Law on Personal Data Protection takes effect: FPT shares 5 key requirements for businesses
The Law on Personal Data Protection (Law No. 91/2025/QH15), officially effective from January 1, 2026, introduces new requirements for businesses in data governance, covering the collection, processing, and protection of personal data and information assets. To help the business community stay updated on legal requirements and share practical implementation experience, the Office of the Employer Representative under the Vietnam Chamber of Commerce and Industry (VCCI) organized a training workshop titled “Human Resource Management in the Digital Age,” with a dedicated session on “Protecting Personal Data and Corporate Information Assets.” At the event, FPT experts shared five key requirements that businesses need to meet to implement and comply with the Law, while also introducing technology solutions to support the process.
The training workshop “Human Resource Management in the Digital Age,” with the session “Protecting Personal Data and Corporate Information Assets,” was held on August 6 in Phu Tho.
Passed by the National Assembly on June 26, 2025, the Law on Personal Data Protection is Vietnam’s first comprehensive legislation on personal data protection. The Law clarifies the rights of data subjects as well as the responsibilities of agencies, organizations, and businesses throughout the process of collecting, storing, using, sharing, and processing data. The enactment of the Law is expected to enhance transparency, strengthen the protection of citizens’ privacy, and promote the development of a safe and trusted digital environment.
Speaking at the opening of the program, Mr. Nguyễn Văn Cường, Standing Vice Chairman of the Phu Tho Provincial Business Association, emphasized that the Law on Personal Data Protection introduces new requirements for corporate governance. As digital transformation continues to accelerate, keeping up to date with legal regulations, raising awareness, and proactively implementing data protection solutions will help businesses minimize risks, safeguard information assets, and strengthen their competitiveness. Against this backdrop, the workshop was structured into two sessions, combining updates on the legal framework with practical implementation experience.
Mr. Bach Trong Đuc – National Cybersecurity Association – introduces key provisions of the Law on Personal Data Protection.
At Session 1, Mr. Bach Trong Đuc, a personal data protection expert from the National Cybersecurity Association, introduced key provisions of the Law on Personal Data Protection, including regulations on data protection in recruitment, management, and employment; the responsibilities of agencies, organizations, and businesses in data processing; and an analysis of legal risks that businesses may face if they fail to fully comply with the new requirements. These insights helped businesses gain a clearer understanding of changes to the legal framework and the requirements that need to be implemented in their data governance activities.
Following the legal framework update, Session 2 focused on implementation solutions for businesses. FPT representatives presented the session “Implementing Compliance with the Law on Personal Data Protection: 5 Key Requirements for Businesses and Supporting Technology Solutions,” highlighting five core requirements for effective implementation: correctly defining the purposes of data processing; managing data subject consent transparently and in a demonstrable manner; ensuring data subject rights; managing sensitive personal data; and establishing data storage, monitoring, and governance mechanisms that meet regulatory requirements.
According to Mr. Le Thanh Bac, Director of IDA Project, FPT Corporation, the biggest challenge today lies not in understanding the Law’s requirements, but in the ability to implement them consistently across the entire organization. Many businesses still manage data and customer consent across multiple systems, such as websites, mobile applications, CRM platforms, and direct forms. This can lead to a lack of consistency, difficulties in proving data subjects’ consent, and challenges in handling requests to modify, restrict, or withdraw consent. Therefore, compliance should be viewed as a comprehensive governance program that combines processes, people, and technology.
Mr. Le Thanh Bac – FPT – shares five core requirements for businesses to effectively implement the Law on Personal Data Protection.
These insights were developed by FPT based on more than 37 years of experience working alongside government agencies, financial institutions, and businesses across key sectors in implementing digital transformation, data governance, and information security projects. Building on this foundation, FPT has developed an ecosystem of solutions to help businesses meet data governance and regulatory compliance requirements under Vietnamese regulations as well as international standards, while establishing implementation roadmaps tailored to the specific characteristics of each organization.
The consent and data privacy management platform developed by FPT attracted significant interest from business representatives.
One of the key solutions introduced at the workshop was the FPT Consent Management Platform (CMP), a consent and data privacy management platform developed by FPT. Built based on the Law on Personal Data Protection, No. 91/2025/QH15, Decree No. 356/2025/ND-CP, and FPT’s experience in implementing standards such as GDPR and ISO 27001, FPT Consent Management Platform enables businesses to centrally manage the entire consent lifecycle, from consent collection, storage, and proof of consent to the management of data subject requests across both digital and traditional channels. The platform also maintains a comprehensive processing history, helping businesses prepare for inspections and audits and meet requests from regulatory authorities.
In addition to supporting compliance requirements, FPT Consent Management Platform is designed to integrate with existing business systems such as CRM, ERP, DMS, and cloud computing platforms. This enables businesses to centrally manage customer data and consent, strengthen coordination among legal, IT, and business functions, and minimize operational risks and disruptions. According to FPT, as the Law on Personal Data Protection has come into effect, a consent management platform is no longer merely a supporting tool but is becoming essential data governance infrastructure for businesses that process personal data.
The consent management platform is no longer merely a supporting tool but is becoming essential data governance infrastructure for businesses.
Mr. Le Thanh Bac of FPT Corporation shared: “What matters is not how much data a business possesses, but how that data is governed. By establishing a transparent governance mechanism with the ability to control and demonstrate compliance throughout the entire data processing lifecycle, businesses will not only meet the requirements of the Law on Personal Data Protection but also strengthen their governance capabilities, build customer trust, and create a foundation for sustainable growth.”
Post-event discussion session, where experts answered questions and shared practical experience in implementing compliance with the Personal Data Protection Law in businesses.
The program concluded with a discussion session in which experts and delegates exchanged views on models for organizing personal data protection functions, identifying risks in the management of data and information assets, and sharing practical implementation experience within businesses. As the Law on Personal Data Protection enters its implementation phase, the combination of a clear legal framework, practical implementation experience, and technology solutions is expected to help businesses accelerate compliance, strengthen data governance capabilities, and build a foundation for sustainable growth in the digital economy.
