Strengthening Vietnam’s legal framework for personal data protection and social responsibility: Lessons from Japan’s experience
-
DOIhttp://dx.doi.org/10.21511/kpm.10(3).2026.05
-
Article InfoVolume 10 2026, Issue #3, pp. 67-79
- 12 Views
-
2 Downloads
This work is licensed under a
Creative Commons Attribution 4.0 International License
Type of the article: Research Article
The rapid development of digital transformation, artificial intelligence, and data-driven economic models has heightened concerns about personal data protection and social responsibility in Vietnam. In this context, this study aims to assess Vietnam’s legal framework for personal data protection and propose policy reforms to enhance social responsibility. Social responsibility is understood as responsible data governance achieved through the implementation of principles of transparency and accountability, thereby enhancing trust, and through risk-based governance that both respects traditional rights and ensures that data flows are not hindered in the digital context. The study employs theoretical legal analysis and comparative law methods to examine comprehensive legal frameworks for personal data protection, particularly Vietnam’s Personal Data Protection Law 2025 and Japan’s Personal Information Protection Law. The results show that Vietnam’s personal data protection regime remains hampered by fragmented regulations and an overly consent-based approach, and that the fundamental principles of the legal framework for protecting personal data are merely symbolic and formal on paper due to weak enforcement and monitoring mechanisms. In contrast, Japan’s experience demonstrates the effectiveness of a centralized supervisory body, a guidance-based management model, risk-based governance, and regular legal review cycles in promoting socially responsible data use. Based on these findings, the study proposes policy recommendations for Vietnam, focusing on improving the structure of a synchronized and unified legal framework for personal data protection; establishing a data governance mechanism based on risk management principles; and creating an independent agency to coordinate the development, monitoring, and implementation of the law nationwide.
- Keywords
-
JEL Classification (Paper profile tab)K15, K24, K39, O38
-
References48
-
Tables0
-
Figures0
-
- Balboni, P., & Francis, K. E. (2025). Data ethics and digital sustainability: Bridging legal data protection compliance and ESG for a responsible data-driven future. Journal of Responsible Technology, 22, 100099.
- Bui, T. L., Tran, T. H. L., & Dang, T. H. (2025). Digital Technology and Data Security in Digital Education. Journal of Science Hanoi Open University, 7A, 446-455. (In Vietnamese).
- Bui, T. N. T. (2024). Một số giải pháp góp phần hoàn thiện dữ liệu cá nhân ở Việt Nam [Some solutions to improve Vietnam’s personal data protection law]. Vietnam Integration Journal, 339, 26-30. (In Vietnamese).
- Cahyani, A., Rosi, E. E., Yasmin, M., Jufri, S., & Saleh, J. (2025). Exploring the dynamics of personal data protection policies within the sustainable digital ecosystem: A scientometric and systematic literature review perspective. E3S Web of Conferences, 657(57), 01003.
- Hoang, M. K. (2026). Luật bảo vệ dữ liệu cá nhân và vấn đề thực thi – Kinh nghiệm từ một số quốc gia phát triển. [Personal data protection laws and enforcement issues – Lessons from several developed countries]. Tạp chí Tòa án nhân dân điện tử – Electronic Journal of the People’s Court, 26/03/2026. (In Vietnamese).
- Hohmann, B., & Kollár, G. (2025). Reflections on the data protection compliance of AI systems under the EU AI Act, Cogent Social Sciences, 11(1). 2560654.
- Information-technology Promotion Agency (IPA). (2023). Information security measures for SMEs: Guideline Version 3.1. IPA IT Security Center.
- Ishiwaka, K. (2025). Japan’s Personal Information Protection Legal Framework and Its International Initiatives. Joint Statement Initiative on E-Commerce Workshop.
- Katagiri, K., Sato, H., & Hirai, K. (2005). The position of personal information in CSR. Ritsumeikan Business Review, 43(5), 215-241. (In Japanese).
- Kitahara, M. (2007). Issues in Japan’s Act on the Protection of Personal Information. Shudo Law Review, 29(2), 23-46. (In Japanese).
