Every e-commerce website collects customer data: names, phone numbers, delivery addresses, purchase histories, and even location and browsing behavior. From 1 January 2026, this activity is directly governed by the Personal Data Protection Law 91/2025/QH15 — which replaces Decree 13/2023/ND-CP for new obligations. Here are 7 points every e-commerce website owner must know.
1. An e-commerce website is a “data controller”
Under Clause 7, Article 2 of the Personal Data Protection Law 91/2025/QH15, the organization operating an e-commerce website decides the purposes and means of processing customer data and is therefore identified as a data controller. The consequence: the website is accountable to data subjects for all processing activities (Article 37) — it cannot shift blame to the web designer or hosting provider when an incident occurs.
2. Consent must come BEFORE collection
Clause 1, Article 11 requires the data subject’s consent to be obtained before collection. Consent must be voluntary, informed and given for each specific purpose; silence does not constitute consent (Article 9).
In practice: a pre-ticked “agree to receive promotions” checkbox, or bundling purchase consent with marketing consent, fails the law’s per-purpose requirement.
3. Disclose purposes, scope and retention before or at collection
The Consumer Rights Protection Law 19/2023/QH15 (Articles 16 and 17) requires businesses to publicly notify the purposes, scope and retention period of data before or at the time of collection, and to issue and publish personal data protection rules applied to the website.
Note: Article 15 of this law has been amended by the Cybersecurity Law 116/2025/QH15 — always check the latest amended version.
4. Collect only within the disclosed scope and purposes
The data minimization principle (Clause 2, Article 3): a website may collect data only within the scope and for the purposes notified and consented to. An online clothing store forcing customers to declare detailed income and occupation — beyond what delivery requires — breaches this principle.
5. Sensitive data: bank cards, location, tracking cookies
Bank card information, location data and behavioral tracking cookies fall into the sensitive personal data group, subject to a heightened protection regime (Article 4 of Decree 356/2025/ND-CP — effective 1 January 2026, prescribing the data catalogue). Websites using such data must meet significantly higher protection requirements than for ordinary data.
6. Respect data subjects’ rights
Customers have the right to withdraw consent, request erasure, request restriction of processing and object to the processing of their data (Articles 4 and 10 of Law 91/2025). Websites must design convenient mechanisms for exercising these rights — for example, an easy-to-find “delete account” or “withdraw marketing consent” button, handled within statutory time limits.
7. Data breaches: report within 72 hours and 24 hours
When a data protection violation occurs, the website must notify the Ministry of Public Security within 72 hours (Article 23 of the Personal Data Protection Law) and notify the competent state management authority within 24 hours under Article 19 of the Consumer Rights Protection Law. Businesses need a ready incident-response procedure so they are not caught off guard.
Frequently asked questions
Does the E-commerce Law 122/2025 govern customer data collection?
Not directly. Article 5.2 of the E-commerce Law 122/2025/QH15 (effective 1 July 2026) only refers to data legislation; the specific obligations follow the Personal Data Protection Law 91/2025.
Does Decree 13/2023 still apply to e-commerce websites?
From 1 January 2026, new obligations follow Law 91/2025/QH15; Decree 13/2023 should not be cited as the basis for new obligations.
Does a customer’s silence after receiving a collection notice count as consent?
No. Article 9 of Law 91/2025 expressly provides that silence does not constitute consent.
Sources
- Personal Data Protection Law 91/2025/QH15 — effective 1 January 2026: Articles 2, 3, 4, 7, 8, 9, 10, 11, 14, 21, 23, 33.2, 37, 38, 39;
- Decree 356/2025/ND-CP — effective 1 January 2026: Articles 3 and 4 (personal data catalogue);
- Consumer Rights Protection Law 19/2023/QH15: Articles 16, 17, 19 (note: Article 15 was amended by Cybersecurity Law 116/2025/QH15);
- E-commerce Law 122/2025/QH15 — effective 1 July 2026: Article 5.2 (reference to data legislation).
Conclusion
From 1 January 2026, e-commerce websites can no longer collect customer data out of habit: they need prior consent for each purpose, public disclosure of purposes, scope and retention, compliance with minimization, heightened protection for sensitive data, respect for data subjects’ rights, and readiness to report breaches within 72/24 hours. Reviewing these 7 points early helps businesses avoid legal risk when the new law takes effect.
Is your website ready to comply with the Personal Data Protection Law 91/2025? Contact FLAT Law Firm for a compliance review.
For reference only; not legal advice. This content was prepared by AI and will undergo quality review by the AI Legal Council of FLAT Law Firm before any publication consideration; it is not the legal opinion of a licensed human lawyer. Laws and regulations may change; verify the current legal texts before applying them.
