HM&P trained nearly 100 Ho Chi Minh City businesses on compliance with the Personal Data Protection Law.

On October 16, 2025, HM&P Law Firm ("HM&P") represented by Managing Partner Nguyen Van Phuc, Partner Nguyen Ngoc Tra My and Senior Associate Nguyen Nhat Duong participated in a training for nearly 100 businesses with the theme "Protecting customer personal data in corporate branding" organized by The Saigon Times in collaboration with the Department of Industry and Trade of Ho Chi Minh City. This is an event in a series of activities to support businesses to win the Ho Chi Minh City Gold Brand Award, in order to equip the business community with the necessary knowledge and tools to adapt to the context of the Law on Personal Data Protection (PDP) 2025 will officially take effect from January 1, 2026.

Source: The Saigon Times

At the training, HM&P lawyers shared in-depth analysis of the new legal framework and key compliance requirements in the processing of client personal data, particularly in the areas of marketing and branding.

From "free resources" to "legal assets": data tied to lifecycle responsibility

Sharing at the training, Managing Partner Nguyen Van Phuc said that the legal framework on personal data processing has fundamentally changed the way businesses operate, personal data is no longer a "free resource" but has become a strictly protected "legal asset". This makes the collection, storage or use of customer information from online forms, marketing emails, images at the event to QR code scans are all considered acts of data processing and must comply with regulations.

Managing Partner Nguyen Van Phuc, HM&P Law Firm participated in the corporate training session. Source: The Saigon Times

Lawyer Phuc emphasized:

"Each round of information collection is now a legal transaction. Businesses must be responsible throughout the data lifecycle and have valid and transparent consent from customers. In addition, the mindset of "data is gold" also needs to be replaced with the mindset of "data is responsibility", because protecting personal data is not only a legal obligation but also part of the compliance culture and brand value of businesses in the digital age."

Core obligations that businesses need to meet

From the current regulations and new points of the Law on PDP 2025, HM&P has systematized 06 groups of key requirements:

• Valid consent: ask for specific opinions – transparency – can be proved; do not combine multiple purposes in one clause; Silence is not consent.
• Limit the retention period: define and notify the deadline in advance for each type of data; delete or anonymize upon expiration (e.g., promotional data is only stored for a certain period of time that is relevant to the purpose).
• Data processing agreements with third parties: when hiring agencies/advertisers (data processors), it is necessary to have a written contract clearly stating the purpose, scope, security measures and responsibilities when an incident occurs.
• Mandatory administrative procedures: assess the impact of data processing, report violations when detecting incidents, and evaluate when transferring data abroad at the request of competent authorities.
• Internal policy & personnel in charge: promulgating data protection regulations, strengthening internal security/periodic training, and appointing a Data Protection Officer (DPO) as the focal point.
• Conditional exemption: some procedures can be relaxed for micro, small, and start-up enterprises; The principles of confidentiality and proper processing remain mandatory, and no exemptions apply when processing sensitive or large volumes of data, or dealing with data processing services.

In addition, Lawyer Nguyen Ngoc Tra My also recommended that businesses should focus on signing data processing agreements with advertising units or technology partners, which clearly stipulates the scope, security measures and obligations to delete data after the end of the contract. Ms. My also emphasized the importance of internal security, requiring businesses to issue regulations on safe information sharing, periodic training for employees and appoint a DPO to ensure compliance with the law and prevent the risk of information leakage.

Partner Nguyen Ngoc Tra My, HM&P Law Firm. Source: The Saigon Times

Discussing the technical and legal aspects, Lawyer Nguyen Nhat Duong analyzed the issue of "de-identification" as one of the most complex legal and technical contents that businesses need to understand when implementing personal data management. According to Duong, data is only considered validly de-identified if three conditions are met: only if (i) it cannot be re-identified by any method, (ii) there is a process for periodic testing and evaluation, and (iii) there are technical and organizational measures in place to prevent re-identification, the new data is no longer personal data. If the conditions are not met, businesses must still fully comply with personal data protection regulations.

Senior Associate Nguyen Nhat Duong, HM&P Law Firm. Source: The Saigon Times

Marketing trends: from Big Data to Smart Data - building "data trust"

According to speakers and representatives of HM&P, the current trend is shifting from Big Data to Smart Data, focusing on purposeful collection, customer consent and transparent use. In the context of the gradual elimination of third-party cookies, businesses need to proactively build first-party data through voluntary forms of interaction. HM&P emphasized that "data trust" is becoming the new metric of brands, and transparency in data management is the foundation for strengthening credibility and sustainable development.

Representatives of HM&P with The Saigon Times. Source: The Saigon Times

HM&P's participation in the training provided the business community with a comprehensive perspective on the new legal framework in the field of PDP, and helped businesses become more aware of the role of compliance in branding and trust with customers. As a legal unit specializing in consulting in the field of personal and business data, HM&P affirms its commitment to continue supporting businesses to improve compliance capacity, build a secure and transparent data management system, thereby contributing to promoting a professional business environment sustainability and respect for personal privacy in Vietnam.

Read more:

Dữ liệu cá nhân của khách hàng: Ranh giới mong manh giữa marketing và vi phạm pháp luật

Doanh nghiệp cần làm gì trước khi Luật Bảo vệ dữ liệu cá nhân có hiệu lực?

‘Niềm tin dữ liệu’ trở thành thước đo mới của thương hiệu

Doanh nghiệp cần chuẩn bị gì khi Luật Bảo vệ dữ liệu cá nhân sắp có hiệu lực?