When personal data becomes an integral part of business activities, disputes not only arise between businesses and data subjects, but also between parties involved in data processing. The Law on Personal Data Protection 2025 (Law on PDP) sets out the requirement to protect the rights of data subjects, and also raises the issue of the mechanism for resolving related disputes.
When the personal data controller, the party controlling and processing personal data or a third party fails to ensure or infringes upon these rights, disputes may arise between the personal data subject and related parties.
Commercial arbitration has the advantages of flexibility, non-disclosure and final validity, but not all personal data disputes can be brought to arbitration. The limitations that need to be clarified lie in the nature of the disputed relationship, the validity of the arbitration agreement, and the mandatory data protection obligations.
Personal data disputes in the digital era: A need for dispute resolution of the times
The collection, storage, use and transfer of personal data can arise from many different legal relationships. In order to assess the possibility of arbitration settlement, it is necessary to distinguish disputes over the rights of personal data subjects, disputes over compensation due to data incidents, contractual disputes between data processors and disputes related to state management decisions.
Firstly, the dispute is related to the rights of the subject of personal data. The subject of personal data is the person who is reflected by the personal data and is the subject whose personal data is collected, processed and transferred. The law grants the subject of personal data certain rights to protect their interests in the personal data, including: (i) to be informed about the processing of personal data; (ii) to agree or disagree, to request the withdrawal of consent to allow the processing of personal data; (iii) to view, edit or request to modify personal data; (iv) to request the provision, deletion or restriction of personal data processing; to send a request to object to the processing of personal data; (v) to complain, denounce, initiate a lawsuit, claim for compensation for damage in accordance with law; and (vi) request competent agencies or agencies, organizations and individuals related to the processing of personal data to implement measures and solutions to protect their personal data in accordance with the provisions of law. Accordingly, when the personal data controller, the party controlling and processing personal data or a third party fails to ensure or infringes upon these rights, disputes may arise between the personal data subject and related parties.
Secondly, disputes related to personal data incidents. Personal data processing activities always have a potential risk of incidents, leading to personal data leakage, theft or unauthorized access and use. These incidents can cause personal data subjects to suffer damages such as being defrauded, being used to commit acts of violating the law, or being infringed upon honor, dignity and reputation. In these cases, the personal data subject may request the party responsible for the incident to perform the obligation to compensate for damage in accordance with the law, thereby giving rise to disputes related to personal data.
Thirdly, disputes related to agreements and contracts on personal data processing signed between parties who are not personal data subjects. The law on PDP allows parties, including the personal data controller, the personal data processor and the personal data controller and processor, to establish agreements and contracts related to personal data processing activities. With the nature of a contractual relationship, it is not uncommon for a party to breach the agreed obligations. At that time, although the direct object of the dispute is not necessarily the personal data, the dispute still arises from agreements and contracts related to the processing of personal data.
Finally, administrative disputes related to personal data between the parties and the state management agency on personal data. This is a group of disputes of a specific nature, related to the exercise of state management powers. According to current legal regulations, this type of dispute is not within the scope of commercial arbitration. Therefore, we do not analyze this group of disputes in depth.
Potential of commercial arbitration
The Court is an important jurisdictional mechanism to protect the legitimate rights and interests of the parties in a personal data dispute. However, for contractual disputes with technical elements and sensitive information, the parties can also consider an out-of-court settlement mechanism. The choice of the appropriate method must come from the type of rights requested to be protected and the ability of the parties to dispose of them, rather than just based on the desire to keep the dispute private.
In Alternative Dispute Resolution (ADR) methods, commercial arbitration has the advantage that the parties can choose arbitrators with appropriate expertise, language, venue and procedural rules. Arbitral awards are final according to the law. However, non-public proceedings do not mean that all documents, personal data and evidence are absolutely confidential; enterprises still need to design measures to control access, storage and sharing of data in the process of dispute resolution.
Legal limitations: Not all personal data disputes can be resolved by arbitration
Unlike the Court, commercial arbitration can only resolve disputes when certain conditions are met. Specifically:
The first condition: The dispute must fall under the jurisdiction of the arbitrator. Article 2 of the Law on Commercial Arbitration 2010 stipulates that the jurisdiction of arbitration to settle disputes includes: (i) Disputes between parties arising from commercial activities; (ii) Disputes arising between parties in which at least one party has commercial activities. (iii) Other disputes between parties that are prescribed by law to be resolved by arbitration.
