Businesses face the 'sword' of personal data.

(PLVN) - The Law on Personal Data Protection represents a significant legal shift in the journey to building a safe and sustainable digital environment in Vietnam. Technological tricks aimed at concealing the purpose of data collection are being blocked by clear regulations and heavy legal responsibilities. In this context, startups, technology companies, and cross-border businesses are forced to adapt quickly to comply with the law, while simultaneously leveraging the strategic competitive advantage from transparent personal data protection policies.

No more "grey areas" with data collection "tricks".

In the context of the rapidly developing digital economy and digital transformation, personal data is playing a central role in online commerce, services, and business management. User data is a crucial resource that helps businesses build customer experiences, optimize products, and create a competitive advantage. However, this reality also creates risks of privacy violations and unauthorized data use, making the protection of personal data an urgent requirement. This necessitates a comprehensive and transparent legal framework that can be quickly implemented to address current difficulties and shortcomings.

The Law on Personal Data Protection marks a turning point in data management in Vietnam, bringing issues of privacy and personal data protection into a separate law, instead of being scattered across various legal documents as before. The new law clearly defines the rights of data subjects, such as the right to know, consent, request correction, review, and deletion of personal data, while also placing clear legal responsibilities on businesses when collecting, processing, storing, and sharing personal information.

A notable aspect of the Law is the elimination of legal "grey areas" that businesses previously exploited in data collection: "default consent" is no longer considered a valid legal basis. Specifically, before the Personal Data Protection Law was enacted, many businesses used "soft" tricks to collect data without explicitly asking for permission. Common methods included using pre-checked boxes, combining multiple data processing purposes into a single acceptance, or hiding the refuse button in various interface layers—collectively known as technological "tricks"—causing users to unknowingly agree to share information without fully understanding the consequences of this decision.

The new law has closed this "grey area" by affirming that "personal data must be collected with the consent of the data subject before collection, except where the law provides otherwise." Consent from the data subject is only valid when it is based on voluntary agreement and knowledge of the following information: the type of personal data being processed, the purpose of processing the personal data; the data controller or the party controlling and processing the personal data; and the rights and obligations of the data subject. Consent must adhere to principles such as: expressing consent for each purpose; not including conditions requiring consent for purposes other than those agreed upon; and remaining valid until the data subject changes their consent or as required by law. In particular, silence or failure to respond is not considered consent. On the other hand, the law also requires businesses to implement clear and transparent permission mechanisms and to be able to withdraw consent at any time when collecting and processing users' personal data.

The new regulations have a far-reaching impact on all businesses that use data as a strategic resource, especially technology companies, digital platforms, e-commerce businesses, online advertising platforms, and startups that rely on big data to build their business models. For large technology corporations and companies operating on global data platforms, this is also a significant legal requirement. For example, online advertising platforms or services based on user behavior cannot continue to collect data extensively without providing clear choices for Vietnamese users.

Legal pressure, strategic opportunities for startups and businesses.

Beyond simply requiring individual consent, the new law also adds mandatory mechanisms such as assessing the impact of processing personal data and assessing the impact of cross-border personal data transfer. For example, the party controlling personal data and the party controlling and processing personal data must create and store a record of the impact assessment of personal data processing and send one original copy to the specialized agency for personal data protection within 60 days from the first day of processing personal data. Furthermore, if the party controlling personal data, the party controlling and processing personal data, or a third party discovers a violation of regulations on personal data protection that could harm national defense, national security, social order and safety, or infringe upon the life, health, honor, dignity, or property of the data subject, they must notify the specialized agency for personal data protection no later than 72 hours from the time the violation is discovered.

Fintech companies in Vietnam are forced to adjust their current security policies to comply with the new regulations. (Source: Banking Plus).

These regulations demonstrate that Vietnam is not only keeping pace with global privacy protection trends but also aims to build a safe digital environment where user rights are respected. These requirements apply to both domestic and cross-border businesses operating in Vietnam. For example, fintech and e-wallet companies in Vietnam such as MoMo and ZaloPay are forced to focus on adjusting their current privacy policies to comply with the new regulations, while also strengthening customer trust regarding personal data. The clear legal definition of organizations and businesses' responsibilities not only enhances personal data security but also prevents illegal data trading.

From another perspective, new requirements for impact assessment and transparency in data processing are posing significant challenges for tech startups and small businesses. Lacking resources in legal, technological, and data governance, many businesses face major obstacles in building compliance systems from the outset, from reviewing data collection and processing procedures to clearly defining responsibilities throughout the entire digital service chain. For large tech corporations, even with the capacity to meet regulations, the tightening legal framework still leads to increased compliance costs and legal risks. Businesses are forced to redesign internal processes, user interfaces, privacy policies, and mechanisms to protect data subject rights. However, this also presents an opportunity to strengthen customer trust – an increasingly decisive factor in global competition, and for many large platforms, good compliance with the new law is a clear competitive advantage. For businesses operating across borders, from social media to technology services with servers located abroad, regulations regarding the transfer of personal data outside the territory have become a key point, directly impacting their operating models and market strategies in the future.

Clearly, the Law on Personal Data Protection is not only a legal step forward but also a milestone in building a transparent and trustworthy digital ecosystem in Vietnam. With the elimination of "grey areas" in data collection, businesses no longer have a choice between compliance or non-compliance; they must shift to a compliance mindset to compete. For startups, technology companies, and cross-border platforms, this presents both pressure and opportunity to reposition their brands based on respect for privacy and personal data security – factors that are increasingly becoming standards of sustainable business in the digital age.

Source: https://baophapluat.vn/doanh-nghiep-truoc-thanh-kiem-du-lieu-ca-nhan.html