In the context of robust digital transformation, artificial intelligence (AI) systems and electronic Know Your Customer (eKYC) systems are being widely applied in finance, banking, insurance, digital healthcare, and many other service industries. With the ability to automate processes, analyze big data, and make real-time decisions, these two types of systems deliver superior operational efficiency and significantly enhance user experience.
However, precisely due to their characteristic of processing personal data on a large scale—including biometric data, financial information, personal images, and various other sensitive data—both AI and eKYC systems are legally mandated to undergo a Data Protection Impact Assessment (DPIA) under current personal data protection laws. So, what should be noted when conducting a DPIA for AI systems and customer identification (eKYC) systems? The following article will analyze in detail the legal requirements and specific points to consider when performing a DPIA for each type of system.
LEGAL BASIS
– Law on Personal Data Protection No. 91/2025/QH15 dated June 26, 2025, of the National Assembly of the Socialist Republic of Vietnam (effective from January 01, 2026);
– Decree No. 356/2025/ND-CP detailing a number of articles and measures for the implementation of the Law on Personal Data Protection;
I. CONCEPTS OF AI SYSTEMS, eKYC, AND DPIA
1.1. What is an AI system?
An AI (Artificial Intelligence) system is a software system that uses machine learning algorithms, deep learning, or other artificial intelligence methods to analyze data, recognize patterns, make predictions, and automate decision-making without manual human intervention in each specific case. In the field of personal data protection, AI systems pose unique challenges due to their ability to process massive amounts of data, the speed of automated decision-making, and their direct impact on the rights and interests of data subjects.
According to Clause 8, Article 21 of Decree No. 356/2025/ND-CP guiding the Law on Personal Data Protection, personal data processing services include services that “automatically process data based on big data technology, artificial intelligence, blockchain, and the metaverse.” This is the group of systems that must comply with strict requirements on personal data protection and undergo mandatory DPIA in accordance with legal regulations.
1.2. What is an electronic Know Your Customer (eKYC) system?
eKYC (electronic Know Your Customer) is a form of electronic customer identification that allows users to complete the entire identity verification procedure online through an application on a mobile device or digital platform without having to visit a physical transaction counter. eKYC technology helps businesses simplify administrative procedures, save time, and improve service capacity, especially in the banking and finance sectors.
Thus, an eKYC system is a specific application of AI (incorporating OCR, Facematch, biometrics technology, etc.) to verify identity. Therefore, it is both governed by general regulations on AI systems and subject to its own specific requirements stemming from the nature of processing biometric data on a large scale.
1.3. What is a DPIA and who must perform it?
DPIA (Data Protection Impact Assessment) is a process to identify, assess, and mitigate risks to the rights and legitimate interests of data subjects arising from personal data processing activities. According to the provisions of the Law on Personal Data Protection 2025, all organizations that process personal data are obligated to formulate a Personal Data Processing Impact Assessment (DPIA) Dossier, except for a few exempted cases, specifically small enterprises, startups, business households, and micro-enterprises when meeting certain conditions specified by the Law.
Therefore, both AI systems and eKYC systems are mandatory subjects for DPIA due to their inherent characteristic of processing personal data on a large scale – including biometric data, financial information, personal images, and other types of sensitive data.
II. WHY ARE AI AND eKYC SYSTEMS MANDATED TO UNDERGO DPIA?
2.1. For AI systems
AI systems are required to undergo a DPIA due to the inherent characteristics of this technology: processing personal data on a large and continuous scale; making fully automated decisions that can directly affect the rights and interests of data subjects; and the potential risk of algorithmic bias. Decree No. 356/2025/ND-CP clearly identifies personal data processing services based on artificial intelligence technology as subjects that must meet strict conditions and fully complete relevant legal procedures, including DPIA.
2.2. For eKYC systems
The customer identification system (eKYC) falls under the mandatory DPIA category for two core reasons: the type of data processed and the scale of operation. Regarding the type of data, the eKYC system collects and processes biometric data – a type of data classified as sensitive personal data by the Law on Personal Data Protection No. 91/2025/QH15 and placed under special protection.
In terms of scale, eKYC systems in the banking and finance sector can process millions of identification requests per year, fully automated and continuously. The combination of sensitive biometric data that cannot be changed like a password, a large processing scale, and a high level of automation places eKYC systems firmly within the category of mandatory DPIA filing under current personal data protection laws.
