In the digital economy, a person's location data tells a lot of things, from where they are, where they live and work, who they often meet, what habits they move into, and what behavioral groups they may belong to. Location data from this perspective has the highest commercial value for businesses, and is also one of the types of data with the greatest privacy risk from a consumer perspective.
The challenge for tech businesses lies in the fact that they can hardly function without location data.
With technology platforms such as Grab, Be, Xanh SM, ShopeeFood or Fast Delivery, location data is not just a type of technical information. This is the "nervous system" of the digital business model, because all activities of matching, routing, delivery, estimated time of arrival, anti-fraud and operational management are directly dependent on real-time positioning capabilities.
Location data: from operational tools to sensitive data
Decree 356/2025/ND-CP details the Law on Personal Data Protection 2025 (“Law on PDP”) on location data of individuals collected through location services as sensitive personal data. Any collection, storage, analysis, sharing, or transfer of location data is subject to higher requirements from the data processing facility; notice and consent; retention, control and security; to impact assessment of data processing and incident response. An individual's location data falls under the category of data that requires special control.
The challenge for tech businesses lies in the fact that they can hardly function without location data. A ride-hailing app must know exactly where the customer and driver are for matchmaking. A food delivery platform needs to track the shipper's location in real time to optimize the delivery route. A logistics company must constantly locate vehicles, warehouses, and delivery statuses.
In other words, location data is not only an operational support tool, but also the core of revenue generation. This puts the business in a very unique situation: while the law requires minimizing collection and limiting the purpose of processing, the business model needs accurate, continuous and real-time data.
"Agree" means "use or not use"
In the past, many businesses tended to consider the fact that users clicked "Agree" as an almost absolute legal basis for data processing. However, under Vietnam's new legal framework for personal data protection, this approach is increasingly exposed to risks.
For location data, the key question is not only "whether the user consents", but also: whether the user is fully informed; whether the consent is truly voluntary; and whether the business is forcing users to accept in the form of "agree or cannot use the service".
In many cases, the "consent" mechanism can in fact become a form of "take it or leave it," where users are forced to accept the sharing of location data if they want to continue using the service. This makes the line between "voluntary consent" and "conditional consent" increasingly sensitive from a legal perspective.
Risks of data reuse
One of the most complex legal issues for location data lies in the fact that it is often not used for a single purpose.
In practice, location data may initially be collected for routing or delivery routing, but then continues to be used for: (i) user behavior analysis; (ii) driver performance evaluation; (iii) behavioral advertising; up to (iv) predicting market demand; even (v) training the AI system.
From a technical and operational perspective, such reuse helps businesses significantly optimize data costs and improve algorithms. However, from a legal perspective, this is an area where there is a huge compliance risk if the purpose of the processing extends beyond the scope for which the data subject was notified or could have expected or been initially known.
.jpg)
The problem now is no longer "keep or not keep", but what data is kept, at what level of granularity, who is accessed and for how long.
The longer it is stored, the riskier it is
Tech businesses always tend to want to keep data for as long as possible. Because the customer's location data history helps businesses in resolving disputes; fraud investigation; forecasting market demand; improve the routing system and more.
Meanwhile, the law protecting personal data goes in the opposite direction: data should only be kept for as long as is necessary for the purposes of the processing. This creates a huge pressure on ride-hailing platforms today, not only in Vietnam but globally.
If businesses keep location history for too long, legal and security risks will increase significantly. Not only does the risk of data leakage increase, but businesses can also be seen as processing data beyond the intended purpose or beyond the time required for the initial processing.
But if the business cancels, delete this data too soon. At that time, businesses may lose data proving delivery; as well as the loss of a basis for settling complaints; or impair the ability to resist fraud in the course of business.
The problem now is no longer "keep or not keep", but what data is kept, at what level of granularity, who is accessed and for how long.
Risk of leaking travel history
Among today's types of personal data, location data may not be as "visually sensitive" as financial data or medical records, but it is the type of data that is capable of recreating a person's personal life in the most comprehensive way. For technology platforms such as ride-hailing, food delivery or logistics, this risk is especially great because businesses do not only hold a single location point, but often capture the entire "flow of movement" of users in real time or according to long-term history.
This is also why many personal data protection agencies around the world consider the breach of location data to be one of the most serious privacy incidents. Ubeeqo International, a French car-sharing and short-term car rental company, was fined 175,000 euros by the French Data Protection Authority (CNIL) in July 2022. The penalties were imposed due to numerous violations of the General Data Protection Regulation (GDPR), mainly related to excessive collection of user location data.
The CNIL emphasizes that tracking and storing geolocation data in too much detail can lead to the risk of surveillance of personal lives beyond what is necessary(1).
Transferring data abroad: a major bottleneck for technology businesses
Most technology businesses today use: (1) international cloud storage services; (2) foreign service providers; (3) global AI system; (4) data centers located outside Vietnam. This means that location data is very susceptible to data transfers abroad.
But under the current legal framework, this activity entails a series of obligations for businesses in the process of operation such as assessing the impact of data transfer, controlling data recipients, or developing and preparing plans to protect this type of data. This is currently one of the points that make many technology businesses in Vietnam face the biggest difficulties in reality.
In the near future, the competitiveness of technology businesses will not only lie in algorithms, delivery speed or market expansion, but also in the ability to build a transparent, minimized and responsible data processing model.
According to Vietnam's new legal framework, location data is no longer a "free resource" for businesses to freely exploit. This is becoming a type of data with a very high level of legal and privacy risk, requiring businesses to change from a "collect as much as possible" mindset to "only process what is really necessary and accountable". For application platform businesses, the problem of compliance will no longer be about fixing a security policy, but about redesigning the entire way data is collected, used, stored, and shared in the digital ecosystem that they hold.
Lawyer Nguyen Van Phuc
HM&P Law Firm
Read more:
Nghịch lý dữ liệu vị trí cá nhân - Phần 1: Giá trị thương mại cao nhất
Nghịch lý dữ liệu vị trí cá nhân - Phần 2: rủi ro riêng tư lớn nhất
.png)
+84 28 7308 0839.png)
hmplaw.vn
