Vietnam has become a meaningful destination for medical investment and clinical research. A growing patient population, improving trial infrastructure, and competitive operating costs have drawn multinational companies to open facilities and run trials here. With that presence comes a set of data privacy obligations that must be complied with as specified under Law No. 91/2025/QH15 on Personal Data Protection ("PDPL"), supported by Decree No. 356/2025/ND-CP (Decree 356) and other relevant regulations.

Vietnam now has a statutory personal data protection law, sector-specific rules for health data management, dedicated retention schedules for medical records, and a separate confidentiality framework for patient files. These instruments sit alongside each other. Understanding how they interact and what they specifically require of healthcare businesses is the starting point for operating responsibly in this market.

This article focuses on aspects of Vietnam's current data privacy framework relevant to the healthcare sector.

1. What is medical data

Decree No. 102/2025/ND-CP (Decree 102) is the first Vietnamese legislation to define medical data formally. Under Decree 102, digital medical data is defined as digital data that reflects various aspects of healthcare, including, but not limited to, information on medical examinations, treatment, and rehabilitation; population; maternal and child health; reproductive health; and health insurance.

2. Medical data sits entirely within the sensitive personal data category

Vietnam's personal data protection law divides personal data into two tiers: basic and sensitive. Sensitive personal data attracts stricter obligations — more demanding consent requirements, mandatory security measures, and heightened accountability.

The categories of sensitive personal data directly relevant to the medical sector include: health conditions; biometric data and genetic characteristics; data revealing racial or ethnic origin; sex life and sexual orientation; and information about private life and personal and family secrets, which encompasses confidential disclosures in the patient-practitioner relationship.

In practice, virtually every data point collected during a clinical trial or patient care interaction — diagnoses, medical histories, lab results, genetic samples, biometric measurements from connected devices, treatment records — is sensitive personal data under Vietnamese law. Accordingly, the heightened obligations apply from the moment of collection.

One aspect worth noting: personal data that has been genuinely de-identified falls entirely outside the scope of data privacy laws. This creates a meaningful pathway for research analytics — de-identified datasets can be processed and shared without triggering the consent and compliance requirements under the law.

3. Consent in Vietnam is purpose-specific, not per-activity

Consent is the primary legal basis for processing personal data in Vietnam. Five aspects are particularly notable for the medical sector.

First, there must be a separate consent for each processing purpose. A single general consent covering all uses of a participant's or patient's data does not satisfy the standard of consent under the law. Where a pharmaceutical company collects patient data for a clinical trial, uses a subset for safety reporting, and intends to include personal data in a registry, each of those is a distinct purpose requiring a distinct consent. The data subject must be able to consent to one purpose without being required to consent to others.

Second, where the data to be processed is sensitive personal data, the consent form must explicitly notify the data subject of that fact. This is a mandatory disclosure. For multinational trials using internationally standardized participant information sheets, this requires deliberate adaptation for Vietnam sites — a document that describes what data is being collected is not sufficient if it does not identify that data as sensitive personal data under Vietnamese law.

Third, beyond the general data privacy framework, Decree 102 introduces its own requirements for medical data. The disclosure or processing of information relating to an individual's private life, personal secrets, health status, genetic characteristics, physical attributes, unique biological characteristics, and sexual life and orientation requires the data subject's express consent. Information relating to family secrets — consent of the relevant family members is required. The only exemption applies to heads of state authorities, who may disclose medical data without consent when acting in the course of their official duties and where disclosure is necessary for the public interest or public health as prescribed by law.

Fourth, consent must also be verifiable: it must be capable of being reproduced in writing, whether via a signed document, a recorded phone call, an SMS consent syntax, or a platform-based electronic mechanism. Oral consent with no record is not sufficient. There are meaningful exemptions. Processing without consent is permitted in certain situations, such as to protect the life or health of the data subject in urgent cases, to perform a contract to which the data subject is a party, and to serve the operations of state agencies.

One further feature: withdrawal of consent does not apply retroactively. A data subject who withdraws consent cannot require that processing already completed be reversed. This is relevant for clinical trials, where data collected before withdrawal forms part of the trial record.

4. Medical records carry their own confidentiality regime

Separate from general data privacy laws, the Law on Medical Examination and Treatment establishes a dedicated confidentiality framework for patient records that applies directly to healthcare facilities and, by extension, to pharmaceutical companies working with them.

