{"id":13812,"date":"2026-01-22T13:50:00","date_gmt":"2026-01-22T06:50:00","guid":{"rendered":"https:\/\/cdlaf.vn\/?p=13812"},"modified":"2026-01-22T13:52:17","modified_gmt":"2026-01-22T06:52:17","slug":"artificial-intelligence-ai-and-personal-data-rights","status":"publish","type":"post","link":"https:\/\/cdlaf.vn\/en\/artificial-intelligence-ai-and-personal-data-rights\/","title":{"rendered":"Artificial Intelligence (AI) and Personal Data Rights"},"content":{"rendered":"<p><em>The development of artificial intelligence (\u201cAI\u201d) has had an impact on many aspects of social life. However, the <\/em><em>development and widespread use of AI<\/em><em> and the widespread use of social networks may pose risks to the right to privacy in general and to personal data in particular, as a large volume of data used by these technologies is directly derived from users\u2019 personal information.<\/em><\/p>\n<p><em>In response to the potential risks posed by AI, Vietnam has promulgated the Law on Personal Data Protection, effective from 01 January 2026 (the \u201c<strong>PDP Law<\/strong>\u201d). This Law establishes core principles governing the processing of personal data, sets out a unified legal framework for the collection, processing, storage, sharing, and transfer of personal data, and strengthens the responsibilities of organizations and individuals in safeguarding the lawful rights and interests of data subjects.<\/em><\/p>\n<p><em>Within the scope of this article, CDLAF focuses on clarifying several key issues concerning the relationship between the application of AI and personal data rights under the PDP Law, including: (i) Principles of Personal Data Protection in AI Systems under the PDP Law; (ii) Specification of Personal Data Protection in AI Systems under Decree No. 356\/2025\/ND-CP; and (iii) The Relationship between the PDP Law and the Law on Artificial Intelligence.<\/em><\/p>\n<figure id=\"attachment_13790\" aria-describedby=\"caption-attachment-13790\" style=\"width: 711px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"size-medium wp-image-13790\" src=\"http:\/\/cdlaf.vn\/wp-content\/uploads\/2026\/01\/pexels-googledeepmind-18069695-711x400.jpg\" alt=\"\" width=\"711\" height=\"400\" srcset=\"https:\/\/cdlaf.vn\/wp-content\/uploads\/2026\/01\/pexels-googledeepmind-18069695-711x400.jpg 711w, https:\/\/cdlaf.vn\/wp-content\/uploads\/2026\/01\/pexels-googledeepmind-18069695-1400x788.jpg 1400w, https:\/\/cdlaf.vn\/wp-content\/uploads\/2026\/01\/pexels-googledeepmind-18069695-768x432.jpg 768w, https:\/\/cdlaf.vn\/wp-content\/uploads\/2026\/01\/pexels-googledeepmind-18069695-1536x864.jpg 1536w, https:\/\/cdlaf.vn\/wp-content\/uploads\/2026\/01\/pexels-googledeepmind-18069695-2048x1152.jpg 2048w\" sizes=\"auto, (max-width: 711px) 100vw, 711px\" \/><figcaption id=\"caption-attachment-13790\" class=\"wp-caption-text\">Source: pexels-googledeepmind-18069695<\/figcaption><\/figure>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_82_2 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of contents:<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #a32411;color:#a32411\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #a32411;color:#a32411\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/cdlaf.vn\/en\/artificial-intelligence-ai-and-personal-data-rights\/#1_Principles_of_Personal_Data_Protection_in_AI_Systems_under_the_PDP_Law\" >1. Principles of Personal Data Protection in AI Systems under the PDP Law<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/cdlaf.vn\/en\/artificial-intelligence-ai-and-personal-data-rights\/#2_Specification_of_Personal_Data_Protection_in_AI_Systems_under_Decree_No_3562025ND-CP\" >2. Specification of Personal Data Protection in AI Systems under Decree No. 356\/2025\/ND-CP<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/cdlaf.vn\/en\/artificial-intelligence-ai-and-personal-data-rights\/#3_The_Relationship_between_the_PDP_Law_and_the_Law_on_Artificial_Intelligence\" >3. The Relationship between the PDP Law and the Law on Artificial Intelligence<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/cdlaf.vn\/en\/artificial-intelligence-ai-and-personal-data-rights\/#SEND_CONSULTATION_REQUEST\" >SEND