In the 2026 business landscape, many enterprises remain focused on worrying about taxes, operating costs, or market fluctuations. However, the biggest risk for businesses in 2026—which few recognize—actually stems from the very customer data repositories they possess. Since the Law on Personal Data Protection 2025 came into effect and Decree No. 13/2023/ND-CP was applied, the legal framework for personal data protection in Vietnam has undergone a comprehensive transformation. Authorities are tightening inspections and penalties are becoming increasingly severe, while the majority of small and medium-sized enterprises (SMEs) still lack a methodical data management system. This article analyzes the legal risks associated with personal data that businesses need to identify and address immediately in 2026.
LEGAL BASIS
- Law on Personal Data Protection No. 91/2025/QH15 (effective from January 1, 2026);
- Decree No. 356/2025/ND-CP detailing a number of articles and measures for the implementation of the Law on Personal Data Protection.
I. WHY DATA IS THE BIGGEST RISK FOR BUSINESSES IN 2026
1.1. New Legal Framework – The Era of Data Accountability Begins
The Law on Personal Data Protection 2025 marks a major turning point in how the Vietnamese State approaches the issue of privacy. Under the provisions of this Law, any organization or enterprise involved in collecting, storing, using, or transferring personal data must comply with specific legal obligations. This is no longer a voluntary recommendation, but a mandatory requirement backed by enforcement sanctions.
Decree No. 13/2023/ND-CP clarified the concept of “personal data”, classifying it into basic and sensitive data, while also defining the lawful bases for data processing. Accordingly, businesses may only process personal data with the consent of the data subject, or under one of the cases permitted by law. Violating this principle is one of the most common risks that businesses are facing in 2026.
1.2. Penalty Levels under Decree No. 356/2025/ND-CP – Alarming Figures
Decree No. 356/2025/ND-CP specifies penalty brackets for violations of personal data protection. No longer symbolic fines, these figures have the genuine potential to seriously impact a business’s financial operations. Monetary fines can reach billions of VND for serious violations, such as the illegal trading of personal data or failing to implement mandatory data protection measures.
In addition to fines, businesses may be subject to remedial measures, such as being forced to delete data, suspended from data processing activities, or having their violation details publicly disclosed – which inflicts severe damage on brand reputation. This is exactly why data risk is overtaking tax risk to become the top concern for businesses in 2026.
II. COMMON PERSONAL DATA LEGAL RISKS ENCOUNTERED BY BUSINESSES
2.1. Collecting Data Without a Lawful Basis
One of the biggest risks businesses face is collecting customer personal data without explicit consent or without relying on other lawful bases as prescribed by the Law on Personal Data Protection 2025. In practice, many enterprises still use generic registration forms that do not specify the purpose of collection or provide information regarding the data subject’s rights.
In the spirit of the Law on Personal Data Protection 2025 and relevant documents, the consent of a personal data subject must be expressed in a clear and specific manner. It must not be set through default opt-in methods or vague, misleading instructions. This means pre-ticked checkboxes, hidden clauses on the final page of a contract, or one-way email notifications all fail to meet legal requirements.
2.2. Lacking Mandatory Legal Dossiers on Data Processing
The Law on Personal Data Protection 2025 and Decree No. 356/2025/ND-CP require businesses to formulate and maintain certain mandatory legal records. These include: the Data Protection Impact Assessment (DPIA) dossier, a Personal Data Protection Policy, and data processing contracts with third parties. This requirement applies to all organizations, including SMEs, when conducting personal data processing activities on a certain scale.
In practice in 2026, the majority of enterprises in Vietnam have not yet finalized these dossiers. When regulatory authorities conduct inspections or examinations, the absence of these legal documents will serve as direct evidence of non-compliance, leading to the risk of being penalized under Decree No. 356/2025/ND-CP.
2.3. Failing to Guarantee Data Subjects’ Rights
The Law on Personal Data Protection 2025 grants data subjects many crucial rights: the right to be informed, right of access, right to rectification, right to erasure, right to restriction of processing, right to object, and so forth. Businesses are obligated to build mechanisms to ensure the execution of these rights within the timeframes prescribed by law.
In reality, many enterprises do not have internal processes to receive and handle requests from data subjects. When a customer requests the erasure of data or access to their personal information and the business fails to respond or refuses without justification, this constitutes a legal violation that can be penalized under current regulations regarding personal data risks.
2.4. Failing to Timely Notify Data Breach Incidents
Under the provisions of the Law on Personal Data Protection 2025, when a personal data breach incident occurs, the enterprise must notify the competent authority within 72 hours of detection. This is a mandatory obligation, independent of the scale of the incident or the severity of the damage.
Amidst increasingly sophisticated cyberattacks in 2026, the risk of data leaks is a reality that any business can experience. The lack of an incident response process and failure to submit notifications on time will aggravate the severity of the violation, resulting in additional sanctions under Decree No. 356/2025/ND-CP.
2.5. Violating Cross-Border Data Transfer Regulations
For enterprises engaged in transferring personal data abroad—such as storing data on overseas cloud systems, or sharing data with a parent company or international partners—the Law on Personal Data Protection 2025 mandates specific legal conditions and procedures that must be fulfilled. Businesses must conduct an impact assessment, compile a dossier, and notify the regulatory authority before executing the data transfer.
This is one of the least-noticed data risks by businesses, particularly for those using international cloud storage services or third-party marketing tools that frequently and “inadvertently” transfer Vietnamese citizens’ personal data out of the territory without having finalized the reporting dossiers with the Ministry of Public Security.
III. WHAT BUSINESSES NEED TO DO TO MITIGATE DATA RISKS IN 2026?
3.1. Review and Update Lawful Bases for Data Processing
The first and most important step is for businesses to review all existing personal data processing activities: where data is collected from, where it is stored, what purposes it is used for, and with whom it is shared. From there, evaluate whether each activity has an appropriate lawful basis in accordance with the Law on Personal Data Protection 2025 and relevant legal documents. For activities lacking a sufficient basis, it is urgent to incorporate consent mechanisms or establish another lawful ground.
3.2. Build a Complete Compliance Dossier System
Businesses need to fully implement Data Protection Impact Assessments (DPIA) as required by Decree No. 356/2025/ND-CP and the Law on Personal Data Protection 2025, as well as build and maintain internal procedures for receiving and processing data subjects’ requests. This serves as a vital “legal shield” that helps enterprises demonstrate compliance during inspections and examinations.
3.3. Train Personnel and Appoint a Data Protection Officer (DPO)
Data risk stems not only from technical systems but also from the human element. Employees who are not trained in personal data protection may accidentally expose customer information, send emails to the wrong recipients, or use data for the wrong purposes. Appointing a dedicated Data Protection Officer (DPO) will help businesses ensure that legal compliance is executed systematically and continuously throughout 2026.
CONCLUSION
The biggest risk for businesses in 2026 is not tax or inflation – it is data. In an era where the legal framework for personal data protection is fully established with the Law on Personal Data Protection 2025, Decree No. 13/2023/ND-CP, and Decree No. 356/2025/ND-CP, compliance is no longer an option but a mandate. Businesses that proactively build a methodical data management and protection system from this point forward will not only avert legal risks but also forge a long-term competitive edge in the eyes of customers and partners.
