Where does responding to a personal data incident start?
In the digital economy, it can be said that personal data is and will become the operational pillar of businesses. From financial transactions, customer care, recruitment, marketing to consumer behavior analysis, every activity relies on this data stream.
Guidance on procedures for issuance of the Certificate of eligibility to trade in data intermediary products and services
Data intermediary is a type of business of products and services that help connect data subjects, data owners and users, through commercial agreements. This is a potential type of business because data is considered a high-value asset in the digital era and agencies, organizations and individuals currently have a high demand for connecting, sharing, exchanging and accessing data. However, opportunity comes with responsibility. Enterprises providing data intermediary products and services between service users and state agencies must be registered, managed and licensed.
Draft sanctioning of administrative violations in the field of data that have a great impact on business activities
Vietnam is entering a critical phase in data management, with new regulations set in place to shape the future of data-related activities. In November 2024, the Data Law was approved by the 15th National Assembly and officially took effect on July 1, 2025 ("Data Law 2024"). This is the first time that Vietnam has enacted an in-depth law, laying the legal foundation for the management, security, processing and use of digital data .
What should enterprises do to manage risks arising from employees’ use of AI?
The digital era that forces businesses to accelerate innovation to maintain a competitive advantage is creating a major polarization within organizations. On the one hand, sales and product development teams are under pressure to apply AI to optimize performance; The other side is the risk management teams (technical and legal teams) that strive to prevent incidents that cause loss of trust or ensure compliance with the law. This interference leads to a common but dangerous phenomenon: "Shadow AI" – the arbitrary use of AI tools by employees without the approval or supervision of the IT department .
Personal Data Protection – How is the market survey industry responding?
Market survey businesses not only collect identifying information such as name, age, occupation, but also collect data on consumer behavior, interests, personal opinions, product reviews, even sensitive information such as health status, etc. financial behavior or social issues. The scope of data collection and use is wide, so businesses in this segment are forced to make many adjustments to adapt to the new legal system on PDP.
The era of “trading benefits for data” is over!
Many businesses have been choosing the model of collecting and exploiting personal data based on the principle of exchanging benefits for the right to use data - the data giver and the data recipient are happy. However, behind that seemingly reasonable exchange mechanism is a significant legal risk for businesses.
CNIL sanctioned e-commerce platform SHEIN 150 million euros for violating its cookie policy
On September 1, 2025, the Restriction Committee of the French National Commission for Informatics and Freedoms (CNIL) issued the Deliberation Judgment No SAN-2025-005 , which is an important legal event confirming France's tough stance on compliance with cookie regulations . The ruling sanctioned INFINITE STYLES SERVICES CO. LIMITED (ISSCL), a subsidiary of the SHEIN group, with a record administrative fine of €150,000,000.
2026 – predicting 3 common types of personal data disputes in Vietnam
Early identification of potential disputes over customers' personal data helps businesses proactively assess risks, improve internal processes, invest in technology, and build transparency mechanisms for users. But to think that we have to obey the new law because it is the LAW is not very thorough. Because businesses around the globe are increasingly sympathetic and trusting to partners who respect privacy and protect personal data. Business opportunities start there.
To be able to harmoniously implement the three new legal "pillars" of privacy
If the Law on Personal Data Protection (Law on PDP) is the "original law" on privacy, the Draft Law on Cyber Security (Amendment - Law on Cyber Security) raises the issue of data protection in the wider cyberspace, while the Draft Law on Artificial Intelligence tackles the new problem of how artificial intelligence systems - which live on data - still respect the rights of children people, privacy, and avoidance of deviance.
When personal data held by businesses is attacked by malicious code
On June 26, 2024, the Singapore Personal Data Protection Commission (PDPC) was notified of a data breach involving the company's servers infected with ransomware around June 24, 2024. As a result, the personal data of 190,589 individuals was stolen and posted for sale on the dark web .![Forecast of privacy disputes in Vietnam in the near future [1]](https://www.hmplaw.vn/thumbs/382x240x1/upload/news/tai-nguyen-2025-12-22t133604764-8816.jpg)
Forecast of privacy disputes in Vietnam in the near future [1]
The article provides some in-depth opinions on legal risks and expected litigation trends related to personal data privacy in Vietnam in the near future. Especially from January 1, 2026, the time when the Law on Personal Data Protection (Law on PDP) officially takes effect and creates a solid foundation for litigation activities to protect the privacy.
