Vietnam Defends Privacy Safeguards as Draft Law Expands Mandatory Digital ID Checks

Mandatory Identity Checks Put Consent at the Centre of Debate

Vietnam's proposed Law on Electronic Identification and Authentication would require national digital ID checks for online transactions in 11 sectors, from banking and healthcare to crypto assets and online games. Responding to lawmakers on November 4, 2026, Minister of Public Security Lương Tam Quang said the system would collect only necessary information, require consent and keep transaction content out of synchronised identification records.

The proposal would also allow state agencies to create digital identities automatically when national or specialised databases already contain complete and accurate information. People and organisations covered by that provision would not have to submit the same details again or register separately.

Those two features put a practical question at the heart of the parliamentary debate: how would people exercise consent when authentication is required to use a service and an identity can be created from information the state already holds? Quang outlined privacy protections, while lawmakers sought clearer limits on collection, stronger responsibility for technology providers and rules that distinguish routine activity from transactions carrying greater risk.

The proposal is being considered alongside a draft Law on Data Security during the second session of the 16th National Assembly. Together, the bills would set rules for establishing digital identities, checking who is using them and protecting the data involved.

What the Minister Promised on Privacy

Quang, who heads the ministry introducing the identification bill, told lawmakers that privacy protections would apply to both the information collected and the way identification systems exchange it. He described the proposed safeguards in these terms:

The collection of minimum data must have the consent of the data subject; transaction content must not be synchronised; and authentication results must not be shared beyond the permitted scope.

A data subject is the person whose information is being processed. In everyday terms, Quang's assurance means the system should collect only what it needs to identify someone, while keeping the details of the transaction outside the synchronised identification data.

Quang also said the principles, conditions, scope and purposes governing personal data processing would remain subject to existing personal data protection legislation. Electronic identification and authentication would have to comply with the Constitution and protect the rights and interests of individuals, organisations and state agencies.

The consent mechanism remains a central issue for users. The parliamentary explanations did not spell out what choices a person would have when declining data collection could prevent them from completing a transaction that requires authentication.

Which Services Would Require Authentication?

Clause 5 of Article 23 would require transactions in the following sectors to be authenticated through, and linked to, a national electronic identity:

• Securities.
• Telecommunications.
• Banking.
• Postal services.
• E-commerce.
• Healthcare.
• Payment intermediaries.
• Digital wallets.
• Crypto assets.
• Online video games.
• Domain name registration, leasing and use.

Authentication means checking that someone using a service is the person they claim to be. Linking connects the service account or transaction to that person's national electronic identity. For customers, the proposal would make that identity part of access to a broad range of financial, commercial and digital activities.

Ministers and heads of agencies at ministerial level could also designate transactions in other sectors when they carry high risk or create substantial legal obligations. The reach of the system could therefore extend beyond the 11 sectors named in the bill.

Thạch Phước Bình, a deputy from Vĩnh Long, proposed classifying transactions according to their risk. His examples show why the detail matters: booking a medical appointment involves a different level of sensitivity from opening medical records, just as checking a bank account differs from making a large transfer.

Automatic Identities and the Scope of State Identification

Articles 7 and 8 address who or what can receive an electronic identity and which categories state agencies would identify. The categories extend beyond individuals and organisations to locations, spaces, entities associated with core or important data, entities certified as owning or using goods considered high risk, and entities involving state secrets.

The government would issue the list of entities subject to state identification and set an implementation timetable. For specified entities under Article 8, agencies would automatically create identities and issue national identification codes where complete and accurate information already exists in national or specialised databases.

The administrative benefit is straightforward: an organisation or person would not need to provide information the state already possesses. The privacy debate concerns the breadth of the categories, the information attached to them and the rules governing its use.

An October 25 summary also included identification of events, transactions and behaviour. The Finance Ministry, Justice Ministry, Industry and Trade Ministry and Supreme People's Court sought clarification of that expansion. Its status in the revised bill is uncertain because the full text submitted to the National Assembly had not been made public.

The business chamber VCCI warned during consultation that the wording could bring nearly every ordinary commercial and civil transaction within identification duties. On October 26, the National Assembly's Committee on National Defence, Security and Foreign Affairs also warned that allowing sector agencies or service providers to choose which data fields to collect could lead to abuse and privacy violations.

A Separate Decree Already Sets Account Deadlines

The proposed law sits alongside an existing measure, Decree 320/2026, which took effect on September 28, 2026. That decree requires certain electronic transaction accounts to be linked and authenticated through VNeID, Vietnam's national electronic identification platform.

The two measures each name 11 sectors, but their lists differ. The decree covers education, securities, telecommunications, banking, e-commerce, electronic invoices, transport, tourism, pharmaceuticals, healthcare and Vietnamese social networks. Accounts on platforms including Facebook, TikTok and Zalo are also described as subject to its linking requirements.

The deadline for linking covered service accounts is December 31, 2026. Bank accounts have a later deadline of June 30, 2027. Social networks are absent from the draft law's list of 11 sectors, while the draft expressly includes crypto assets, digital wallets, online games and domain name services.

