Tiếng Việt
1. A New Law Is Here: Stronger Personal Data Protection
The 2025 Personal Data Protection Law, recently passed by the National Assembly, will come into effect on January 1, 2026. A key provision is found in Article 29, which prohibits social media platforms and online services from requesting users to upload images or videos containing personal identification documents such as ID cards, passports, or other official papers for account verification, unless there is a clear legal basis.
This aims to prevent abuse of personal data and safeguard users’ privacy across digital platforms.
2. Who Is Affected – And When?
The law will take effect nationwide on January 1, 2026 and applies to:
– Social media and digital platforms (e.g., Facebook, TikTok, Zalo, OTT apps)
– Enterprises using eKYC or requiring document uploads for account verification
– Online banking, fintech, and e-commerce platforms that request document images
– Individuals who regularly verify accounts online
3. What the Law Says – Key Points for Businesses
No More Mandatory ID Document Uploads for Verification
– Platforms may only verify users via OTP, email, phone number, profile pictures, or other lawful methods.
– Requesting ID document images without legal grounds will be considered a violation.
Data Collection Requires Informed, Explicit Consent
ID photos can only be collected if:
– There is a clear legal basis or sector-specific law permitting it;
– The user provides explicit and voluntary consent — consent cannot be assumed merely by using the service.
ID Document Images Are Sensitive Data – Handle With Care
– Businesses must adopt strict safeguards to ensure secure handling of sensitive data, in line with the Personal Data Protection Law and accompanying government decrees.
– Data leaks may result in fines, operational suspension, or even criminal liability.
Users Have the Right to Refuse Without Service Restrictions
– Users can decline to provide ID photos and must still be granted access to the platform’s core services.
– Platforms are required to clearly communicate users’ rights and ensure transparent data usage policies.
4. Legal Compliance Checklist – What Organizations Must Do
To comply with the new regulations, businesses must:
– Review and revise all verification processes, removing any requirement for ID photos unless legally justified.
– Update privacy policies, service terms, and consent processes to reflect clear purposes, scope of use, and user rights.
– Adopt legally permitted verification alternatives such as licensed eKYC tools, OTP, email, digital signatures, or remote signing.
– Strengthen data governance systems that allow users to review, delete, or update their personal data.
– Train internal staff on privacy laws, data protection, and cybersecurity risks.
– Stay informed about government circulars and guidance documents to ensure continuous legal compliance.
5. Legal Basis
2025 Personal Data Protection Law – Article 29
6. Contact LTS LAW – Your Privacy Compliance Partner
LTS LAW offers end-to-end legal support to help digital platforms and enterprises comply with new data protection laws:
– Auditing and redesigning user verification and data collection processes
– Drafting privacy policies, user agreements, and legal disclosures
– Providing technical guidance on secure data handling and staff training
– Representing businesses in regulatory checks or inspections
Legal Hotline: 0902 798 066
Website: https://lts.com.vn
