A retail chain wants to roll out facial recognition to check in loyalty customers and analyze shopping behavior. Is collecting customers’ biometric data (faces, fingerprints, irises, and so on) lawful? This article answers under the legal framework in force as of October 2026.
1. Biometric data is sensitive personal data
Vietnamese law places biometric data in the highest protection tier:
- Article 4 of Decree 356/2025/ND-CP: lists biometric data among sensitive personal data;
- Clause 2, Article 31 of the Law on Personal Data Protection 91/2025/QH15 (effective from 1 January 2026): defines biometric data and sets a commensurate protection regime.
2. Short answer: collection is allowed — with valid consent
The answer is yes, but under strict conditions. Under Article 9 of Law 91/2025, processing (including collection) of sensitive personal data must be based on the data subject’s valid consent. Valid consent must be:
- Voluntary — the data subject freely chooses, without coercion;
- Fully informed — the subject must clearly know the type of data collected, the processing purposes, the data controller, and his or her rights and obligations;
- Clearly expressed — given specifically and transparently, not ambiguously.
3. Common traps for businesses
Trap 1: “no objection means consent”
Wrong. Under Clause 4, Article 9 of Law 91/2025, silence or a pre-ticked box does not count as consent. Businesses must design a mechanism for customers to actively express consent.
Trap 2: citing Decree 13/2023 as the current basis
Decree 13/2023/ND-CP has expired, replaced by the Law on Personal Data Protection 91/2025. All current legal references on personal data must cite Law 91/2025 and its implementing regulations (such as Decree 356/2025), not Decree 13/2023.
Trap 3: collecting first, asking for consent later
Consent must exist before collection begins. Collecting first and seeking consent afterwards is a violation — the timing of consent is mandatory.
4. Protection measures commensurate with sensitive data
Because biometric data is sensitive, businesses must apply commensurate protection measures under Article 31 of Law 91/2025: access controls, encryption, purpose limitation, and an incident response process for data breaches.
5. Compliance checklist
- Define clearly the type of biometric data to be collected and the specific purposes;
- Build a separate consent form fully disclosing the data type, purposes, controller, and rights and obligations;
- Remove all pre-ticked boxes — customers must actively opt in;
- Obtain consent before starting collection;
- Apply technical protection measures commensurate with sensitive data;
- Update all legal documents from Decree 13/2023 references to Law 91/2025 and Decree 356/2025.
Contact us
FLAT Law Firm advises on personal data protection: compliance with Law 91/2025, consent mechanisms, and data policies for businesses. Contact: contact us.
Disclaimer: This article is for general information only and does not replace legal advice for your specific case. Laws may change; please consult a lawyer before acting.
Transparency label: This article was prepared with the support of the FLAW AI Legal Council, an AI-assisted legal review system. It is not a legal opinion from a human lawyer who has reviewed your case.