10 common personal data protection risks in businesses and how to check for them yourself

Personal data risk rarely starts with a major leak. It usually sits in very ordinary tasks: HR receives CVs by email, staff clock in with facial recognition, Marketing downloads a customer list from the CRM, Sales sends details to a delivery company, or the business uses software from a foreign vendor. Since 1 January 2026, the Law on Personal Data Protection (Law No. 91/2025/QH15) and Decree No. 356/2025/ND-CP have been in force, so these gaps are no longer just an internal technical matter. This article sets out 10 risk situations FC Legal often sees when working with businesses. It explains the relevant law, gives self-check questions for each situation and suggests where to start your review.

1. Why is personal data risk usually found in day-to-day work?

Each activity on its own, such as receiving CVs, installing cameras or sending a delivery list, looks completely normal. But when you place them in the full lifecycle of the data, businesses often find many gaps that have never been treated as a legal issue.

Analysis: The problem is not whether the business collects data. It is that each department handles data in its own way, and nobody has the full picture. Policies, contracts and procedures then easily drift away from what actually happens.

The personal data lifecycle in a business

1. Collection
2. Use
3. Storage
4. Access
5. Sharing
6. Transfer
7. Deletion or destruction

2. Group 1: The business cannot see all the data it processes

Risk 1: Not knowing exactly what personal data the business holds

Try asking at a management meeting: “What personal data does the company currently store?” HR has one answer, IT has another, Marketing has its own list, Sales has the CRM, Accounting has payment information, and the cameras are managed by Administration.

A business may be processing data of customers, employees, job candidates, partners’ representatives, suppliers, website or app users, and office visitors. If you cannot yet answer the chain of questions what data → where → who manages it → who can access it → what it is used for → who it is shared with, the first gap is data mapping.

Risk 2: Having a privacy policy while actual operations have changed

A privacy policy is often written when the website is launched. Later the business adds a CRM, marketing automation and analytics tools, changes cloud provider, launches an app, adds a loyalty programme, hires a call centre, connects to logistics partners or uses AI, but the policy stays the same. The result: the documents say one thing and the systems do another.

Self-check question: When did the business last compare its privacy policy with its actual data flows? If the answer is “we don’t remember”, this is a point to review.

3. Group 2: HR data and biometric data

Risk 3: HR collects a lot of data but does not manage it as a data system

For many businesses, the largest set of personal data is not about customers but in HR. One employee may leave behind: a CV, a photo of their ID card, address, phone number, bank account, tax information, dependants, timekeeping data, camera images, performance reviews, health records and data on leaving. This data is scattered across email, Excel, Google Drive/OneDrive, HRM software, payroll, HR staff’s own computers and vendors’ systems.

The question is not just “Does HR protect its files?” but also: who can access them, which data is really needed, which vendors process it, how long it is kept, and where the data goes when an employee leaves. So HR data should be reviewed as a separate programme.

Risk 4: Using facial or fingerprint timekeeping without a separate review of biometric data

A timekeeping machine is often bought as a piece of office equipment. But the data it processes is far more sensitive than an ordinary timesheet. The business needs to know: what data is actually stored; whether it is stored on the device or in the cloud; whether the vendor can access it; how long it is kept; who can export it; whether it is synchronised to other systems; and what happens when an employee leaves.

A very practical question: if the business changes its timekeeping vendor tomorrow, where will the current biometric data go? If there is no clear answer, this is a warning sign.

4. Group 3: Marketing, Sales and customer data

Risk 5: Marketing creates more data collection points than the business realises

Website, landing pages, social media ad forms, CRM, email marketing, chatbots, loyalty programmes, events, remarketing: each channel is a data collection point. A customer may pass through the chain landing page → CRM → email platform → Sales → customer service without any single governance mechanism.

So the question is not only “Did the customer tick the consent box?” but also: consent for which purpose; where the data is used afterwards; who can access it; whether it is moved to other systems; and, when the customer withdraws consent, whether the downstream systems are updated too.

Risk 6: Staff export customer data to Excel and send it by email or messaging apps

A very everyday situation: Sales exports data from the CRM, downloads it to Excel, sends it to a colleague or a vendor, and the file then stays in the Downloads folder or the mailbox. Data that was in a controlled system has now multiplied into copies outside anyone’s control.

Try checking: who is allowed to export CRM data; how much can be exported each time; how long files are kept; whether they may be sent by email or uploaded to a personal Drive; and who is responsible for deleting them once the work is done. Sometimes the risk is not in a large system but in one Excel file.

Analysis: A business that buys “potential customer data” from outside, or shares customer lists with partners in exchange for a benefit, should assess this carefully. This is the group of acts with the highest maximum fine under the Law.

5. Group 4: Vendors, cloud and data going abroad

Risk 7: Vendors hold data, but the contract only says “confidentiality” in general terms

Payroll, CRM, cloud, marketing agencies, call centres, logistics, IT outsourcing, recruitment services: each may access part of your personal data. But when the business opens the contract, it often finds just one sentence: “The parties shall keep information confidential.”

Analysis: A general confidentiality clause does not answer the core data governance questions: what data the vendor processes and for what purpose; what it may and may not do; whether it may pass the work to a third party (subcontractor); in an incident, who notifies whom and how quickly; and how data is returned or deleted when the contract ends. The business remains primarily responsible to the data subjects, so gaps in the contract are the business’s own risk.