CONSULTATION REQUEST<\/a><\/li><\/ul><\/nav><\/div>\n<h2><span class=\"ez-toc-section\" id=\"1_Principles_of_Personal_Data_Protection_in_AI_Systems_under_the_PDP_Law\"><\/span>1. Principles of Personal Data Protection in AI Systems under the PDP Law<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The PDP Law establishes fundamental principles governing all personal data processing activities, including the development and use of AI systems. Accordingly, the collection and processing of personal data must comply with the following basic principles:<\/p>\n<ul>\n<li>The processing of personal data in an AI environment must comply with the PDP Law and other relevant laws and regulations, and must be consistent with Vietnam\u2019s ethical standards and traditional customs;<\/li>\n<li>AI-based systems and services must incorporate appropriate personal data security measures; appropriate authentication, identification, and access control mechanisms must be applied in personal data processing;<\/li>\n<li>Personal data processing by AI must be classified according to risk levels in order to apply appropriate personal data protection measures;<\/li>\n<li>AI systems that use personal data must not be used or developed in a manner that harms national defense, national security, public order and safety, or infringes upon the life, health, honor, dignity, or property of others.<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"2_Specification_of_Personal_Data_Protection_in_AI_Systems_under_Decree_No_3562025ND-CP\"><\/span>2. Specification of Personal Data Protection in AI Systems under Decree No. 356\/2025\/ND-CP<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>In parallel with the PDP Law, Decree No. 356\/2025\/ND-CP further specifies the protection of personal data throughout the design, deployment, and operation of AI systems. Accordingly, personal data protection in AI systems is not limited to the data collection stage but must be ensured throughout the entire data processing lifecycle, from data input and model training to algorithm operation and the exploitation of output results.<\/p>\n<p>Specifically, Article 10 of Decree No. 356\/2025\/ND-CP provides that:<\/p>\n<p><strong>Organizations and individuals <\/strong>are entitled to use personal data for the research and development of AI systems and other automated systems, provided that compliance with personal data protection regulations is ensured.<\/p>\n<p><strong>Data derived from AI inference results <\/strong>that can be used to identify, or help identify, a specific individual must be subject to personal data protection measures in accordance with the law.<\/p>\n<p><strong>Personal data controllers and personal data controllers and processors <\/strong>are responsible for informing data subjects of automated personal data processing activities, explaining the operating principles of the algorithms and their impacts on the lawful rights and interests of data subjects, and providing options for data subjects to opt out.<\/p>\n<p><strong>Organizations and individuals applying personal data protection <\/strong>measures in AI systems shall:<\/p>\n<ul>\n<li><em>Research, develop, and deploy systems that meet cybersecurity standards and comprehensive data protection standards for AI systems, with particular attention to information security, algorithm reliability, system stability, and cyberattack prevention;<\/em><\/li>\n<li><em>Establish mechanisms for monitoring AI system operations from two perspectives: supervision by competent state authorities, and accountability to personal data subjects by personal data controllers and personal data controllers and processors;<\/em><\/li>\n<li><em>Develop personal data protection mechanisms in accordance with appropriate standards, and establish monitoring systems and early-warning mechanisms for cybersecurity risks;<\/em><\/li>\n<li><em>Establish control mechanisms to prevent the misuse of AI and virtual environments for activities that infringe upon national security, public order, and public safety;<\/em><\/li>\n<li><em>Conduct periodic compliance assessments with personal data protection regulations at least once per year;<\/em><\/li>\n<li><em>Ensure that personal data subjects have the right to rectify, anonymize, and delete identification records, including in cases where platforms store behavioral history data.