Vietnam Personal Data Protection Law 2025 for Tourism Businesses
A practical guide to Vietnam’s 2025 personal data law for hotels and tour operators: risks, controls, staff training, evidence and next steps.
Tourism companies handle personal data at many moments: a guest books a room, sends passport details, asks for an airport transfer, joins a mailing list or appears in a group photograph. Vietnam’s Law No. 91/2025/QH15 was issued on 26 June 2025 and took effect on 1 January 2026. The practical question is not whether a business uses data, but whether it can explain why it uses it, who can access it and what happens when something goes wrong.
1. Legal duties, standard expectations and good practice
The legal baseline
The 2025 Law addresses data-subject rights, responsibilities of controllers, processors and third parties, processing activities, transfers and impact-assessment records. The National Assembly’s official explanation also identifies prohibited conduct, including unlawful processing, trading in personal data, taking data, and intentionally disclosing or losing it . Businesses should read the Law together with Government Decree 356/2025/ND-CP, effective from 1 January 2026 .
Standard and programme expectations
A tourism sustainability criterion such as Standard 23 is an assessment expectation: the organisation should be able to show a policy, accountable roles, training, controls and continual improvement. Travelife describes a step-by-step approach supported by training, management tools, action planning and independent assessment . The Code, overseen by ECPAT International, is a voluntary child-protection initiative with six criteria, including employee training, supply-chain clauses, traveller information and annual reporting . Neither programme replaces Vietnamese law.
ISO/IEC 27701
ISO/IEC 27701:2025 sets requirements and guidance for a Privacy Information Management System and is designed for organisations responsible for personally identifiable information 4. It can provide a structured accountability framework. Certification or alignment with ISO does not, by itself, prove compliance with every Vietnamese rule.
2. Scope and tourism-specific risks
Map guest, employee, child, emergency-contact, supplier and marketing data across booking systems, paper forms, messaging apps, Wi-Fi, CCTV, payment providers, cloud platforms and spreadsheets. Include data handled on the company’s behalf by guides, transport providers, destination partners and technology vendors.
Common risks include an exposed passport copy, an email sent to the wrong recipient, shared PMS credentials, an unrestricted tour manifest, a photo of a child posted without an appropriate basis, excessive retention and overseas access by a technology provider. Cross-border flows should be flagged for the applicable impact-assessment and record-keeping requirements 2 3.
3. Controls that staff can actually use
Purpose, notice and rights
Use clear notices at booking, check-in and tour-registration points. Explain the relevant purpose in plain language and provide a route for data-subject requests. The Ministry of Justice identifies the Law’s Article 4 as the provision setting out data-subject rights 6. Staff should know where to route a request rather than improvise a refusal or promise.
Access, retention and sharing
Give each worker an individual account, least-privilege access and prompt offboarding. Set a retention schedule tied to purpose and applicable obligations. Share only the fields a supplier needs, through an approved channel, and record material disclosures.
Suppliers and incidents
Maintain a supplier register and contract controls covering purpose, confidentiality, permitted use, assistance with rights requests and incident escalation. Create a simple incident route: stop further disclosure, preserve the facts, notify the designated contact and do not conceal or casually delete evidence.
4. A practical implementation sequence
- Inventory: document data categories, purposes, systems, recipients and locations.
- Assess: identify sensitive, high-risk and cross-border activities.
- Control: set permissions, notices, retention, supplier terms and secure sharing.
- Train: give role-based examples to reception, guides, marketing, IT and managers.
- Exercise: rehearse a misdirected email, lost device and guest rights request.
- Review: test records, fix gaps and update after a system, supplier or legal change.
5. Roles and evidence
Senior management approves policy and resources. A privacy lead coordinates the processing map, impact records and incidents. HR manages onboarding and refreshers; IT manages access and logs; procurement reviews suppliers; operational teams apply the rules at the point of service.
Useful evidence includes the policy, data map, system and supplier register, notices, assessment records, contracts, access reviews, training materials, attendance and test results, rights-request logs, incident exercises and corrective-action records. Evidence should demonstrate control without unnecessarily copying live guest data.
6. Example scenario
A tour guide asks for the full guest manifest to share with a local restaurant. The coordinator checks the purpose, limits the fields to what the restaurant actually needs, uses the approved channel and records the disclosure. If the file is sent to the wrong address, the guide reports it immediately. The response team then assesses the data, recipients, impact and next steps instead of treating deletion of the message as a complete solution.
7. Frequently asked questions
Is Standard 23 a Vietnamese legal instrument?
No. It is an assessment or training framework, depending on the programme. The binding baseline comes from applicable Vietnamese legislation and contracts.
Are small businesses free from all privacy duties?
No. The National Assembly stated that small and start-up enterprises may choose whether to perform certain impact-assessment and privacy-personnel requirements for five years from commencement, while household businesses and micro-enterprises receive the exemptions specified by the Law. The precise scope and any implementing conditions must be checked against the current text and Decree 356.
Is one annual training session enough?
Usually not as a practical control. Training should be role-based, refreshed after material changes, tested with scenarios and supported by incident drills.
Does The Code cover all personal-data compliance?
No. The Code focuses on preventing the sexual exploitation of children in travel and tourism. It is valuable for child-protection awareness and reporting, but it is not a substitute for Vietnam’s personal-data requirements .
Soft CTA: A role-based privacy training course can help tourism teams map data, practise incident response and assemble assessment evidence. Use training as an implementation aid, then obtain legal review for decisions that depend on the current Vietnamese text.
Contact us for Personal Data Protection consulting for Tourism Businesses in Vietnam.
ISC Global
Hotline/Zalo: +84 933 096 426 – +84 868 591 260
Email: info@iscglobal.asia | van.pham@iscglobal.asia
Website: iscglobal.asia | iscglobal.edu.vn
No responses yet