Personal data protection means ensuring that information about customers, workers and partners is collected, used and stored lawfully, for its intended purpose and securely. In ESG, it is a metric within the Social pillar (responsibility to customers) and is closely linked to the Governance pillar (technology risk governance).
Key takeaways
- Decree 13/2023/ND-CP on personal data protection lays the foundation; the Law on Personal Data Protection passed by the National Assembly in 2025 raises the bar.
- Core principles: a lawful basis for processing (such as consent), purpose limitation, data minimisation, security and transparency.
- GRI 418 requires disclosure of substantiated complaints concerning breaches of privacy and losses of customer data.
Why is personal data an ESG issue?
- Human rights: privacy is a fundamental right.
- Financial and legal risk: penalties, compensation and business disruption when data is leaked.
- Trust: data incidents damage a brand faster than almost any other incident.
Seven things businesses need to do
- Map your data: what is collected, where it is held, who has access and how long it is kept.
- Identify the lawful basis for processing and manage data subjects' consent.
- Carry out data processing impact assessments as required.
- Control access, encrypt and back up data; manage data processing vendors.
- Set up a procedure for handling data subject requests (access, correction, deletion).
- Have an incident response plan and notify breaches within the statutory deadlines.
- Train staff and report regularly to the Executive Board and the Board of Directors.
Links to corporate governance
Cybersecurity and data should be on the list of material risks overseen by the Board of Directors. Workers' personal data is also part of human rights due diligence.
Collecting less data is the cheapest security measure.
Frequently asked questions
Do small businesses have to comply with personal data protection rules?
Yes. The rules apply to organisations and individuals processing personal data in Vietnam; the specific obligations may vary depending on the type of data and the scale of processing.
What counts as sensitive personal data?
It usually includes data on health, biometrics, finances, location, private life and certain other categories as defined by law; this type of data requires a higher level of protection.
Which personal data metrics go into an ESG report?
The number of substantiated complaints about privacy breaches, the number of leaks and losses of customer data (GRI 418-1) and a description of the data security management system.
VietESG — Independent ESG rating organisation. Ratings based on disclosed data, supporting evidence and a public methodology aligned with GRI and the SDGs.
