country despite never establish company in Vietnam reveal a considerable gap between the legal framework and its practical enforcement.
Behind these incidents lies more than simple document forgery. They expose weaknesses in identity verification mechanisms, personal data governance, and coordination among state authorities. These cases also serve as an important test of the effectiveness of Vietnam’s Personal Data Protection Law during its initial implementation.
The Personal Data Protection Law Has Changed Vietnam’s Approach to Citizens’ Data
Previously, regulations governing personal information protection were scattered across various legal instruments, including the Civil Code, the Law on Cybersecurity, the Law on Cyberinformation Security, and the Law on Protection of Consumers’ Rights. The absence of a dedicated law resulted in inconsistent regulation, insufficient recognition of data subjects’ rights, and challenges in addressing violations.
The Personal Data Protection Law addresses these shortcomings by establishing a unified legal framework built upon three fundamental principles.
First, it shifts the regulatory focus from merely “managing information” to “protecting individuals’ rights over their personal data.”
Second, it establishes personal data protection principles consistent with international standards.
Third, it provides a legal foundation for the secure and sustainable development of Vietnam’s digital economy.
Accordingly, the rights of data subjects have been significantly expanded, while organizations and businesses now bear clearer responsibilities regarding the collection, storage, processing, and use of personal data. Nevertheless, recent cases in which citizens’ identity card information has been misused to establish companies or fabricate employment records demonstrate that strengthening the legal framework is only the first step; effective enforcement remains the greater challenge.
Why Can a Citizen Identification Card Become a “Passport” for Establishing a Company?
One of the most significant shortcomings today lies in the identity verification process during business registration.
In practice, company registration still relies primarily on application documents and copies of identity papers, without requiring mandatory biometric verification directly matching the applicant with the data subject at the time of submission. This creates opportunities for criminals to use stolen, purchased, or forged Citizen Identification Cards (CCCDs) to establish companies under another person’s name.
Meanwhile, under Decree No. 356/2025/ND-CP, biometric data and photographs stored on Citizen Identification Cards are classified as sensitive personal data and are therefore subject to enhanced legal protection. However, this heightened level of protection has yet to be fully reflected in the identity verification procedures applicable to business incorporation.
The problem extends beyond company formation in Vietnam. Numerous cases have also been reported in which individuals were falsely declared as employees of companies for which they had never worked. This indicates that personal data has been processed beyond its original purpose and without the valid consent of the data subject, contrary to the consent and data processing principles established under the Personal Data Protection Law.
The Weakness Lies Not Only in Data Protection but Also in the Lack of Coordination Among Government Authorities
While identity fraud constitutes the immediate cause of these incidents, the lack of interoperability among government information systems allows the consequences to persist.
Currently, there is no real-time alert mechanism connecting the National Population Database, business registration authorities, tax authorities, and social insurance agencies. As a result, when a Citizen Identification Card is unexpectedly used to register multiple companies or generate unusual tax obligations, the system is unable to automatically detect and flag these irregularities at an early stage.
This gap often leaves individuals unaware that they have been listed as company owners until they receive tax debt notices, enforcement decisions, or even travel bans.
Commenting on this issue during an interview with Vietnam Television (VTV) for the program “Information Loopholes Leave Citizens Burdened with Tax Debts,” Lawyer Nguyen Tien Hoa, Senior Partner at ASL LAW, stated:
“There should be a unified coordination mechanism among business registration authorities, tax authorities, and social insurance agencies. In addition, citizens need to understand the principles governing the storage and processing of personal information so that if they become victims of fraud, they can promptly report the matter to the competent authorities and the police.”
As long as government authorities continue operating through separate, disconnected systems, fraudulent activities will always be detected more slowly than perpetrators can exploit personal data. At the same time, improving public awareness of personal data management remains an indispensable element in reducing these risks.
Where Does the Personal Data Leakage Come From?
In many cases, identity fraud originates from personal data that has already been collected, traded, leaked, or otherwise compromised.
The Personal Data Protection Law expressly prohibits the sale, misappropriation, unauthorized disclosure, and unlawful use of personal data. Nevertheless, images of Citizen Identification Cards, scanned identity documents, and personal identification information continue to circulate widely across online platforms or are shared through messaging applications without appropriate safeguards.
Many individuals still habitually send photographs of their Citizen Identification Cards via Zalo or email, post images of identity documents on social media, or provide unredacted scans containing sensitive personal information. Once such data has been disseminated, data subjects have little practical ability to control how it is subsequently used.
Unlike many jurisdictions that have established mechanisms enabling citizens to determine which organizations hold their personal data, with whom it has been shared, and for what purposes it is being processed, Vietnam is still in the process of developing tools that allow individuals to track the “data footprint” of their own personal information.
The Legal Framework Is in Place but Requires Stronger Enforcement
From a legal perspective, the Personal Data Protection Law has introduced several important mechanisms to prevent the misuse of personal data.
Data subjects have the right to be informed, to request correction or deletion of data processed for improper purposes, and to require that all data processing activities be based on clear and valid consent. Businesses may collect personal information only for legitimate recruitment purposes. The sale or unlawful disclosure of personal data is strictly prohibited, and violations may result in substantial administrative fines or criminal prosecution where the statutory elements of a criminal offense are satisfied.
However, for these provisions to achieve their intended effect, legal reforms must be accompanied by both technical and administrative measures.
First, mandatory biometric authentication should be implemented for company registration procedures and the establishment of formal employment relationships, with direct integration into the National Population Database.
Furthermore, the National Personal Data Protection Portal and the National Public Service Portal should introduce functions enabling citizens to proactively verify whether their Citizen Identification Card is being used to represent or register any companies.
Coordination among the authority responsible for personal data protection, business registration authorities, tax authorities, and social insurance agencies should also be strengthened through integrated information-sharing mechanisms, allowing suspicious cases to be detected earlier and citizens’ complaints to be resolved more efficiently.
At the same time, illegal trading of personal data should be addressed through rigorous enforcement, including the full application of financial penalties, confiscation of unlawful profits, and criminal prosecution whenever sufficient legal grounds exist.
What Should Citizens Do If They Discover That Their Identity Has Been Used to Register a Company or Generate Tax Liabilities?
If individuals discover that their personal information has been misused to establish a company or create unwanted tax obligations, they should promptly gather all available evidence, including business registration records, incorporation documents, signature specimens, and any other relevant materials for comparison.
They should then submit formal requests to the relevant business registration authority and the tax authority administering the company, asking them to verify the information, while simultaneously reporting the identity fraud and unlawful use of personal data to the police.
At the same time, data subjects may exercise their rights under the Personal Data Protection Law by requesting the data controller and the competent personal data protection authority to verify, correct, or delete inaccurate personal data.
Where identity fraud has caused financial loss, reputational damage, or restrictions on personal freedoms—such as being prohibited from leaving the country—the affected individual may also seek compensation in accordance with applicable law and consult legal counsel for assistance throughout the dispute resolution process.
ASL Law is a leading full-service and independent Vietnamese law firm made up of experienced and talented lawyers. ASL Law is ranked as the top tier Law Firm in Vietnam by Legal500, Asia Law, WTR, and Asia Business Law Journal. Based in both Hanoi and Ho Chi Minh City in Vietnam, the firm’s main purpose is to provide the most practical, efficient and lawful advice to its domestic and international clients. If we can be of assistance, please email to [email protected].
ASL LAW is the top-tier Vietnam law firm for doing business in Vietnam. If you need any advice, please contact us for further information or collaboration.