However, the fact that a party has commercial activities does not automatically make any dispute related to that party suitable for arbitration. It is necessary to consider the nature of the disputed relationship, the specific requirements and specialized regulations, especially when the dispute involves moral rights, consumers or labor relations.
The second condition: The parties must have a valid arbitration agreement that covers the entire dispute. According to Article 5 of the Law on Commercial Arbitration, an agreement can be established before or after a dispute arises. In addition to the existence of the agreement, it is necessary to check the form, signatory, scope and cases of invalidity or impossibility of implementation according to Articles 16 and 18 of the Law. For consumers, Article 17 sets out the mechanism for choosing the dispute resolution method when the arbitration clause is included in the general conditions by the supplier. In particular, consent for the processing of personal data is not automatically an agreement to settle the dispute by arbitration.
In particular, consent for the processing of personal data is not automatically an agreement to settle the dispute by arbitration.
Applicability of commercial arbitration as a method of resolving personal data disputes
The law on personal data does not mean that all disputes related to personal data are excluded from arbitration. However, it is necessary to distinguish the claim for compensation or performance of contractual obligations from the request for the exercise of the statutory rights of the subject of the personal data. The arbitral jurisdiction must be simultaneously assessed according to Article 2 of the Law on Commercial Arbitration, the validity and scope of the arbitration agreement, the nature of the request and the mandatory provisions of specialized laws. Arbitration also does not replace the competence to handle violations of state management agencies.
For disputes between individuals and enterprises over the right to know, objection to processing or requests for deletion of personal data, caution should be exercised when inferring arbitral jurisdiction solely from the fact that the enterprise has commercial activities. In employment, labor or consumer relations, the specific protection mechanisms and the validity of the arbitration agreement should be considered separately. In contrast, disputes over the allocation of liability, reimbursement of costs and breach of confidentiality obligations in contracts between enterprises often have a clearer basis for selecting arbitrators, if the statutory conditions are met.
For example, enterprise A hires enterprise B to provide services for storing and processing customer personal data. The contract stipulates the obligation of confidentiality, decentralization of access, incident notification and compensation for damages, and has a valid arbitration clause. After a data leakage incident, A and B dispute the cause of the incident, the extent of the violation, and the cost of remediation. Arbitration can be the appropriate mechanism to resolve the contractual obligations between A and B within the scope of the agreement. However, the judgment between the two enterprises does not automatically bind the subject of the personal data from participating in the agreement, nor does it exclude the legal obligations of each party to the data subject or the competent authority.
For data processing contracts between data controllers and data processors, the possibility of applying arbitration is often clearer because disputes mainly revolve around commercial obligations: security, system safety, incident notification, support in meeting data subjects' requirements, and allocation of damages. However, internal risk allocation agreements do not automatically transfer or exempt each party from liability that the law directly imposes on each party.
Recommendations for businesses
International experience shows that arbitration can be a worthy option for some personal data protection disputes, especially contract disputes with cross-border elements. However, the advantages of non-disclosure and flexibility should not be equated with the ability to resolve all rights of data subjects. The application of international experience in Vietnam must be within the limits of arbitration jurisdiction and regulations to protect the rights of individuals.
The peculiarity of personal data disputes is that evidence often exists in electronic form: access logs, decentralization history, processing records, incident notifications, and system data. The core issue is not only the form of the document but also the integrity, origin, authenticity and evidentiary value of the evidence. Arbitration can create conditions for the parties to agree on how to present, examine and evaluate technical evidence; However, this does not mean that evidence is automatically accepted or exempted from relevant legal requirements. The parties need to anticipate mechanisms for preserving evidence, restricting access, masking identifying information and protecting personal data throughout the proceedings.
For enterprises, the selection of arbitration should not only stop at adding dispute settlement clauses to the personal data processing contract. The clause should clearly define the scope of the dispute, the mechanism for preserving and accessing electronic evidence, the obligation to confidentiality in the proceedings, the responsibility to notify the incident, the allocation of remedial costs and compensation. More importantly, the arbitration agreement only governs the dispute to the extent permitted by law and cannot replace the obligation to comply with the obligation. The value of arbitration therefore does not lie in the ability to resolve all personal data disputes, but in the right selection of disputes that can be effectively resolved on the basis of the parties' right to self-determination.