The timetable brings together existing duties and proposed changes:

• July 2026: Vietnam adopted its national digital transformation strategy covering five years.
• September 28, 2026: Decree 320/2026 took effect.
• October 25 and 26, 2026: A draft summary and parliamentary committee concerns brought the scope of identification into focus.
• November 4, 2026: The National Assembly discussed the identification and data security bills.
• November 21, 2026: The parliamentary session is scheduled to close, with the identification bill listed among measures expected to pass.
• December 31, 2026: Covered service accounts face the linking deadline.
• June 30, 2027: The linking deadline applies to bank accounts.

Why Lawmakers Want More Than Biometric Checks

Phạm Trọng Nhân, a deputy from Ho Chi Minh City, warned that advances in artificial intelligence are weakening assumptions about the reliability of faces, voices and fingerprints. He said biometrics remain necessary, but should not be the sole method for preventing fraud.

Biometric authentication checks a physical or behavioural feature associated with a person. AI tools can imitate some of those features, making it harder for a system to distinguish a genuine user from someone presenting fabricated material.

Tô Ái Vang, a deputy from Cần Thơ, called for clearer responsibility when an AI authentication system produces an incorrect result. She said the proposal places ultimate responsibility on organisations or individuals making decisions using the results, while the relationship with the technology developer or provider also needs attention.

Triệu Thị Ngọc Diễm, another deputy from Cần Thơ, proposed an express prohibition on unauthorised collection, use, disclosure or sharing of identification data and authentication factors. She cited the risk of criminals trading facial data, voice data and one time passwords. Her proposal addresses information that can become a means of entering someone else's account.

The Companion Bill Would Match Protection to Risk

The draft Law on Data Security would introduce five levels of data security risk. Controllers, the organisations or bodies responsible for deciding how data is processed, would classify the risks and apply corresponding protections. Oversight would operate mainly through inspections after those decisions.

Protection would cover the full life of data, from the design of a system to the destruction of information. Quang said the purpose of classification is to match duties to the harm a breach could cause, so that less sensitive activity faces lighter requirements while more dangerous exposures receive stronger protection.

The five levels would correspond to the five information system levels under cybersecurity legislation. Clause 4 of Article 8 would allow organisations to reuse existing cybersecurity risk classification results, avoiding two separate assessments of the same system.

The proposed risk levels would operate alongside the Law on Data's categories of core and important data. They would guide the choice of security measures, while those existing categories would continue to apply. The debate also covered the division of responsibilities between the public security and national defence ministries, security cryptography and post-quantum cryptography, which is designed to resist attacks using future quantum computers.

AI Data and Transfers Abroad Face Different Duties

The data security bill would require organisations developing or using AI to protect the origin and integrity of training data and data produced from it. It would prohibit data poisoning and unauthorised extraction, and provide for human intervention and oversight of automated decisions.

Data poisoning means deliberately corrupting the information used to train an AI system, potentially causing it to produce unreliable or manipulated results. For identification services, the quality and security of that information matters because automated errors can affect whether a person is accepted or rejected.

Transfers and processing across borders would face different procedures according to risk. Data at levels one and two would be exempt from procedures under this law. Controllers handling level three data would conduct their own assessments and retain records.

Transfers involving levels four and five would require appraisal and approval by the competent authorities before proceeding. The bill also addresses foreign requests for data, duties of service providers operating across borders, and the use of data security assessments within existing investment and technology transfer procedures.

VNeID's Scale Makes the Details Consequential

By October, VNeID had issued 86.4 million electronic identity accounts to Vietnamese citizens. The platform had more than 70 features, recorded over 500 million visits and attracted between three million and six million users a day.

Those daily user figures amount to roughly 3.5% to 6.9% of the number of issued accounts. The figures describe a platform with a very large registration base and a smaller group using it on any given day, even before the proposed law expands its role in essential transactions.

The government presents the identification measures as tools to combat online fraud, secure digital infrastructure and reduce administrative work under its national digital transformation strategy. For users, the concrete changes concern access to services, the handling of existing records and responsibility when an identity check goes wrong.

Quang said the drafting agency would work with the National Assembly committee responsible for defence, security and external relations to incorporate deputies' comments and report to the Standing Committee before finalising the bills. The next legislative milestone is the session's scheduled close on November 21; the existing account linking deadlines follow regardless of the debate over the new proposal.

Key Points

• The proposed identification law would require national digital ID authentication for transactions in 11 sectors, with authority to add other transactions carrying high risk.
• Quang promised minimum data collection, consent, limits on sharing authentication results and no synchronisation of transaction content.
• State agencies could create specified identities automatically using complete and accurate information already held in public databases.
• A separate decree sets account linking deadlines of December 31, 2026, and June 30, 2027, for bank accounts.
• Lawmakers sought stronger rules on AI provider responsibility, biometric fraud and unauthorised use of identification information.
• The companion data security bill proposes five risk levels, human oversight of automated decisions and stricter procedures for transfers of data at the highest risk levels.