A digitized mechanical factory generates two data streams with entirely different legal value every day: production data such as machining parameters and heat-treatment formulas, and workers’ personal data such as faces, fingerprints and workstation locations. This article separates the legal duties for each stream under the Personal Data Protection Law 91/2025/QH15 and Decree 356/2025/ND-CP (replacing Decree 13/2023/ND-CP from 1 January 2026), and the Law on Intellectual Property 131/2025/QH15.
1. Classifying data in the digital factory
Production data is operational data: machine parameters, output, defect rates, quality data, maintenance history. This stream belongs to the business and may be protected as trade secrets when statutory conditions are met. Personal data is information tied to identifiable individuals: names, faces, fingerprints, attendance records, each worker’s location. Even when collected by company devices, personal data belongs to the worker and may only be processed within legal bounds.
Correct classification from the start underpins every later compliance measure.
2. Duties when processing workers’ personal data
Under the Personal Data Protection Law 91/2025/QH15 (effective 1 January 2026) and its guiding Decree 356/2025/ND-CP, before collecting personal data the business must notify and obtain the consent of the worker, except in cases prescribed by law. For facial-recognition attendance or AI surveillance cameras, the business must tell workers the collection purpose, data types, retention period and their rights. Consent must be voluntary and explicit — never coerced as in “no consent, no job”, and pre-ticked or default consent is prohibited (Article 6, Decree 356/2025/ND-CP).
Businesses must apply safeguards: access controls, encryption, access logging and a breach-response procedure. Where a detected violation may harm national defence, national security, public order and safety, or infringe the life, health, honour, dignity or property of workers, the business must notify the specialised personal-data protection agency under the Ministry of Public Security no later than 72 hours from discovery (Article 23, Law 91/2025/QH15); the notification contents follow Article 28 of Decree 356/2025/ND-CP. Notifying the workers themselves is required only in cases prescribed by law. Where a foreign vendor operates the MES system with cross-border transfer elements, the conditions in Article 20 of Law 91/2025/QH15 apply, together with an impact-assessment dossier for cross-border transfers under Articles 17–18 of Decree 356/2025/ND-CP.
3. Protecting production data as trade secrets
Core production data such as heat-treatment formulas and optimized machining parameters may be protected as trade secrets under the Law on Intellectual Property 131/2025/QH15 when three conditions hold: not common knowledge, usable in business with advantage, and protected by necessary confidentiality measures. The third condition is where businesses most often fail in disputes: without confidentiality measures, no trade-secret recognition.
Necessary measures in a digital factory include: confidentiality agreements with workers and partners, role-based MES access controls, drawing watermarks, and access-revocation procedures when staff leave. When a former employee takes technical data to a competitor, only a business with full confidentiality measures in place has grounds to pursue trade-secret infringement.
Conclusion
The more data a digital factory collects, the greater its legal duties in two directions: respecting workers’ personal-data rights and protecting production data as business assets. Building a clear internal data policy from the start costs far less than handling one data leak.
Frequently asked questions
1. Does facial-recognition attendance require workers’ consent?
Yes. Faces are sensitive personal data; the business must disclose the purpose, scope and retention period and obtain each worker’s consent before collection. A card-based alternative should be offered to those who decline.
2. Is production data like heat-treatment formulas a trade secret?
Yes, if three conditions hold: not common knowledge, usable in business with advantage, and protected by necessary confidentiality measures. The business must prove measures such as confidentiality agreements and access controls.
3. A foreign vendor operates the MES system. May data be transferred abroad?
Transferring workers’ personal data outside Vietnam must meet the conditions in Article 20 of the Personal Data Protection Law 91/2025/QH15, with an impact-assessment dossier for cross-border transfers under Articles 17–18 of Decree 356/2025/ND-CP (filed within 60 days of starting the transfer). Pure production data without personal data follows trade-secret rules and contract terms, with details requiring QA Council verification.
4. A departing worker takes technical data to a competitor. What can be done?
The business may pursue trade-secret infringement if it proves the data meets trade-secret conditions and it applied confidentiality measures. Signed confidentiality and non-compete agreements are the most important evidence.
5. What penalties apply to personal-data protection violations?
Violations may draw administrative fines at prescribed levels, plus remediation such as deleting unlawfully collected data. Where damage occurs, workers may claim compensation. Exact fine levels require QA Council verification.
This article has been quality-reviewed by the FLAW AI Legal Council.