- Le, N. Y., Nguyen, M. H., & Nguyen, T. N. L. (2024). Analysis of the issue of personal information security in Vietnamese legal documents. Journal of Science of Dong Thap University, 13(6), 113-120. (In Vietnamese).
- Le, T. V. A., & Duong, T. L. (2024). Xu hướng phát triển số và sự tham gia của cộng đồng doanh nghiệp vào phát triển khoa học, công nghệ và đổi mới sáng tạo ở Việt Nam. [Digital economy development trends and the business community’s participation in science, technology, and innovation development in Vietnam]. Journal of Economics and Development, 329(2), 47-55. (In Vietnamese).
- Matsuno, A. (2006). One year after the enforcement of the Act on the Protection of Personal Information]. Sompo Research Report, 77(2006), 45-68. (In Japanese).
- McCoy, M. S., Allen, A. L., Kopp, K., Mello, M. M., Patil, D. J., Ossorio, P., Joffe, S., & Emanuel, E. J. (2023). Ethical Responsibilities for Companies That Process Personal Data. The American Journal of Bioethics, 23(11), 11-23.
- Miyake & Partners. (2025). Latest trends in amendments to the Act on the Protection of Personal Information. Personal Information Protection Law Newsletter, 12. (In Japanese).
- Miyake & Partners. (2026). Articlebyarticle commentary on the 2026 amendment bill to the Act on the Protection of Personal Information – A detailed commentary based on the bill approved by the Cabinet on April 7, 2026. Personal Information Protection Law Newsletter, 15. (In Japanese).
- Muralinathan, S. (2025). Balancing data protection and human rights in the digital age: A review. International Journal of Science and Research Archive, 16(01), 505-515.
- Nasu, S. (2025). Key issues in the Act on the Protection of Personal Information. JILIS Report, 1, 1-15. (In Japanese).
- National Assembly of Vietnam. (2025). Law on Personal Data Protection. (In Vietnamese).
- Nguyen, L. M., & Ha, T. T. B. (2025). Enhancing personal data protection on E-Commerce platforms: A case study in Vietnam. Veredas do Direito, 22(2), e223116.
- Nguyen, N. A. D. (2023). Online Personal Data Protection Focuses on The Path of Vietnam’s Digital Transformation and The Next Stage. International Journal of Religion, 4(2), 166-172.
- Nguyen, T. P. C. (2025). Application of artificial intelligence in the healthcare sector and legal challenges: A study in Vietnam. Journal of Cultural Analysis and Social Change, 10(2), 1952-1962.
- Nguyen, T. P. C. (2026a). Vietnamese ethical and legal challenges in protecting patient privacy through informed consent. Veredas do Direito, 23(2), e234253.
- Nguyen, T. P. C. (2026b). Comprehensive Examination of Patients’ Data Privacy in Vietnam. Washington International Law Journal, 35(3), 30-64.
- Personal Information Protection Commission (PPC). (2017a). Introduction to the Act on the Protection of Personal Information. (In Japanese).
- Personal Information Protection Commission (PPC). (2017b). Handbook on the Act on the Protection of Personal Information. (In Japanese).
- Personal Information Protection Commission (PPC). (2022). Basic policy on the protection of personal information. (In Japanese).
- Personal Information Protection Commission (PPC). (2024). Guidelines on the Act on the Protection of Personal Information. (In Japanese).
- Personal Information Protection Commission (PPC). (2025a). Guidelines on the Act on the Protection of Personal Information (General rules). (In Japanese).
- Personal Information Protection Commission (PPC). (2025b). Considerations on institutional issues of the Act on the Protection of Personal Information. (In Japanese).
- Personal Information Protection Commission Secretariat (PPCS). (2025). Policies related to the handling of personal information. (In Japanese).