Risk 8: Using international cloud or SaaS without mapping cross-border data flows

Microsoft 365, Google Workspace, AWS, Azure, CRM, HR platforms, marketing platforms, a group ERP. As soon as a business uses some international systems, the questions of where data is stored, who receives it and who can access it become important. For FDI companies, employee data and management reports may also be shared with the parent company.

The right question is not only “Where is the server?” but: who outside Vietnam can access the data, and which systems does the data pass through? Answer this before deciding the specific legal obligations.

6. Group 5: Data subjects’ rights and incident response

Risk 9: There is a procedure on paper, but nobody knows what to do when a data subject makes a request

The policy may say that individuals can access, correct or delete their data, or withdraw consent. But when a real request arrives, who receives it: Customer Service, Legal, IT, Marketing or HR? Then who verifies identity, who searches the systems for the data, who decides how to handle it, who replies and who keeps the record?

Without a clear procedure, the business has a policy but not the ability to run it. Decree No. 356/2025/ND-CP sets specific deadlines for each type of request, so passing a request back and forth between departments can easily lead to missed deadlines.

Risk 10: Only thinking about data protection after an incident has happened

One morning, IT finds signs that an administrator account has been hacked. Or a customer file is sent to the wrong person, a laptop holding data is lost, or a vendor reports a problem with its system. If the business only then asks who is in charge, whether it must report, which data is affected, whether customers need to be told, and who deals with the authorities, it is already on the back foot, while the notification deadline is counted in hours.

7. What do these 10 risks have in common?

HR, Marketing, IT, vendors, cloud, cameras, CRM, incidents: on the surface they are very different, but they all come back to one problem. A business cannot protect data it has not seen and whose processing it does not understand. So the first step is not necessarily buying more software or writing more policies. It is diagnosing the current state.

8. A 60-second self-check for businesses

Answer Yes / No / Not sure to the following 10 statements:

• We know all the types of personal data the business processes.
• We know which systems the data is held in.
• We know who has access rights.
• Our privacy policy correctly reflects current operations.
• Employee data has been reviewed separately.
• We know which vendors access the data.
• We know which data is transferred to or accessed from abroad.
• We have a procedure for handling data subjects’ requests.
• We know who does what if an incident occurs.
• Records and procedures are updated when processing activities change.

Many “No” or “Not sure” answers do not mean the business is in breach. But they are a sign that a closer check is needed.

9. Where should your business start?

Instead of launching a large compliance project straight away, FC Legal recommends a cycle from identification to monitoring. An initial quick assessment reviews these areas: data, people, processes, documents, vendors, technology, incident response and governance structure. The result shows which issues to deal with first, which areas need a deeper review, and whether a full assessment is needed.

Personal data protection review roadmap

1. Identify: where does the business process data?
2. Diagnose: where are the gaps?
3. Prioritise: which issues should be dealt with first?
4. Fix: legal, processes, contracts, technical measures
5. Monitor: periodic review, updates, training

10. Frequently asked questions

When did the Law on Personal Data Protection take effect?

The Law on Personal Data Protection, Law No. 91/2025/QH15, was passed by the National Assembly on 26 June 2025 and is in force from 1 January 2026. On the same day, Decree No. 356/2025/ND-CP implementing the Law took effect and replaced Decree No. 13/2023/ND-CP. Businesses that complied under Decree 13 should review their records and procedures against the new framework.

Is facial or fingerprint timekeeping data sensitive data?

Yes. Article 4 of Decree No. 356/2025/ND-CP classifies biometric data as sensitive personal data. Businesses should tightly control where it is stored, the device vendor’s access rights, the retention period and deletion when an employee leaves.

Does using Google Workspace or Microsoft 365 count as transferring data abroad?

It depends on how the data is stored and who abroad can access it. The business should map its data flows first, then check them against Article 18 of Decree No. 356/2025/ND-CP to decide whether a cross-border data transfer impact assessment dossier (Form No. 09) is required or an exception applies.

What are the fines for personal data protection violations?

Article 8 of Law No. 91/2025/QH15 sets the maximum fines for organisations: VND 3 billion for most violations; up to 5% of the previous year’s revenue for cross-border transfer violations; up to 10 times the revenue obtained for buying or selling data. These are ceilings. The specific amounts are set by the penalty regulations.

Do small businesses have to meet all the obligations?

Article 41 of Decree No. 356/2025/ND-CP exempts micro businesses and household businesses from certain obligations. Small businesses and start-ups may choose whether to apply them for 5 years from 1 January 2026. The exception does not apply if the business provides data processing services, processes sensitive data, or processes the data of a large number of data subjects.

11. Legal basis and references

• Law on Personal Data Protection, Law No. 91/2025/QH15 dated 26 June 2025, in force from 1 January 2026.
• Decree No. 356/2025/ND-CP dated 31 December 2025 detailing certain articles of and measures to implement the Law on Personal Data Protection (Articles 4, 13, 18, 19, 29 and 41).
• Civil Code 2015 (Article 38).
• Law on Cybersecurity, Law No. 24/2018/QH14.
• Thư viện Pháp luật and LuatVietnam: full text and summaries of Decree No. 356/2025/ND-CP.
• EY Vietnam: legal alert on Decree No. 356/2025/ND-CP.