Context: The customer’s question sounds simple — ‘did the bank ask me before sharing my data with a fintech?’ — but the legal answer lies in the quality of consent: a generic consent buried in a 40-page set of terms is increasingly hard to treat as valid consent.
Reading the Framework from the Source Texts
The current personal-data framework is the Personal Data Protection Law 91/2025/QH15 (effective 1 January 2026) and Decree 356/2025/ND-CP, which replaced Decree 13/2023/ND-CP — the instrument many older materials still cite as current. The core requirement is unchanged across both generations: the data subject’s consent must be voluntary, given with clear knowledge of the data types processed, the purposes and the recipients; consent for one purpose does not automatically extend to another. Sharing bank data with a fintech for credit scoring or Open API — one of the three solutions in the Decree 94/2025/ND-CP sandbox — therefore needs its own consent layer, separate from account-opening consent.
The three most common defects that void consent are: bundling data-sharing consent into an ‘agree to all’ button with no partial-refusal option; not letting customers withdraw consent while keeping the basic service that does not depend on that data; and sharing beyond the notified data scope, such as using transaction data shared for credit scoring for advertising. When a customer withdraws consent, the bank and the fintech must stop processing for that purpose and delete or stop sharing the data as requested, except for independent retention duties under banking and AML law. Credit-institution customer secrecy is a second protective layer on top: even with consent, disclosure must stay within that consent and the Law on Credit Institutions 32/2024/QH15.
Practical Points Commonly Overlooked
Banks and fintechs should design consent screens on a ‘one purpose, one switch’ principle: the customer turns off sharing for advertising while keeping the payment service. The consent record must store the timestamp, the version of the text displayed and the collection channel — when a complaint arises, these are the first three facts the data-protection authority asks to see.
Concrete Steps for Those Involved
The steps below turn the analysis above into concrete work:
- First, test your own situation against this ground: The current personal-data framework is the Personal Data Protection Law 91/2025/QH15 (effective 1 January 2026) and Decree 356/2025/ND-CP, which replaced Decree 13/2023/ND-CP — the instrument many older materials still cite as current.
- Record the application point specific to this case instead of copying conclusions from another case: Sharing bank data with a fintech for credit scoring or Open API — one of the three solutions in the Decree 94/2025/ND-CP sandbox — therefore needs its own consent layer, separate from account-opening consent.
- Prepare the evidence and file relating to the following point before dealing with authorities or partners: Banks and fintechs should design consent screens on a ‘one purpose, one switch’ principle: the customer turns off sharing for advertising while keeping the payment service. The consent record must store the timestamp, the version of the text displayed and the collection channel — when a complaint arises, these are the first three facts the data-protection authority asks to see.
- Answer the question clients ask most directly with this conclusion, and keep it on file: Yes. Under the Personal Data Protection Law 91/2025/QH15 and Decree 356/2025/ND-CP (replacing Decree 13/2023/ND-CP), sharing data with a fintech is a processing activity needing the customer’s voluntary, informed consent, separate from account-opening consent, except where the law compels disclosure.
Frequently Asked Questions
Must the bank ask me before sharing my data with a fintech?
Yes. Under the Personal Data Protection Law 91/2025/QH15 and Decree 356/2025/ND-CP (replacing Decree 13/2023/ND-CP), sharing data with a fintech is a processing activity needing the customer’s voluntary, informed consent, separate from account-opening consent, except where the law compels disclosure.
Is a generic consent in the terms valid?
A generic ‘agree to all’ consent is easily treated as invalid if the customer did not clearly know the data types, purposes and recipients, or had no partial-refusal option. The safe bank presents consent purpose by purpose and can evidence the exact text shown to the customer.
Can I withdraw consent to data sharing?
Yes. Withdrawal of consent is the data subject’s right: the bank and fintech must stop processing for the withdrawn purpose and delete or stop sharing as requested, while data under independent banking and AML retention duties is still kept for the statutory period.
This article has been quality-reviewed by the FLAW AI Legal Council