Are countries around the world banned the sale and purchase of personal data?
The answer is not simple and depends on the legislative philosophy, the level of technological development, and the cultural perspective on privacy in each country. Some countries, especially in Europe, consider personal data as a fundamental human right and apply strict regulations. Meanwhile, in other regions, such as the United States, the approach is somewhat more flexible, creating a legal gray area where personal data is still widely traded. In this article, we will analyze the legal frameworks in key regions of the world – Europe, North America, Asia, Oceania, and South America – to clarify how countries handle the purchase and sale of personal data, while assessing global trends and making recommendations for Vietnam.
Contents to be carefully considered before passing the Draft Law on Personal Data Protection
Digital transformation is advancing rapidly in Vietnam, protecting personal data has become a top priority in many countries, including Vietnam. Decree 13/2023/ND-CP on Personal Data Protection has laid the foundation for the legal framework for data protection, and the Draft Law on Personal Data Protection (the "Draft"), which was submitted to the National Assembly at its 9th session (May 2025) and is expected to be adopted at this session, is expected to complete one of Vietnam's most important laws in personal data protection. With 68 provisions ranging from general regulations to the responsibilities of stakeholders, the Draft represents an effort to build a comprehensive legal framework. However, some contents in the draft are still unclear, difficult to implement, or not in line with the economic, social and legal practices of Vietnam.
The Draft Law on Personal Data Protection: Who is a Data Protection Officer?
In the rapid digital technological advancement, personal data has become a valuable resource but also has many potential risks. The protection of personal data is not only a legal requirement but also a vital factor to maintain user trust and ensure national security. The Draft Law on Personal Data Protection of Vietnam (the "Draft"), is expected to be approved by the National Assembly in 2025 and take effect on January 1, 2026. One of the key highlights of the draft is the regulation on personal data protection experts – a new but decisive role in the enforcement of data protection laws. In this article, we will analyze in detail the content related to DPO according to the latest Draft being submitted to the National Assembly at the 9th session, May 2025.
Building a law on personal data protection in Vietnam, lessons from the hacker attack on VNDirect
Personal data is becoming the target of increasingly sophisticated cyberattacks. The hacker attack on VNDirect Securities Joint Stock Company in March 2024 is a warning bell about vulnerabilities in personal data protection in Vietnam. This incident not only disrupts business activities but also exposes the limitations of the current legal framework, and sets an urgent requirement to build a more comprehensive and effective legal system for personal data protection. This article will analyze the VNDirect case, thereby proposing solutions to build and improve personal data protection laws in Vietnam.
Does the Draft Law on Personal Data Protection impose additional administrative procedures on businesses?
The rapid development of technology and the cyber environment has made the protection of personal data (PD) an urgent requirement in Vietnam. The draft Law on Personal Data Protection (the "Draft") has been drafted by the Ministry of Public Security to be submitted to the National Assembly for comments and may be approved as soon as this year. The Law on Protection of Personal Data is expected to create a comprehensive legal framework to protect the privacy of individuals, while meeting international standards to which Vietnam is a member. However, some opinions say that this draft is setting too many administrative procedures, creating a burden on businesses, especially small and medium enterprises (SMEs) as well as start-ups, and going against the goals of administrative reform as well as promoting the digital economy set by the Government.
Several irrational points in the Draft of Law on Protection of Personal Data
In the context of rapid digital technology development, personal data has become a valuable asset not only for individuals and organizations but also for the economy. However, data security faces many challenges due to the increasing activities of data collection and usage without stringent control. To address this issue, the Draft of Law on Protection of Personal Data (“Proposition”) has been released for public consultation with the intention of being enacted and taking effect from January 1st 2026 , as planned by the National Assembly. The regulations elevating personal data protection to the status of law are considered a significant step forward in safeguarding personal information and promoting the development of the digital economy. However, the Draft still contains some limitations that need to be carefully assessed and adjusted to better align with practical realities.
Challenges faced by financial companies in complying with personal data protection regulations
In the digital age, securities companies and investment funds must handle vast amounts of personal data, including sensitive information such as bank account numbers and transaction history. Decree No. 13/2023/ND-CP on personal data protection ("Decree 13") imposes strict rules on data collection, analysis, and sharing to protect users' rights.
Challenges in protecting consumers' personal information on the e-commerce platforms
The protection of personal data is receiving a lot of attention from businesses, including those that own e-commerce platforms. In this article, HM&P provides some observations and discusses the challenges that e-commerce platforms face in complying with current personal data protection regulations.
Advantages and disadvantages in the process of application of Decree No. 13/2023/ND-CP on the protection of personal data from company practice
13/2023/ND-CP on Personal Data Protection is promulgated in April 2023, with effect from July 1, 2023 ("Decree 13") to adjust this purpose. In this discourse, the author refers to some advantages and disadvantages of Vietnam in general and especially from the perspective of enterprises in particular during the process of implementation and application of Decree 13.
Some important impacts of the Law on Electronic transactions 2023 on the activities of enterprises
The article is made in collaboration between VCCI-HCM and HM&P Law Firm. In this article, we will discuss some important implications of the Law on Electronic Transactions 2023 that companies should consider in their operations. Besides, this article was published in the Legal Electronic Magazine on July 4, 2024.
The impact of data protection regulations on the implementation of the employment contract
In the following article, HM&P will again refer to Decree 13, but under a narrower aspect, in particular the conclusion and implementation of employment contracts during the period of validity of Decree 13.
