Information about an agricultural product is being digitised and a QR code added for traceability before it is listed on an e-commerce platform.— VNA/VNS Photo

HÀ NỘI — In the digital economy, the convergence of social media, data-driven advertising and e-commerce has created increasingly complex data flows, exposing consumer information to risks of misuse, unauthorised disclosure and illegal trading for fraudulent purposes.

Consumer data has become a valuable business resource, particularly in e-commerce and online advertising.

Protection weakens as data crosses borders

A consumer in Hà Nội who uses a foreign shopping application may unknowingly share personal information with multiple parties, including overseas platforms, sellers, delivery companies and payment processors. The application may also track browsing habits and purchasing behaviour.

Months later, the consumer could receive a scam call mentioning a recently purchased product, without knowing whom to contact or which country's laws apply if their data has been leaked.

In fact, more than 6.9 million user accounts in Việt Nam were exposed in the first quarter of 2026 alone.

Nguyễn Mạnh Tùng, a resident of Hải Phòng, questioned how far Vietnamese law could protect consumers when their personal data was transferred overseas and what measures they could take to safeguard themselves.

Under the Law on Personal Data Protection and the Law on Protection of Consumers' Rights, consumers are entitled to be informed, give or withdraw consent, and request the correction or deletion of their personal data, regardless of where it is processed.

However, enforcement remains problematic, particularly regarding notification of data breaches. Current notification requirements cover certain cases involving biometric, location and sensitive financial or banking data, but may not extend to breaches involving names, phone numbers, addresses and purchase histories. Consumers could therefore remain unaware that their information has been compromised.

Dr. Nguyễn Ngọc Quyên from Hanoi Law University identified three main channels for cross-border data transfers: direct collection by foreign platforms; overseas storage or processing by domestic businesses; and the sharing of information among multiple parties involved in cross-border transactions.

Although Vietnamese legislation provides a legal framework for regulating these activities, protection weakens as data passes through multiple jurisdictions and service providers. Mechanisms for joint responsibility and liability remain insufficient.

Dr. Quyên stressed the need for detailed implementing regulations and further consideration of amendments to the Law on Personal Data Protection to ensure consumers' rights remain enforceable across borders.

Challenges in handling violations

Recent violations include the use of customer information for unauthorised advertising, illegal trading of customer databases and data leaks from e-commerce platforms.

According to Hoàng Bích Thủy of the National Competition Commission under the Ministry of Industry and Trade, identifying responsible parties is a major challenge, as data is often processed through complex networks involving platforms, storage providers, advertising agencies and other intermediaries.

Collecting evidence is also difficult, particularly when transactions take place through electronic systems or platforms based overseas. Consumers may struggle to prove unlawful data use, identify responsible parties and demonstrate damages.

Thuy called for stronger legal oversight, improved capacity to detect organised data-trading networks and greater compliance responsibilities for businesses and digital platforms.

An effective legal framework in the digital economy must rest on three pillars: prevention through compliance obligations, strict and proportionate sanctions, and restoration of the lawful rights and interests of affected individuals, she emphasised.

These measures will help strengthen corporate accountability, build consumer confidence and improve state management of data-driven business activities, she added. — VNA/VNS