<\/em><\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"3_The_Relationship_between_the_PDP_Law_and_the_Law_on_Artificial_Intelligence\"><\/span>3. The Relationship between the PDP Law and the Law on Artificial Intelligence<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Alongside the promulgation of the PDP Law, the Law on Artificial Intelligence (the \u201c<strong>AI Law<\/strong>\u201d) has also been enacted and officially takes effect from 01 March 2026, reflecting Vietnam\u2019s trend toward a risk-based approach to AI governance, consistent with many international legal models.<\/p>\n<p>Under this approach, AI systems used in sectors such as finance, banking, credit information services, and advertising\u2014where large volumes of users and personal data are processed\u2014are considered to pose higher legal risks, particularly systems that directly affect individuals\u2019 lawful rights and interests, such as credit scoring, customer ranking, automated credit decisions, or fraud detection. These systems are therefore subject to stricter regulatory requirements, with personal data protection identified as a key pillar closely linked to transparency, accountability, and algorithmic control.<\/p>\n<p><strong>Notable points of intersection between the PDP Law and the AI Law include:<\/strong><\/p>\n<p><strong><em>First<\/em><\/strong>, principles governing personal data protection and AI activities<\/p>\n<p>Although Article 4 of the AI Law and Article 3 of the PDP Law regulate different areas, they reflect a consistent legislative spirit of placing human beings, human rights, and individuals\u2019 lawful interests at the center of technological development and application. Accordingly, AI principles emphasize the protection of privacy, data security, and human responsibility in controlling AI systems, while personal data protection principles require legal compliance, accuracy, security, and purpose limitation in data usage. This convergence demonstrates that the processing and use of personal data in AI activities must simultaneously comply with both personal data protection principles and the fundamental principles governing AI activities.<\/p>\n<p><strong><em>Second<\/em><\/strong>, the obligation to classify risk levels<\/p>\n<p>Clause 4, Article 30 of the PDP Law requires that personal data processing by AI be classified according to risk levels to enable appropriate personal data protection measures. These risk levels are further specified in Clause 1, Article 9 of the AI Law, including:<\/p>\n<ul>\n<li>High-risk AI systems: systems that may cause significant harm to life, health, lawful rights and interests of organizations or individuals, national interests, public interests, or national security;<\/li>\n<li>Medium-risk AI systems: systems that may mislead, influence, or manipulate users due to users\u2019 inability to recognize that they are interacting with an AI system or AI-generated content;<\/li>\n<li>Low-risk AI systems: systems that do not fall under the above categories.<\/li>\n<\/ul>\n<p><strong><em>Third<\/em><\/strong>, prohibited acts<\/p>\n<p>Article 7 of the AI Law prohibits the collection, processing, or use of personal data for the development, training, testing, or operation of AI systems in violation of personal data protection regulations. In addition, Article 30 of the PDP Law prohibits the use or development of AI systems that use personal data to harm national defense, national security, public order and safety, or infringe upon the life, health, honor, dignity, or property of others.