Health data, financial data and biometric data are the groups that Personal Data Protection Law 91/2025/QH15 classes as sensitive personal data in Article 2 — and assigns a markedly stricter processing regime: separate consent, a mandatory data protection organisation and heavier incident responsibility. Hospitals, financial institutions and every factory timekeeping by face recognition should re-audit their whole processing chain from 2026.
Governing Instruments
The stricter processing conditions for sensitive data
Article 2 of Law 91/2025 divides personal data into basic data and sensitive data; the sensitive class includes health data, biometric data, financial data, precise geolocation and further groups detailed by the Government. The legal consequence of the classification is an enhanced condition package on every processing activity: the subject must be clearly informed that the data is sensitive before processing; consent — where it is the processing basis — must be given separately for this data class and not buried in one blanket consent; and the controller must apply commensurate safeguards, including role-based access control, encryption in storage and transit, and access logging.
The key organisational point: controllers and controller-processors of sensitive personal data must designate a personal data protection unit and responsible personnel — a requirement inherited from Decree 13/2023/ND-CP and codified in the Law 91/2025 framework with its guiding Decree 356/2025/ND-CP. For hospitals, clinics, banks, finance companies and enterprises using biometric timekeeping this is not optional: having no formally designated data protection function is a stand-alone violation, separate from whether any data was ever leaked. The Article 21 impact assessment file must also describe the safeguards for each sensitive data group processed.
Application Analysis
By sector, the application points differ. Healthcare: medical record data is simultaneously sensitive data under Law 91/2025 and confidential medical-record information under healthcare law — providers must synchronise the two regimes, especially when sharing data with insurers or uploading it to group systems. Finance: transaction and credit data also sit under the State Bank’s information-safety rules; biometric authentication for online transactions under Decision 2345/QD-NHNN shows biometrics is already mandatory industry infrastructure, and every biometric collection point is a separate compliance duty. Factory biometrics: fingerprints and faces used for timekeeping are sensitive data even if the purpose is “only attendance” — the enterprise must offer an alternative for employees who do not consent (card, PIN) and may not use biometric data for any purpose beyond what was notified.
When an incident hits sensitive data, the response mechanism has two layers: notification to the specialised data protection authority within the statutory period (72 hours from detection under the current mechanism inherited from Decree 13/2023 and the new framework), with notification to affected subjects where the incident risks harm; and legal liability — administrative sanctions under the Law’s violation-handling provisions and the specialised sanctions instruments, civil compensation to harmed subjects, and in grave cases criminal liability under current law. Sanction gravity scales with data sensitivity and the number of affected subjects, so the same leak is always assessed more heavily when it involves biometric or medical data than when it involves ordinary contact data.
Recommended Actions
- Inventory sensitive data per system (medical records, transactions, biometrics) and tag the Article 2 Law 91/2025 classification in the data map.
- Designate the data protection unit and personnel in writing; publish the function in the Article 21 file and the privacy policy.
- Separate sensitive-data consent from general consent: its own form, its own purposes, its own withdrawal path; re-paper consents collected on old blanket forms.
- Apply enhanced technical measures: encryption at rest and in transit, role-based access, access logging for sensitive data and periodic access reviews.
- Build a dedicated sensitive-data incident playbook: the 72-hour notification mark, subject notification templates, isolation and evidence-preservation steps.
Frequently Asked Questions
What stricter processing conditions apply to sensitive data in healthcare, finance and biometrics from 2026?
Four enhanced conditions over ordinary data under the Law 91/2025 framework: (1) clear notice to the subject that the data belongs to the sensitive class in Article 2, with the specific purpose, before collection; (2) consent — where it is the processing basis — given separately for the sensitive class, not buried in a multi-purpose blanket consent; (3) designation of a data protection unit and personnel responsible for this data; (4) commensurate technical and organisational safeguards — access control, encryption, logging — with the Article 21 impact assessment describing safeguards per sensitive group. Missing any one condition is a stand-alone violation, even if no data incident has occurred.
Must an enterprise designate a data protection organisation when processing sensitive data?
Yes. Controllers and controller-processors of sensitive personal data must designate a data protection unit and dedicated personnel — a requirement originating in Decree 13/2023/ND-CP and codified in the Law 91/2025 framework with guiding Decree 356/2025/ND-CP. The designation must be in writing, define its scope (data types, systems, liaison with the specialised authority) and be reflected in the impact assessment file. Small-scale sensitive-data processors are still within the duty; what scales with size is the form of the unit, not whether the duty exists.
What separate form must consent for sensitive data take?
Consent for sensitive data must be separate on three axes: separate in document — a distinct consent statement (or a distinctly highlighted section) covering only the sensitive data class and its specific purpose, not merged into service terms; separate in act — the subject performs a distinct affirmative act (signature, separate tick, separate in-app confirmation), never inferred from consent to ordinary processing; and separate in lifecycle — withdrawing sensitive-data consent must be independently possible and must stop processing of that data class even while other processing continues. Consents collected on blanket forms before 2026 should be re-collected in this separated structure.
How are sensitive-data violations sanctioned, and how does incident notification work?
Two mechanisms run in parallel. Incident notification: on discovering a violation or leak of sensitive data, the enterprise must notify the specialised data protection authority within the statutory period — 72 hours from detection under the current mechanism — and notify affected subjects where the incident risks harm, while applying containment and remediation measures. Violation handling: breaches are administratively sanctioned under the violation provisions of Law 91/2025 and the specialised sanctions instruments, with corrective measures such as forced data deletion or processing suspension; harmed subjects may claim civil compensation, and grave conduct can attract criminal liability. Because sensitive data carries a higher gravity coefficient, the same incident is ordinarily sanctioned more heavily than one involving ordinary data.
