Pharmaceutical businesses need to comprehensively review their data policies

For the pharmaceutical industry, specifically for today's pharmacy chains, the stored data block is not just a type of transaction information between drug sellers and drug buyers, but also health data - a sensitive form of data under the new law and is required to be more strictly protected. However, there are gaps in the way pharmacies collect and separate their data management that can expose these businesses to legal risks even as they strive to demonstrate compliance with current laws.

Source: The Saigon Times

In January 2026, most major pharmacy chains such as FPT Long Chau, Pharmacity or An Khang have announced privacy and personal data protection  policies on their official websites[1]  to meet the requirements of compliance with the Law on Personal Data Protection 2025 ("Law on PDP 2025") which has just come into effect and Decree 356/2025/ND-CP ("Decree 356") issued on December 31, 2025 detailing a number of articles and measures to implement the Law on PDP 2025. However, it can be seen that there are still significant gaps, especially in the specific issues of the pharmaceutical industry - a field where personal data is not only associated with identifying information, but also directly related to the health, medical conditions and private life of each individual.

Health data is more than just "transactional information"

Through prescriptions, purchase history, pharmacist consultations, and customer care programs, businesses can hold a large amount of information that directly or indirectly reflects the health status of individual customers , not just names, phone numbers, or shipping addresses.

Decree 356 defines health data as sensitive personal data [2]that requires a higher level of protection than ordinary personal data. This entails a series of legal consequences such as stricter processing conditions, higher requirements for security measures, etc  as well as the accountability obligations of the data controller and processor. In fact, the fact that a health condition is listed as a sensitive personal data is not a new regulation, Decree 13/2023/ND-CP on personal data protection ("Decree 13") has also mentioned this issue.

However, when reviewing the current personal data protection policies of the above-mentioned pharmacy chains, it can be noticed that one common point is that health data has not been identified and processed as an independent group of sensitive personal data. The policies all list "personal information", "transaction information", and "customer information" without clearly separating what is basic data and what is health data that is sensitive data that needs to be applied with enhanced protection mechanisms. This approach carries significant legal risks.

First, businesses may have difficulty demonstrating that they have applied safeguards commensurate with the sensitive nature of their data. Decree 356 sets stricter regulations for businesses (data controllers or data controllers and processors) related to sensitive personal data.

This can be mentioned as the need to specifically notify the data subject that the collected personal data is sensitive personal data or the need for physical security measures for storage and transmission devices, encryption measures, anonymization of personal data and other security measures in the process of transferring sensitive personal data. When health data is homogenized into basic data, this boundary becomes blurred, and the biggest difficulties at this time are pharmaceutical companies - pharmacy chain owners.

Second, the failure to properly classify health data makes it difficult for the data subject's control to be guaranteed in practice. A customer who needs to access, correct, or restrict the processing of data related to his medical condition is almost impossible to know how to exercise that right if the policy does not clearly identify the type of data being processed. At this time, the "ball of responsibility" belongs to the pharmaceutical company, not the customer using the service.

The absence of a power enforcement mechanism

The Law on PDP 2025 puts the rights of data subjects at the center, with a series of specific rights such as the right to know, the right to consent, the right to withdraw consent, the right to access, the right to rectification, the right to erasure, the right to restrict processing, and the right to complain.[3] At the same time, Decree 356 has set out the obligation of the data controller, the party controlling and processing the personal data to develop clear processes, procedures and forms to exercise the rights of data subjects, ensuring that data subjects are aware of the procedures for exercising their rights.[4]

For the pharmaceutical industry, ensuring these rights is especially important because personal data is processed in close association with the private life and health of individuals. However, in personal data protection policies such as those of Long Chau, Pharmacity and An Khang, these rights are mainly listed as a principled commitment. What is missing is a mechanism for those rights to be enforced effectively and consistently.

For example, these policies do not clarify how customers can submit requests to exercise their rights, such as through which channels, whether a form is needed, how long the response period is, and which department is responsible for handling. These questions are operational, but they determine whether the data subject's rights are actually guaranteed. In the pharmaceutical industry, in particular, the right to erasure and the right to restrict data processing often pose complex legal situations.

Source: The Saigon Times

On the one hand, customers have the right to request the deletion of personal data once the purpose of processing has been achieved. On the other hand, enterprises are obliged to store certain information according to specialized regulations, serving inspection, traceability or legal liability. Without a clear framework for handling these conflicts, it is easy for businesses to fall into a passive position when receiving requests from customers, and at the same time, the interests of customers (data subjects) may not be guaranteed.

Decree 13 has been replaced: a comprehensive review of data policy is needed

In the early stages of the legal framework for personal data protection, Decree 13 serves as a foundational document. Many enterprises have developed personal data protection policies based on the provisions of this decree. However, with the Law on PDP 2025 and Decree 356 officially taking effect, Decree 13 has been replaced. Decree 356 has also been issued and not only inherits the spirit of Decree 13, but also concretizes many new obligations, reflecting a more rigorous and systematic approach to personal data protection.

For pharmaceutical businesses, this means that the policies issued in the past, if only based on Decree 13, are likely to no longer be in line with the current legal framework, for example, the contents mentioned above. In this context, a comprehensive review of the promulgated personal data protection policies is an urgent requirement for businesses, especially those in the pharmaceutical sector, where personal data is required to be strictly protected.

It can be seen that pharmacies such as FPT Long Chau, Pharmacity or An Khang... are all pharmacies accounting for a very large market share in the market today. They are also leading businesses in promulgating policies on protecting customers' personal data. This proves the special attention of these businesses to the protection of customers' personal data.

However, in order for these policies to really be effective in practice, both as a solution to comply with the law for businesses, and to create transparent and progressive mechanisms in the processing of personal data, pharmaceutical enterprises need to more thoroughly assess the specificity of personal data in the pharmaceutical industry.  thereby revising/promulgating more appropriate and substantive personal data protection policies to not only ensure the brand reputation of the business but also fully enforce the rights of consumers.

Lawyer Nguyen Nhat Duong

HM&P Law Firm

Read more: Doanh nghiệp kinh doanh dược cần rà soát toàn diện chính sách dữ liệu