Tech companies hold vast amounts of user data: search histories, chat logs, images, usage behavior. So can tech companies use user data to train AI models? The answer is: it depends on the type of data — Vietnamese law distinguishes three different scenarios.
1. Data containing personal data: fresh purpose-specific consent required
If the training data contains personal data, the company must obtain the data subject’s prior consent specifically for the AI-training purpose (Article 9.4.a and Article 11.1 of the Law on Personal Data Protection No. 91/2025/QH15). The core principle: processing must not exceed the consented purpose — data consented for service provision does not automatically become usable for training AI models.
In addition, Article 7.3 of Law No. 134/2025/QH15 (effective 1 March 2026) prohibits using data to train AI in violation of the law.
2. Scenario 1: fresh consent for the AI-training purpose
When the company seeks and obtains the user’s separate, clear consent for AI training — voluntary and purpose-specific under Article 9.4 — the use is lawful. Note: an old consent for another purpose (for example service operation) is not enough; fresh consent is required.
3. Scenario 2: fully de-identified data
Under Article 2.1 and Article 14.6 of Law No. 91/2025/QH15, data that has been fully de-identified — i.e. the data subject can no longer be identified — is no longer personal data. Companies may use such data to train AI without seeking consent. The prerequisite is that de-identification must be thorough and irreversible.
4. Scenario 3: lawfully public data (published works)
For data consisting of lawfully published works or content, intellectual property law permits use for AI training under Article 7.5 of the amended Law on Intellectual Property No. 131/2025/QH15 (effective 1 April 2026). However, the company must respect the author’s reservation of rights under Decree 134/2026/ND-CP — if the author has reserved rights (not permitting exploitation of the work for AI training), the company may not use it.
5. Compliance checklist for tech companies
- Review data sources: classify training data into three groups — containing personal data, de-identified, lawfully public;
- Purpose-specific consent: for personal data, obtain fresh, separate consent for AI training; do not stretch an old consent given for another purpose;
- Thorough de-identification: if choosing de-identification, ensure re-identification is impossible;
- Respect authors’ reservations: check reservation of rights before using published works;
- Keep compliance records: retain evidence of consent and de-identification processes for inspections.
FAQ
Can user data consented for service provision be used to train AI?
No, unless the company obtains fresh consent for the AI-training purpose, or the data has been fully de-identified.
Is removing usernames from the dataset enough?
Not if individuals can still be re-identified from remaining data. De-identification must be complete — no possibility of identifying the person (Article 2.1, Article 14.6 of Law 91/2025).
Is scraping publicly available online content for AI training lawful?
For lawfully published works, yes under Article 7.5 of the amended IP Law 131/2025, but the author’s reservation of rights must be respected (Decree 134/2026).
References
- Law on Personal Data Protection No. 91/2025/QH15: Article 9.4.a, Article 11.1 (prior purpose-specific consent), Article 2.1, Article 14.6 (de-identification).
- Law No. 134/2025/QH15 (effective 1 March 2026): Article 7.3 (ban on unlawful use of data for AI training).
- Amended Law on Intellectual Property No. 131/2025/QH15 (effective 1 April 2026): Article 7.5.
- Decree 134/2026/ND-CP (authors’ reservation of rights).
This article is for reference only and does not constitute legal advice. The content was drafted by AI and will be reviewed for quality by the AI Legal Council of FLAT Law Firm before approval for publication; it is not the legal opinion of a licensed human lawyer. Laws and regulations may change; please verify the current legal texts before applying them.
Does your tech company need data and AI compliance advice? Contact FLAT Law Firm for support.
