What types of sensitive personal data are included?

Lawyer Ho Thu Trang, YouMe Law Firm LLC, replied:

Clause 3, Article 2 of the Law on Personal Data Protection 2025 (effective from January 1, 2026) stipulates as follows: Sensitive personal data is personal data attached to the privacy of individuals. When violated, it will directly affect the legitimate rights and interests of agencies, organizations, and individuals, on the list issued by the Government.

Article 4 of Decree No. 356/2025/ND-CP stipulates that sensitive personal data includes:

a) Data revealing ethnic origin;

b) Political, religious and belief views;

c) Information on private life, personal secrets, and family secrets;

d) Health status;

d) Biometric data, genetic characteristics;

e) Data revealing the sexual life and sexual orientation of individuals;

g) Data on crimes and law violations collected and stored by law enforcement agencies;

h) The location of the individual is determined through the positioning service;

i) Information on the login name and password to access the individual's electronic identification account; image of ID card, citizen identification card, ID card;

k) Login name, access password of bank account; bank card information, data on transaction history of bank account; financial information, credit and information on activities, history of financial transactions, securities, insurance of customers at credit institutions, foreign bank branches, payment intermediary service providers, securities, insurance, and other licensed organizations;

l) Data tracking the behavior and activities of using telecommunications services, social networks, online communication services and other services in cyberspace;

m) Other personal data that are required by law to be kept confidential or require strict security measures.

2. In the process of processing sensitive personal data, agencies and organizations must establish regulations on decentralization of access restrictions, processing processes and security measures.

Thus, from January 1, 2026, the above data is considered a sensitive personal data.

See the original here