Patients have a statutory right to confidentiality of all information in their medical records and any personal information disclosed during the course of examination and treatment. Exceptions do apply; the law governs who may access medical records and on what terms. During active treatment, access is very limited, such as to treating personnel, external practitioners, students, and researchers with facility consent. After treatment concludes and records are archived, the categories expand to include access by courts, prosecutors, investigative authorities, forensic medicine organizations, and the patient's own lawyers.

5. Mandatory data-sharing obligation with the National Health Database

Decree 102 creates a compliance obligation with no direct equivalent in general data protection frameworks: healthcare facilities must connect to, synchronize, and share data through Vietnam's National Health Database, administered by the Ministry of Health.

The National Health Database will aggregate individual health information, including basic information, medical identification code, birth information, health insurance information, information on disease prevention, examination, treatment, and healthcare, and death notification and registration information. Healthcare facilities are required to create, standardize, and synchronize their health data to this database. The upload of data to the national database is a mandatory infrastructure obligation, not an opt-in integration.

6. In healthcare groups, each entity carries its own data privacy obligations

A common assumption among international healthcare groups operating in Vietnam is that their global data privacy compliance program covers all entities in the supply chain. Under Vietnamese law, that assumption is incorrect. Every organization that processes Vietnamese patients' personal data is independently responsible for its own compliance obligations under the PDPL, Decree 356, Decree 102, and other relevant regulations — including filing its own assessments, appointing its own data protection officer, and meeting its own deadlines.

Consider a straightforward example. An international hospital group headquartered in Singapore operates a private hospital in Ho Chi Minh City. The Vietnam hospital collects patient data during consultations and shares it with the group's regional data center in Singapore for centralized records management and analytics. The Singapore headquarters also has access to that data for group-wide quality assurance purposes. In this structure, the Vietnam hospital is a data controller under Vietnamese law — it decides why patient data is collected and how it is managed at the point of care. The Singapore data center, which receives and processes that data on the group's behalf, is a data processor. The headquarters, when accessing data for its own quality assurance purposes, may itself be a controller or a controller-processor, depending on the degree of decision-making it exercises.

What this means practically is that the Vietnam hospital appoints its own Data Protection Officer/Department/Service Provider and files its own Data Processing Impact Assessment and Overseas Transfer. The Singapore data center, as a processor of Vietnamese patient data, must also file its own assessment in its capacity as a processor. These are separate filings, with separate 60-day deadlines running from when each entity begins processing.

For international healthcare groups with Vietnam operations, this means group-level data privacy documentation is a starting point, not a solution. The Vietnam-specific layer — local filings, local officer appointments, and transfer documentation that meets Vietnamese requirements — needs to be built on top of it.

7. Storage and deletion of medical data are governed by specific mandatory periods

One area that receives less attention in general data privacy discussions, but is directly operational for pharmaceutical and healthcare businesses, is the mandatory storage and deletion framework. The general data privacy law establishes the principles, and Circular No. 33/2025/TT-BYT on the storage of health sector documents (Circular 33), effective 1 July 2025, sets the specific retention periods for different categories of medical records and documents. Additionally, Circular 33 specifies that where a document type is not explicitly covered by its schedules, the organization must apply the retention period of the most comparable category listed in Circular 33 or other regulations. Organizations must make a considered determination based on the closest analogous category and document their reasoning.

Under the data privacy law, personal data must be deleted or destroyed when:

(1) the purpose of processing has been completed;

(2) the applicable statutory retention period has expired;

(3) the data subject requests deletion and accepts the risks and potential damages that may occur;

(4) a competent state authority orders deletion; or

(5) under other circumstances under the law.

Secure methods must be used for deletions that prevent unauthorized access, copy, appropriation, disclosure, or loss of personal data.

A note on the current framework

Vietnam's data privacy framework for pharmaceutical and healthcare businesses is not a single instrument. General data privacy rules, health data management obligations, a dedicated medical records confidentiality regime, and sector-specific retention schedules all apply simultaneously — and a different regulator enforces each. The Ministry of Public Security oversees general data privacy compliance. The Ministry of Health oversees health data management, medical records, and document retention.

For organizations operating across both areas — which describes virtually every pharmaceutical and healthcare company with a Vietnam presence — understanding the full picture, not just one part of it, is what sound compliance looks like.

For advice on data privacy obligations in Vietnam's pharmaceutical and healthcare sector, contact Dilinh Legal at contact@dilinh.com | +84 (28) 73000864 | dilinh.com

Related: Data Privacy practice area | Advisory & Regulatory