WHICH CASES ALLOW PERSONAL DATA TO BE PROCESSED WITHOUT CONSENT FROM JANUARY 1, 2026?
Pursuant to Clause 1, Article 19 of the Law on Personal Data Protection 2025 (Law No. 91/2025/QH15), five cases in which the processing of personal data does not require the...
Pursuant to Clause 1, Article 19 of the Law on Personal Data Protection 2025 (Law No. 91/2025/QH15), five cases in which the processing of personal data does not require the consent of the data subject are as follows:
- To protect the life, health, honor, dignity, rights, or lawful interests of the data subject or another person in emergency circumstances; or to protect one’s own legitimate rights or interests, the legitimate rights or interests of others, or those of the State or an agency or organization in a necessary manner in response to acts infringing upon such interests. Personal data controllers, personal data processors, personal data controlling and processing parties and third parties shall prove this case.
- To respond to emergencies or threats to national security which are not serious to the extent of requiring the declaration of a state of emergency; for preventing and combating riots, terrorism, crimes and violations in accordance with law.;
- To serve the operation of state agencies and the exercise of state management functions in accordance with specialized laws;
- To perform an agreement entered into between the data subject and the relevant agency, organization, or individual in accordance with law;
- Other cases as prescribed by law.
Furthermore, Clause 2 of this Article stipulated: Agencies, organizations, and individuals concerned must establish supervision mechanisms when processing personal data without requiring consent of data subjects, including:
- Establishing procedures and regulations on personal data processing and defining the responsibilities of agencies, organizations, and individuals in personal data processing;
- Implementing appropriate personal data protection measures; regularly assessing risks that may arise during personal data processing;
- Conducting periodic inspections and evaluations of compliance with laws, procedures, and regulations on personal data processing;
- Establishing mechanisms for receiving and handling feedback and recommendations from relevant agencies, organizations, and individuals.