After Personal Data Protection Law 91/2025/QH15, a marketing SMS or email campaign in Vietnam must pass two gates at once: the personal-data gate — has the customer consented to the marketing purpose — and the anti-spam gate of Decree 91/2020/ND-CP — is the sender name registered, is the message labelled as advertising with a working opt-out. Passing one gate and failing the other is still a violation.
Governing Instruments
Two regulatory layers over the same message
The first layer is Personal Data Protection Law 91/2025/QH15. Sending advertising is a processing purpose for personal data (phone numbers, emails, purchasing behaviour); where the basis is consent, that consent must be clear and specific to the marketing purpose — agreeing to service terms does not by itself cover receiving promotional SMS. Data subjects have the right to withdraw consent and to object to processing for direct marketing, and the enterprise must stop sending once those rights are exercised. The second layer is Decree 91/2020/ND-CP on combating spam messages, spam email and spam calls: advertising messages may only be sent to people who have previously registered consent to receive them, must use a registered sender identification name (brand name) instead of an ordinary number, must carry an advertising label and refusal instructions, and may only be sent in the permitted window (07:00 to 22:00) unless the recipient agrees otherwise.
The boundary between the layers is their object: Law 91/2025 governs the lawfulness of the data processing (is there a basis, are subject rights honoured), while Decree 91/2020 governs the act of sending on the telecommunications network (who may send, under what identity, at what hours, with what exit) together with telecom and advertising sanctions — advertising violations may additionally be handled under Decree 87/2026/ND-CP on sanctions in culture and advertising. A campaign can be technically perfect on sending (registered brand name, right hours) yet still breach Law 91/2025 if the number list was bought from a third party without valid subject consent for advertising.
Application Analysis
Legacy customer lists collected before 2026 need a split answer. Consent validly collected under the law of its time does not automatically lapse when Law 91/2025 takes effect; but continued processing from 1 January 2026 must meet the new law’s standard — a clear purpose, provable consent and a working withdrawal mechanism. For the part of the list whose consent provenance cannot be traced (purchased, exchanged, collected at events without a consent form), the only safe treatment is a re-permission campaign: send one message asking for confirmation under the new standard and keep only those who confirm; delete the rest from the send list. Continuing to send to the whole legacy list on the argument “they are already customers” is the common misunderstanding — a past customer relationship grounds processing for contract performance, not for advertising.
The opt-out mechanism is where the two layers meet most tightly. Under Decree 91/2020 every advertising message must carry refusal instructions and refusal must be free and easy (a syntax message or a designated channel); under Law 91/2025 withdrawal of consent and objection to direct marketing are subject rights the enterprise must execute at once. Correct operation means a single refusal by the customer switches off all three places simultaneously — the messaging vendor’s send list, the enterprise’s CRM/marketing systems and any running partner campaigns — and is recorded on a suppression list so the subject is not re-imported from another data source. Outsourcing the sending does not outsource this responsibility: the sending agent must work from the enterprise’s opt-out-filtered list.
Recommended Actions
- Audit every marketing list source: keep only numbers/emails with provable consent for the advertising purpose; move unprovable entries to a re-permission campaign under Law 91/2025 standards.
- Register and maintain the sender identification name (brand name) with carriers; every advertising message carries the advertising label and refusal instructions under Decree 91/2020.
- Build one-touch opt-out: a refusal on any channel (SMS, email, hotline, app) syncs to the central suppression list the same day.
- Lock the 07:00–22:00 sending window in the sending system and clear advertising content under advertising law (Decree 87/2026 sanctions) before any campaign launches.
- Write compliance clauses into contracts with external sending vendors: send only from the enterprise’s opt-out-filtered list, never from the vendor’s own lists, with reporting duties on sends and complaints.
Frequently Asked Questions
What form of customer consent makes promotional SMS and email lawful after Law 91/2025?
Consent must meet the Personal Data Protection Law 91/2025 standard: clear, specific to the advertising/marketing purpose and expressed by an affirmative act of the customer (a separate tick at registration, an SMS confirmation or a dedicated form) — never inferred from a purchase or from accepting general service terms. The consent must be evidenced and stored (time, channel, consent text) and must be as easy to withdraw as to give. In parallel, Decree 91/2020/ND-CP requires recipients to have registered consent to receive advertising messages before sending — the two standards overlap: the enterprise needs one consent that satisfies both the data-protection and the anti-spam test for the same list.
Where is the line between the Personal Data Protection Law and the anti-spam decree in marketing?
Law 91/2025 answers “may this data be processed for advertising at all”: the processing basis, consent quality, and the subject’s rights to withdraw consent and object to direct marketing. Decree 91/2020/ND-CP answers “how may it be sent on the telecom network”: the registered sender name, the advertising label in the message, free refusal instructions, the 07:00–22:00 sending window and the duties of carriers and senders. Breaches of each layer are sanctioned under that layer’s regime — telecom/advertising on one side, personal data protection on the other — and one wrongful send can breach both at once. Campaigns must therefore be checked against both checklists before sending; neither substitutes for the other.
Can legacy customer lists collected before 2026 still be used for marketing?
Only the part with valid consent. Consent lawfully collected at its time keeps its value, but continued sending from 1 January 2026 must satisfy Law 91/2025: a clear purpose, provable consent and a working withdrawal mechanism. The untraceable part of the list — bought from third parties, collected at events without forms, imported from partners — may not be used on a “former customer” argument: run a re-permission campaign, keep only those who confirm under the new standard and remove the rest from the send list. A past sales relationship is a basis for processing to perform the contract, not a basis for sending advertising.
How must the advertising opt-out mechanism operate?
Three operating requirements. One, presence: every advertising SMS and email must carry a clear refusal route inside the message itself — a reply syntax, an unsubscribe link — and refusal must be free for the recipient under Decree 91/2020. Two, immediate and global effect: one refusal must stop sends from every system (messaging vendor, CRM, partner senders) and be recorded on a central suppression list so the subject is not re-imported from another data source; under Law 91/2025 this is exactly the execution of the rights to withdraw consent and object to direct marketing. Three, evidence: the system must log the time and channel of each refusal to prove compliance on complaint or inspection — and must never send again to a person who refused, including in campaigns of another brand of the same enterprise where the original consent did not cover that brand.
