2026 – predicting 3 common types of personal data disputes in Vietnam

Early identification of potential disputes over customers' personal data helps businesses proactively assess risks, improve internal processes, invest in technology, and build transparency mechanisms for users. But to think that we have to obey the new law because it is the LAW is not very thorough. Because businesses around the globe are increasingly sympathetic and trusting to partners who respect privacy and protect personal data. Business opportunities start there.

In the digital economy, customer personal data is considered a valuable asset because it is collected, analyzed and exploited to optimize business models, but this type of asset can also increase risks to privacy, security and interests of users. Especially when the Law on Personal Data Protection 2025 (Law on PDP) takes effect from January 1, 2026 with clearer legal regulations, State agencies strengthen supervision and especially people begin to be aware of their rights to personal data. At that time, the dispute over personal data in Vietnam will have similarities with Europe – which has operated a strict personal data protection mechanism for nearly a decade.

Notable similarities

The Law on PDP is based on experience from the General Data Protection Regulation (GDPR) of the European Union and countries such as Singapore. Therefore, the disputes that have arisen in Europe and Singapore are an "early forecast" for possible types of risks in Vietnam.

The case between HMI Institute of Health Science Pte. Ltd. (HMI) and the Personal Data Protection Commission of Singapore (PDPC) arising out of a serious data security incident is a good example[1]. HMI, a medical training unit, has breached its data protection obligations under Section 24 of the PDPA by failing to take reasonable measures to prevent unauthorized access. After the decommissioning of the Students' Career Portal in 2019, an Excel file containing the personal data of 761 individuals (including names, addresses, NRIC numbers, dates of birth, e-mail, phone numbers, and other sensitive information) still exists in the web directory without access control. This file is indexed by search engines, leading to public disclosure on the Internet.

PDPC identified the main cause as the lack of a vendor monitoring process and the failure to verify the deletion of data after the system was shut down. HMI admitted the breach and was fined S$10,000, and had to take corrective measures such as security audits, data cataloging, and supplier management policy development. The case emphasizes the importance of personal data governance and technical monitoring in the digital environment.

Another example is the case between the Noyb Foundation and OpenAI.[2] This privacy organization sued OpenAI, alleging that the ChatGPT system provided false information about the personal data of a public figure. OpenAI allegedly did not allow this person to edit the data and did not respond satisfactorily to requests for information.

The above story reflects a global challenge. The boundary between artificial intelligence technology and the individual's control over data. In comparison with Vietnam, the Law on PDP has clearly recognized the right of data subjects to view, edit and update information. This means that AI platforms, new technology applications or digital service platforms in Vietnam will have to prepare a full technical mechanism to meet the requirements of users, otherwise, disputes are inevitable.

Deep in the chain of disputes and lawsuits from countries, it can be seen that personal data disputes often explode when businesses subjectively assess the scope of personal data, ignore transparency obligations, or do not build a mechanism to meet users' rights. These are also the points that are at risk of appearing in Vietnam in the near future.

Types of disputes that may arise in Vietnam

Disputes arise when the rights of the data subject are infringed. The most common type of dispute in the near future will revolve around control of personal data. In recent years, Vietnamese businesses often collect personal data from forms, websites, applications or cookies without explicit notice; or require users to agree to the entire data processing policy without allowing partial opt-in. When the Law on PDP takes effect, these acts may become grounds for the data subject to request deletion, termination of processing, compensation for damages or initiation of lawsuits.

These types of disputes are particularly prone to arise in areas with a large level of data collection, such as:

Human Resources – Labor: Employees can request to delete data after quitting their jobs, but businesses continue to use it in case of disputes with employees, serve internal audits or share with overseas parent companies. If the storage period has expired or the purpose of use has changed, this may lead to disputes.

Finance – banking – insurance: Account information, credit history or identification data are sensitive data according to the law. A dispute may arise if the bank shares information with a credit scoring agency or debt collection agency without the customer's consent.

Medical – healthcare: Medical data is classified as highly sensitive. If the hospital transfers the data to the insurer or the partner that advertises drugs and other medical services without adequate notice, the data subject can completely file a lawsuit.

Communication – Advertising: Similar to the EDPS–SRB dispute, risks may arise when businesses share anonymized data with advertising agencies but the data is still traceable. At that time, the consent of the data subject becomes a determinant of legal liability.

As users become more and more concerned about privacy, just one situation of data processing that lacks transparency can lead businesses to face class action lawsuits, civil lawsuits, or administrative sanctions.

Source: The Saigon Times

Disputes related to data leakage and theft. In the digital era, data leaks can be caused by system errors, security vulnerabilities, cyber attacks, or errors from third-party service providers. The majority of Vietnamese enterprises have not seriously invested in encryption, decentralization of access or information security monitoring; Many storage systems still operate at "minimum sufficient" levels. When data is leaked, users can suffer direct losses such as being scammed, losing assets, having their identities used, being defamed, etc. These damages can become grounds for claiming compensation or initiating a lawsuit.

Another type of dispute can arise in the data supply chain, from the business using a third-party storage service, but the partner does not guarantee security. When an incident occurs, the dispute can extend between the data subject, the business, and the service provider. With businesses increasingly reliant on cloud services or third-party platforms, these chain liability conflicts are likely to become the most complex form of dispute.

Administrative disputes between enterprises and management agencies. When the management agency strengthens inspections, the issuance of sanctioning decisions related to personal data will take place more frequently. However, with a new legal system and no precedent for enforcement, inconsistencies in application can lead to administrative disputes.

Enterprises may complain or initiate lawsuits if they believe that the sanctioning decision is not based on clear legal grounds, exceeds its competence, or is not suitable for the nature of the act. The sectors most at risk include e-commerce, banking, insurance, healthcare, and technology.

These types of disputes will contribute to shaping how the Law on PDP will be enforced in the early stages, and at the same time create important case law and guidance for businesses.

Personal data has become a core element of the digital economy. When specialized laws begin to be fully applied, disputes related to personal data will no longer be the story of developed economies but will become an inevitable part of business activities in Vietnam.

Early identification of potential disputes helps businesses proactively assess risks, improve internal processes, invest in technology, and build a transparent mechanism for users. This is not just a legal compliance obligation, but a long-term competitive advantage in the context of consumers increasingly trusting businesses that respect privacy and protect personal data.

Lawyer Nguyen Nhat Duong

HM&P Law Firm

Read more: Năm 2026 – dự đoán ba dạng tranh chấp dữ liệu cá nhân phổ biến tại Việt Nam