Consumer information has become an important data resource for business activities, particularly in e-commerce and online advertising. However, this has also increased the risk of data being used for unintended purposes, unlawfully disclosed or traded to facilitate fraudulent activities.
The further data travels, the lower the level of protection
A consumer in Ha Noi downloads a shopping application from a platform headquartered overseas, registers using a phone number, enters an address and links a payment card. Within just a few minutes, this information reaches the platform’s server in another country before being transferred to a seller in a third country, a delivery service provider and a payment processor. At the same time, the application records which products the consumer has viewed and how long they have spent looking at them.
Several months later, the consumer receives a fraudulent phone call in which the caller correctly identifies an item they have just purchased. However, the consumer does not know whom to contact, which country’s laws apply or who is liable for compensation if the data is leaked. In reality, this type of risk is far from insignificant. In the first quarter of 2026 alone, more than 6.9 million user accounts in Viet Nam were leaked. Nguyen Manh Tung, a resident of Hai Phong, expressed his concern: “When consumers’ personal data, including mine, leaves Viet Nam, to what extent does Vietnamese law protect us, and what tools do we still have to protect ourselves?”
As data subjects, consumers are entitled to all the rights provided for under the Law on Personal Data Protection, including the right to be informed, the right to give and withdraw consent, and the right to have their data corrected or deleted, as well as the rights to information protection under the Law on Protection of Consumer Rights. These rights must be equally guaranteed, regardless of whether the data is processed domestically or transferred overseas. However, most of these rights do not raise any specific issues when data crosses national borders.
One example is the right to be notified of a personal data breach. Suppose a service provider’s server overseas is attacked, resulting in the exposure of data belonging to hundreds of thousands of Vietnamese customers of an e-commerce platform. In this case, consumers’ right to be notified can only be guaranteed if an entire chain of notification obligations is put into operation and the law requires that the data subjects themselves be notified.
At present, this obligation applies only in certain cases, such as incidents involving biometric data, location data and sensitive data in the finance, banking and credit information sectors. A leak involving names, phone numbers, addresses and purchase histories does not fall into these categories. As a result, consumers have no right to be notified and, when an incident occurs overseas, may never know that their data has been exposed.
Doctor Nguyen Ngoc Quyen of the Faculty of Economic Law at Ha Noi Law University explained that, from the consumer’s perspective, there are three ways in which data can be transferred overseas. First, data is collected directly when consumers use an application or website operated by a foreign business and is sent straight to that business’s server. Second, a domestic business collects data and then stores it overseas, hires a foreign entity to process it, or shares it with its parent company or overseas partners. Third, in a cross-border order, the platform, seller, delivery service provider and payment processor each retain part of the data in different countries.
Vietnamese law already provides instruments governing all three methods of cross-border data transfer, including the Law on Personal Data Protection, the Law on Protection of Consumer Rights and the Law on E-commerce. However, the level of protection decreases as data travels further. When a domestic business transfers data overseas, consumers’ rights accompany the data through the chain of contracts, but the assessment of the recipient country is still limited to the measures taken by the receiving party, without taking into account the laws of that country. When data passes through a chain involving multiple parties, consumers must identify the party at fault themselves, as there is not yet a legal framework for joint controllership and joint liability.
Doctor Nguyen Ngoc Quyen said that the common feature of the above issues was that, although rights had been fairly comprehensively recognised, the mechanisms enabling consumers’ data rights to remain protected when data is transferred overseas were still lacking. To ensure that these mechanisms operate effectively, specific guiding documents are needed, and the possibility of amending and supplementing the Law on Personal Data Protection should also be considered.
Difficulties in addressing violations of consumers’ personal data
Numerous violations have occurred in recent years, including the use of customer information for advertising beyond the scope previously notified to customers, the trading of customer data through multiple intermediary organisations, and data leaks from e-commerce platform systems. Although the legal framework for handling violations involving consumer information has been strengthened, practical enforcement in cases involving infringements of consumers’ personal data still faces numerous difficulties.
According to Hoang Bich Thuy of the National Competition Commission under the Ministry of Industry and Trade, the first challenge lies in identifying the parties responsible. In the digital environment, data is often processed through networks involving businesses that collect data, intermediary platforms, storage service providers, analytics service providers, advertising agencies and the ultimate users of the data. One party may directly determine the purposes for which data is used without storing it itself, while another may store and transfer the data without having determined its original purpose.
In addition, proving violations and collecting evidence are difficult because data transactions are often conducted through electronic systems, intermediary accounts or platforms located outside Viet Nam. In many cases, consumers may find it difficult to prove that their information has been used unlawfully, identify the responsible party or demonstrate the resulting damage. The transfer of data through multiple parties also makes it difficult for consumers to know who holds and uses their information.
In the context of the digital economy, an effective legal framework needs to combine three pillars: prevention through compliance obligations; strict enforcement proportionate to the nature and consequences of violations; and the restoration of the lawful rights and interests of those whose rights have been infringed. This also provides a basis for enhancing corporate accountability, strengthening consumer confidence and improving the effectiveness of state management of data-driven business activities.
— Hoang Bich Thuy, National Competition Commission, Ministry of Industry and Trade
Addressing solutions to this situation, Thuy said that, alongside reviewing legal provisions, it was necessary to strengthen the capacity to detect organised networks involved in data trading, particularly in the e-commerce and online advertising environments. The compliance responsibilities of businesses and digital platforms also needed to be enhanced.
“In the context of the digital economy, an effective legal framework needs to combine three pillars: prevention through compliance obligations; strict enforcement proportionate to the nature and consequences of violations; and the restoration of the lawful rights and interests of those whose rights have been infringed. This also provides a basis for enhancing corporate accountability, strengthening consumer confidence and improving the effectiveness of state management of data-driven business activities,” the representative of the National Competition Commission under the Ministry of Industry and Trade emphasised.