<\/p>\n<p>Accordingly, both the PDP Law and the AI Law share a common legislative intent: strictly prohibiting the use of personal data for the development, training, testing, or operation of AI systems where such use does not comply with legal requirements. In the context where personal data constitutes a critical input for AI systems, these two laws jointly establish In the context where both the PDP Law and the AI Law will be concurrently applied from 2026, enterprises need to proactively prepare at an early stage to avoid high-risk data processing activity. Deploying AI solutions without integrating personal data governance may result in widespread legal violations, particularly as regulatory authorities intensify supervision and accountability requirements. Therefore, rather than viewing AI purely as a technological solution, enterprises should regard AI as a high-risk data processing activity requiring close coordination among technology, legal, and risk management functions. This approach not only helps ensure legal compliance but also contributes to building customer trust and promoting sustainable development in the digital era.<\/p>\n<ul>\n<li>\n<h4><strong>Advisory email<\/strong> info@cdlaf.vn<\/h4>\n<\/li>\n<li>\n<h4><strong>Hotline:<\/strong> (+84) 909 668 216<\/h4>\n<\/li>\n<\/ul>\n<p><strong><em>Time<\/em><\/strong><strong><em> of writing<\/em><\/strong><em>: 02\/01\/2026<\/em><\/p>\n<p><em>The article contains general information which is of reference value, in case you want to receive legal opinions on issues you need clarification on, please get in touch with our Lawyer \u00a0at\u00a0 <a href=\"https:\/\/mail.google.com\/mail\" target=\"_blank\" rel=\"noopener\"><strong>info@cdlaf.vn<\/strong><\/a><\/em><\/p>\n<div class=\"content-post-nd\">\n<div style=\"text-align: center;\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-5519 size-full aligncenter\" src=\"http:\/\/cdlaf.vn\/wp-content\/uploads\/2023\/05\/CHUONG-TRINH-THANG.png\" alt=\"\" width=\"1080\" height=\"600\" srcset=\"https:\/\/cdlaf.vn\/wp-content\/uploads\/2023\/05\/CHUONG-TRINH-THANG.png 1080w, https:\/\/cdlaf.vn\/wp-content\/uploads\/2023\/05\/CHUONG-TRINH-THANG-720x400.png 720w, https:\/\/cdlaf.vn\/wp-content\/uploads\/2023\/05\/CHUONG-TRINH-THANG-768x427.png 768w\" sizes=\"auto, (max-width: 1080px) 100vw, 1080px\" \/><\/div>\n<\/div>\n<div class=\"content-post-nd\">\n<p><strong>Why choose CDLAF\u2019s service?<\/strong><\/p>\n<ul class=\"li-content\">\n<li>We provide effective and comprehensive legal solutions that help you save money and maintain compliance in your business;<\/li>\n<li>We continue to monitor your legal matters even after the service is completed and update you when there are any changes in the Vietnamese legal system;<\/li>\n<li>Our system of forms and processes related to labor and personnel is continuously built and updated and will be provided as soon as the customer requests it;<\/li>\n<li>As a Vietnamese law firm, we have a thorough understanding of Vietnam&#8217;s legal regulations, and grasp the psychology of employees, employers, and working methods at competent authorities;<\/li>\n<li>CDLAF&#8217;s team of lawyers has many years of experience in the field of labor and enterprises, as well as human resources and financial advisory.<\/li>\n<li>Strict information security procedures throughout the service performance and even after the service is completed.<\/li>\n<\/ul>\n<\/div>\n<p><strong style=\"color: #a32411;\">You can refer for more information:<\/strong><\/p>\n<ul>\n<li><a href=\"https:\/\/cdlaf.vn\/en\/internal-control-responsibilities-and-data-sharing-within-organizations\/\">Internal control responsibilities and data sharing within organizations<\/a><\/li>\n<li><a href=\"https:\/\/cdlaf.vn\/en\/personal-data-protection-personnel-under-decree-356-in-house-implementation-or-hiring-professional-external-services\/\">Personal data protection Personnel under Decree 356: In-house Implementation or Hiring Professional External Services?