- Pham, T. H., Phan, T. A., Trinh, P. A., Mai, X. B., & Le, Q. C. (2023). Ảnh hưởng của cảm nhận về rủi ro bảo mật và quyền riêng tư đến niềm tin và hành vi kiểm soát quyền riêng tư của người dùng trên mạng xã hội [The effect of perceptions of security and privacy risks on users’ trust and privacy control behaviors on social networks]. Journal of Economics and Development, 314, 35-45. (In Vietnamese).
- Radanliev, P. (2025). Privacy, ethics, transparency, and accountability in AI systems for wearable devices. Frontiers in Digital Health, 7, 1431246.
- Rezac, F. (2022), The Role of Privacy Protection in Business Models for Sustainability: A Conceptual Integration from an Ecosystem Perspective. Journal of Business Models, 10(2), 31-57.
- Schubert, K. D., & Barrett, D. (2024). Chapter 5: Data Governance, Privacy, and Ethics. In M. C., Lacity & L. Coon (Eds.), Human Privacy in Virtual and Physical Worlds: Multidisciplinary Perspectives (pp. 87-110). Palgrave Macmillan.
- Srivastava, P., & Siddiqui, S. (2024). Data Protection in the Age of Social Regulation: A Conceptual. ShodhKosh: Journal of Visual and Performing Arts, 5(6), 1919-1924.
- Tada, T. (2006). Information security and corporate social responsibility. Unisys Technology Review, 86, 153-164. (In Japanese).
- TMI Associate. (2026). Commentary on the ‘Policy for Institutional Reform of the Act on the Protection of Personal Information, the so-called Triennial Review’ (January 9, 2026).
- To, T. L. (2024). Some legal aspects of personal data protection in the world – experience for Vietnam. Cogent Social Sciences, 10(1), 2414872.
- Tran, T. L. (2024a). Xây dựng khung pháp lý chung ASEAN về chuyển dữ liệu quốc tế: Kinh nghiệm từ Liên minh châu Âu [Developing a common ASEAN legal framework on international data transfers: Experiences from the European Union]. Vietnam Journal of Legal Sciences, 11(183), 68-80.
- Tran, V. D. (2024b). Bàn về phát triển quy phạm đạo đức trong tiến trình xây dựng pháp luật về trí tuệ nhân tạo [On the development of ethical norms in the process of developing laws on artificial intelligence]. Vietnam Journal of Legal Sciences, 9(181), 30-39. (In Vietnamese).
- Trinh, P. T. (2025). Những điểm nổi bật của Luật bảo vệ dữ liệu cá nhân mới của Việt Nam (Luật BVDLCN 2025) [Key highlights of Vietnam’s new Personal Data Protection Law]. Vietnam Business Law (Venture North Law). (In Vietnamese).
- Vamsi, K. P. (2025). Privacy, Surveillance, and Consent in the Age of Automated Data Processing: Societal Implications of Enterprise Analytics. European Modern Studies Journal, 9(5), 976-983.
- Verdoodt, V., Zang, Y., & Lievens. E. (2024). Safeguarding the child’s right to privacy and data protection in the European Union and China: a tale of state duties and business responsibilities. The International Journal of Human Rights, 28(2), 125-147.
- Wylde, V., Prakash, E., Hewage, C., & Platts, J. (2023). Post-COVID-19 Metaverse Cybersecurity and Data Privacy: Present and Future Challenges. In C. Hewage, Y. Rahulamathavan, & D. Ratnayake (Eds.), Data Protection in a Post-Pandemic Society: Laws, Regulations, Best Practices and Recent Solutions (pp. 1-48). Cham: Springer.
- Yeung, K., & Bygrave, L. A. (2021). Demystifying the modernized European data protection regime: Cross-disciplinary insights from legal and regulatory governance scholarship. Regulation & Governance, 16(1), 137-155.
- Zhang, J. (2026). Research on legal issues of personal information protection in the context of big data. Journal of Cases on Information Technology, 28(1), 1-15.
- Zisu, M.-A. (2025). Personal Data Protection in the Era of Artificial Intelligence: Legal Challenges and Solutions. Anuarul Universității “Petre Andrei” din Iași, Fascicula: Drept, Științe Economice, Științe Politice, 34, 251-259.


