Scenario: a marketplace deploys a “trust score” system rating buyers on purchase history, return rates, even online hours and devices used. Low scorers lose pay-later access and vouchers. Users were never asked. Does this violate personal data law?
Credit scoring is “personal data processing”
Under the Personal Data Protection Law 91/2025/QH15 and Decree 356/2025/ND-CP (effective 1 January 2026), all collecting, analysing and evaluating of personal data — including scoring and ranking — counts as “personal data processing” requiring a legal basis. The most common basis is data-subject consent. Purchase histories, service-use behaviour and device data are personal data; some (financial data, behavioural tracking) are sensitive categories demanding stricter safeguards and legal bases. Scoring without notice or consent — as above — breaches processing principles.
Conditions for lawful scoring
For lawful scoring, platforms must: clearly notify users about scoring (purposes, data types used, scoring logic at an understandable level); obtain consent before scoring, with refusal mechanisms free from unreasonable discrimination; use only necessary, proportionate data (harvesting device data and online hours to score shopping credit is hard to justify as proportionate); guarantee data-subject rights — to know the scoring logic and seek human review of automated decisions affecting their interests (pay-later denials, benefit restrictions); and apply proportionate security. Fully automated adverse decisions without human involvement are scoring systems’ highest-risk point.
Distinct from official credit information (CIC)
Distinguish internal platform “trust scores” from official credit information. Credit-information activity (collecting and processing borrower credit data) in Vietnam is performed by the National Credit Information Centre (CIC) under the State Bank and licensed credit-information companies, regulated by credit-information law. Marketplaces and e-wallets are not licensed credit-information organisations — internal scores carry no legal weight as CIC credit history, must not be shared externally as “credit information”, and impersonating credit-information services may violate credit-information regulations.
Frequently asked questions
Can users demand deletion of their trust score?
Yes, within data-subject rights: requesting deletion of data no longer necessary for notified purposes, withdrawing consent. Platforms must operate request-handling mechanisms under Decree 356/2025/ND-CP.
Does using trust scores for price discrimination violate the law?
Potentially several rules: opaque price discrimination breaches consumer rights; and relying on sensitive personal data without legal basis breaches data-protection law. Personalised pricing faces tightening scrutiny by regulators worldwide.
Does AI scoring need a data-processing impact assessment?
Yes. Automated scoring affecting large numbers of data subjects triggers personal-data processing impact assessments under Decree 356/2025/ND-CP, with standard forms and procedures.
This article has been quality-reviewed by the FLAW AI Legal Council.