<\/a><\/li>\n<li><a href=\"https:\/\/cdlaf.vn\/en\/conditions-for-the-transfer-of-data-to-partners-to-be-considered-valid\/\">Conditions for the transfer of data to partners to be considered \u201cvalid\u201d<\/a><\/li>\n<li><a href=\"https:\/\/cdlaf.vn\/en\/regulations-regarding-personal-data-under-current-personal-data-protection-law\/\">Regulations regarding Personal Data under current Personal Data Protection Law<\/a><\/li>\n<li><a href=\"https:\/\/cdlaf.vn\/en\/data-and-legal-considerations-in-outsourcing-contracts-part-1\/\">Data and Legal Considerations in Outsourcing Contracts (Part 1)<\/a><\/li>\n<\/ul>\n\n<div class=\"wpcf7 no-js\" id=\"wpcf7-f2681-o1\" lang=\"en-US\" dir=\"ltr\" data-wpcf7-id=\"2681\">\n<div class=\"screen-reader-response\"><p role=\"status\" aria-live=\"polite\" aria-atomic=\"true\"><\/p> <ul><\/ul><\/div>\n<form action=\"\/en\/wp-json\/wp\/v2\/posts\/13812#wpcf7-f2681-o1\" method=\"post\" class=\"wpcf7-form init\" aria-label=\"Contact form\" novalidate=\"novalidate\" data-status=\"init\">\n<fieldset class=\"hidden-fields-container\"><input type=\"hidden\" name=\"_wpcf7\" value=\"2681\" \/><input type=\"hidden\" name=\"_wpcf7_version\" value=\"6.1.5\" \/><input type=\"hidden\" name=\"_wpcf7_locale\" value=\"en_US\" \/><input type=\"hidden\" name=\"_wpcf7_unit_tag\" value=\"wpcf7-f2681-o1\" \/><input type=\"hidden\" name=\"_wpcf7_container_post\" value=\"0\" \/><input type=\"hidden\" name=\"_wpcf7_posted_data_hash\" value=\"\" \/>\n<\/fieldset>\n<h2 class=\"tt-form\"><span class=\"ez-toc-section\" id=\"SEND_CONSULTATION_REQUEST\"><\/span>SEND CONSULTATION REQUEST\n<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><label>Full name<\/label><br \/>\n<span class=\"wpcf7-form-control-wrap\" data-name=\"full-name\"><input size=\"40\" maxlength=\"400\" class=\"wpcf7-form-control wpcf7-text wpcf7-validates-as-required\" aria-required=\"true\" aria-invalid=\"false\" value=\"\" type=\"text\" name=\"full-name\" \/><\/span><br \/>\n<label>Email<\/label><br \/>\n<span class=\"wpcf7-form-control-wrap\" data-name=\"email\"><input size=\"40\" maxlength=\"400\" class=\"wpcf7-form-control wpcf7-email wpcf7-validates-as-required wpcf7-text wpcf7-validates-as-email\" aria-required=\"true\" aria-invalid=\"false\" value=\"\" type=\"email\" name=\"email\" \/><\/span><br \/>\n<label>Phone Number<\/label><br \/>\n<span class=\"wpcf7-form-control-wrap\" data-name=\"phone\"><input size=\"40\" maxlength=\"400\" class=\"wpcf7-form-control wpcf7-tel wpcf7-text wpcf7-validates-as-tel\" aria-invalid=\"false\" value=\"\" type=\"tel\" name=\"phone\" \/><\/span><br \/>\n<label>Message<\/label><br \/>\n<span class=\"wpcf7-form-control-wrap\" data-name=\"coment\"><textarea cols=\"40\" rows=\"10\" maxlength=\"2000\" class=\"wpcf7-form-control wpcf7-textarea\" aria-invalid=\"false\" name=\"coment\"><\/textarea><\/span><br \/>\n<input class=\"wpcf7-form-control wpcf7-submit has-spinner btn-yellow\" type=\"submit\" value=\"Send\" \/>\n<\/p><div class=\"wpcf7-response-output\" aria-hidden=\"true\"><\/div>\n<\/form>\n<\/div>\n\n","protected":false},"excerpt":{"rendered":"<p>The development of artificial intelligence (\u201cAI\u201d) has had an impact on many aspects of social life. However, the development and widespread use of AI and the widespread use of social networks may pose risks to the right to privacy in general and to personal data in particular, as a large volume of data used by&#8230;<\/p>\n","protected":false},"author":4,"featured_media":13790,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[64],"tags":[],"class_list":["post-13812","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-articles"],"acf":[],"_links":{"self":[{"href":"https:\/\/cdlaf.vn\/en\/wp-json\/wp\/v2\/posts\/13812","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cdlaf.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cdlaf.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cdlaf.vn\/en\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/cdlaf.vn\/en\/wp-json\/wp\/v2\/comments?post=13812"}],"version-history":[{"count":2,"href":"https:\/\/cdlaf.vn\/en\/wp-json\/wp\/v2\/posts\/13812\/revisions"}],"predecessor-version":[{"id":13814,"href":"https:\/\/cdlaf.vn\/en\/wp-json\/wp\/v2\/posts\/13812\/revisions\/13814"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cdlaf.vn\/en\/wp-json\/wp\/v2\/media\/13790"}],"wp:attachment":[{"href":"https:\/\/cdlaf.vn\/en\/wp-json\/wp\/v2\/media?parent=13812"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cdlaf.vn\/en\/wp-json\/wp\/v2\/categories?post=13812"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cdlaf.vn\/en\/wp-json\/wp\/v2\/tags?post=13812"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}