Article · June 17, 2026
What is the data subject’s right to be informed under the PDPL?
Learn the PDPL right to be informed: what to notify, when to do it, and how Vietnamese businesses can comply.
Quick answer
What is the PDPL data subject’s right to be informed?
The right to be informed is a foundational right under the Personal Data Protection Law. Simply put: before collecting someone’s data, a business must tell them how the data will be used so they can decide whether to provide it, and afterwards be able to track where their data is going.
For Vietnamese businesses, this right is not just a “we respect your privacy” sentence in a policy. It must be embodied in notices that are specific, easy to understand, timely, and verifiable in day-to-day operations.
What must businesses notify data subjects of?
Businesses must provide at least the following groups of information as required:
- Purposes of processing personal data.
- Types of data collected.
- Processing methods, scope of processing, and retention period.
- Data recipients or categories of recipients.
- Possible consequences or impacts if the data subject does not provide data.
- The data subject’s rights and how they can exercise those rights.
- Contact information of the organization/individual responsible for receiving requests.
Real-world example: a Vietnamese e-commerce app collects full name, phone number, shipping address and purchase history. When a user registers, the app needs to clearly state that this data is used to create an account, deliver orders, provide customer care, analyze shopping behavior or run advertising; and whether it is shared with couriers, payment gateways or advertising platforms.
When must businesses notify?
Notices must be provided before or at the time of data collection, except where the law allows an exception under the regulations.
A key point is that “notifying after collection” is usually not sufficient. If a user fills out a form but only sees the privacy policy in the footer after clicking submit, the business risks being unable to prove the user was fully informed before providing data.
Commonly missed situations:
- Quote request or inquiry forms.
- HR accounts, timekeeping, internal ERP.
- Chatbots, live chat, customer support forms.
- Recruitment pages collecting candidate applications.
- SDKs/trackers collecting user behavior on websites or apps.
How should businesses meet the right to be informed?
Inventory data and processing flows:
Identify what you collect, from where, where it is stored, who can access it, and whether it is shared with third parties.
Write short, clear notices at the right touchpoints:
Put the core content right in the form, cookie banner, sign-up screen or app onboarding; don’t make users read long documents to find out.
Separate notices by purpose:
Each processing purpose should be split so users can understand which are mandatory, which are optional, and which relate to marketing.
Keep evidence of having notified:
Record the policy version, when it was displayed, consent logs if any, and the configuration of each collection channel.
Update when things change:
If you add advertising partners, change the CRM, transfer data abroad or introduce new purposes, update the notice before applying them.
A ready-to-use short notice for your website/app
Below is a minimal content template for a data collection form:
| Field | Sample content |
|---|---|
| Purpose | We collect full name, email and phone number to create an account, contact support and send order information. |
| Data sharing | Data may be shared with the shipping provider, hosting provider and payment gateway as required by regulations. |
| Retention period | Data is retained for as long as necessary to provide the service and for applicable legal retention periods. |
| Your rights | You have the rights to be informed, access, rectify, withdraw consent, request deletion, or restrict processing as provided by law. |
| Contact | Send requests to privacy@[companyname].vn or to the department in charge of personal data. |
If you use a cookie banner, you can shorten it: “We use cookies to operate the website, measure and personalize content. See details and manage your choices in the Cookie Policy.”
What if you fail to notify properly?
Under the Personal Data Protection Law (Law 91/2025/QH15), the notification obligation is part of PDPL compliance. Breaching this obligation may lead to sanctions under the Government’s implementing decree; for serious violations, the company or individuals involved may also be subject to criminal liability.
For SMEs, the risk usually does not lie in “bad intent” but in weak processes: data collection forms without a notice, HR keeping candidate CVs for too long, marketing adding trackers without explanation, or customer support recording calls without clearly stating the purpose.
How to check if your business has met the right to be informed?
You can self-check with five questions:
- Do users see a notice before they submit data?
- Does the notice clearly state purposes, recipients, retention period and their rights?
- Are mandatory and optional purposes separated?
- Do you have logs or evidence of the notice version that was displayed?
- When changing providers or adding new purposes, does the business update the notice?
If the answer is “not sure,” treat it as a PDPL item to fix now, rather than waiting for requests from customers, partners or a competent authority.
- It is the right to be clearly informed about the data being collected, processing purposes, recipients, retention period, and their own rights before or when the data is collected.
- Usually not sufficient if users are not adequately notified at the point of collection. Under the regulations, the information must be easy to see, easy to understand, and timely.
- If cookies or trackers are used for measurement, personalization or advertising, the business should clearly state the purposes and provide a mechanism to manage choices, as required for each case.
- The enforcement authority is the Ministry of Public Security, specifically the Department of Cybersecurity and the Prevention and Combat of High-Tech Crime (A05), according to its assigned functions.
If you are building forms, a cookie banner or DSAR flows for a website/app, consent.vn can help standardize notice content and store consent evidence to make audits easier.
Source: the Personal Data Protection Law (Law 91/2025/QH15); Decree 13/2023/ND-CP — thuvienphapluat.vn; Ministry of Public Security — bocongan.gov.vn
Get started — no account needed.
Ready to comply with PDPL?