Domestic law and policy

Law No. 26/2023/QH15 on Identification regulates electronic identification and authentication.^[27] Under this law, digital identity is defined as an electronic account containing a citizen’s identification number, biometric data, and other information verified through the national database.^[28] In addition, Decree No. 72/2013/ND-CP introduces mandatory online identity verification requirements for certain internet services, raising concerns regarding privacy, surveillance, and access for individuals lacking recognized digital identities.^[29] Each citizen is issued one unique electronic identification credential, which has the same legal validity as the physical identity card.^[30]  Law No. 26/2023/QH15 provides in Article 6 an avenue for complaints, to settle complaints and denunciations and handle violations of the law on identity in accordance with law.^[31] This suggests that the law does provide for complaints and handling of violations in the identity/ID regime. 

Decree No. 69/2024/ND-CP on Electronic Identification and Authentication regulates issuance, use, locking/unlocking of electronic identification accounts (e-ID) for individuals, foreign nationals, organizations; integration with the national population or immigration databases; connection and sharing of data; legal validity of electronic identification and authentication services.^[32] This decree also defines ‘electronic identity’ as information about an agency or an organization or an individual existing in an electronic identification and authentication system that makes it possible to uniquely identify that individual or agency or organization in cyberspace.^[33]

The legal and policy framework does establish a linkage between digital identity and citizenship, in that the identity card regime is for Vietnamese citizens, and the digital identity regime maps onto that system.^[34] However, the digital identity framework also extends to foreign residents, so it is not strictly limited to citizens.^[35]

Data Protection

Data Protection is primarily governed by two decrees, that is – Decree No. 13/2023/ND-CP (Decree No. 13) and Decree No. 69/2024/ND-CP (as discussed above). Decree No. 13 on Personal Data Protection sets out rights of data subjects and the manner in which personal data shall be used.^[36] It states that data subjects have the right to be informed, to consent (and to withdraw consent), rights of access or correction, and rights to request deletion or return, except where other laws provide exceptions.^[37] Decree No. 69/2024/ND-CP requires the Ministry of Public Security to build, operate and protect the e-ID system; it mandates permanent storage of e-identification in the national e-ID system and retention of access history for 5 years.^[38]

Decree No. 13 lists ‘distinctive physical attributes and biological characteristics’ (i.e. biometric information) among ‘sensitive personal data’, which triggers higher protection measures and additional organisational/technical requirements for controllers/processors.^[39] With regard to the encryption of data, Decree No. 13 requires appropriate technical and organisational security measures and encourages the application of standards; it lists encryption or decryption as processing operations and requires technical safeguards.^[40] Decree No. 69 also brings cryptographic or cipher guidance into the picture by naming the Government Cipher Committee to provide cryptographic standards and to assess cryptographic security for e-ID users.^[41] Decree No. 13 also requires Personal Data Controllers to notify the Ministry of Public Security (Department of Cybersecurity & Hi-tech Crime Prevention) within 72 hours of detecting a violation of personal data regulations.^[42] The decree also sets up a National Personal Data Protection Portal to receive notifications and complaints as well as to handle violations in relation to personal data protection in accordance with the law.^[43]

While there is no publicly available documentation indicating the misuse of data, it should be noted that the government has statutory power to access/process personal data for state functions and national security. ^[44] Civil society organisations have raised concerns that Viet Nam’s expanding digital identification and cybersecurity framework may facilitate state surveillance, particularly of human rights defenders and civil society actors.^[45] Reports by Amnesty International and Human Rights Watch document spyware attacks and expansive monitoring powers under the 2019 Cybersecurity Law (Law No. 24/2018/QH14), raising risks that digital ID systems could be used to suppress dissent or target marginalised groups.^[46]

The aforementioned laws permit government access under statutory exceptions and do not institute an absolute prohibition.^[47] Decree No. 13 establishes the Department at Ministry of Public Security as the specialised agency, with powers to inspect, receive notifications and handle violations.^[48] Controllers or processors are explicitly required to cooperate and to supply information for investigations.^[49] Similarly, Decree No. 69 places the build, operation, administration of the national e-ID system in the hands of the Ministry to connect or share data with other state bodies, and prescribes that e-ID records be stored permanently and access logs for five years.^[50]

International Commitments

Viet Nam is not a party to any international treaty explicitly governing digital identification or data protection, but it is a signatory to major human rights treaties relevant to these domains. Notably, the Committee on the Rights of the Child, in its General Comment No. 25 states that digital systems should be created such that they enable all children to safely access essential digital public services and educational services without discrimination.^[51]

The ASEAN Framework on Personal Data Protection and Framework on Digital Data Governance sets out non-binding principles encouraging member states to adopt national data protection laws and supports mutual recognition.^[52] However, it does not impose binding commitments or specific mandates on digital ID systems or make provisions for the protection of stateless persons.^[53] The country has also pledged in 2025 to the Ministerial Declaration on a Decade of Action for Inclusive and Resilient Civil Registration and Vital Statistics in Asia and the Pacific where countries pledged to ensure that every birth is registered by 2030 and to close registration gaps among marginalized populations.^[54] The Declaration highlights the barriers faced by stateless persons in access to civil registration services and pledged to  ‘develop and implement measures to avoid the potential exclusion of digitally marginalized or vulnerable populations from statistical data and facilitate their access to services and entitlements’.^[55]