III. KEY POINTS TO NOTE WHEN CONDUCTING DPIA FOR AI AND eKYC SYSTEMS
3.1. Describe fully and accurately data processing activities
According to Article 19 of Decree No. 356/2025/ND-CP, the DPIA dossier must clearly demonstrate:
- Information and contact details of the data controller; information of the Personal Data Protection Officer (DPO);
- Description of the purpose and details of processing activities; policies for retention, erasure, and destruction of data;
- Applied data protection measures.
For AI systems, it is necessary to clearly describe the operational logic of the model, the training data used, the automated decision-making mechanism, and the extent to which those decisions affect data subjects. For eKYC systems, it is crucial to specifically identify the integrated technologies (OCR, Facematch, biometrics, etc.), the level of automation in the customer identification process, and the handling mechanism when the system makes an incorrect decision or mistakenly rejects verification. These are specific risks that the DPIA dossier of AI and eKYC systems must fully reflect.
3.2. Assess the specific risks of each type of system
One of the central requirements of a DPIA is to comprehensively identify and assess potential risks. Decree No. 356/2025/ND-CP stipulates that the DPIA dossier must clearly state “potential unwanted consequences and damages, and measures to mitigate or eliminate such risks and harms”. For AI systems in general, specific risks include: algorithmic bias; automated decisions that adversely affect users without an accountability mechanism; risks of data leakage from exploited AI models; and the risk of training data being misused.
With eKYC systems, in addition to the general risks of AI, specific risks arise from biometric data—a type of data that cannot be changed like a password, which once leaked will cause permanent damage to the data subject. Clause 4, Article 31 of the Law on Personal Data Protection No. 91/2025/QH15 stipulates that agencies and organizations collecting and processing biometric data must have a tracking system to prevent and detect acts of infringement upon biometric data, and must comply with relevant legal regulations and international standards. This requirement must be specifically reflected in the DPIA dossier.
3.3. Ensure legal basis and the consent mechanism of data subjects
Both AI and eKYC systems are only permitted to process personal data when there is a full legal basis. The DPIA needs to review and record:
- Whether the data subject’s consent is collected voluntarily, proactively, and with full information;
- Whether the purpose of data processing is clearly declared prior to collection;
- Whether mechanisms for data subjects to exercise their rights to access, rectify, erase, and withdraw consent have been established.
Current personal data protection laws strictly prohibit forms of default consent, pre-ticked checkboxes, or general clauses that do not clarify the purpose. For AI systems that make automated decisions affecting user rights, the DPIA must also record explanation and complaint response mechanisms. For customer identification systems (eKYC), the DPIA dossier must specifically describe the process of obtaining positive, proactive consent prior to collecting biometric data, ensuring that customers clearly understand how their data will be processed by AI technology and for what purpose.
3.4. Data protection measures and technical requirements
The DPIA for AI and eKYC systems must fully describe the technical and organizational measures applied to protect data throughout the processing lifecycle. According to Clause 4, Article 31 of the Law on Personal Data Protection No. 91/2025/QH15, agencies, organizations, and individuals collecting and processing biometric data must possess physical security measures for storage and transmission equipment of biometric data, and restrict access to biometric data.
3.5. Obligation to submit and update DPIA dossiers when there are system changes
After finalizing the internal DPIA dossier, the organization must submit the dossier using Form No. 10 issued together with Decree No. 356/2025/ND-CP to the Department of Cybersecurity and High-Tech Crime Prevention (A05) – Ministry of Public Security within 60 days from the date of commencing data processing. The dossier must always be available to serve the inspection and evaluation activities of competent authorities.
Notably, the DPIA dossier is not a document created once and stored forever. The organization is obligated to update and supplement the dossier whenever there is a change according to Article 20 of Decree 356/2025/ND-CP.
CONCLUSION
DPIA for AI systems and customer identification (eKYC) systems is a mandatory and continuous legal obligation under the Law on Personal Data Protection No. 91/2025/QH15 and Decree No. 356/2025/ND-CP. These two types of systems share the commonality of processing personal data on a large scale with a high degree of automation, but they also possess distinct risks and requirements that the DPIA dossier must fully reflect – particularly the risk of automated biased decisions in AI systems and the risk of irreversible biometric data leakage in eKYC systems.
Properly executing a DPIA not only helps organizations prevent legal risks but also builds a foundation of trust with users – a key factor in the digital economy era. If your business is deploying or planning to operationalize an AI or eKYC system, please review your DPIA obligations immediately and seek specialized legal counsel to ensure full compliance with current personal data protection laws.
