AI Compliance Vietnam: Automation Is the Same Project

Direct answer

Data compliance and business automation are the same project, and small businesses in Vietnam keep paying for it twice. Both start from an identical artefact: a written map of what personal data you hold, where it enters, who touches it and when it goes. Compliance calls it a data inventory. Automation calls it a process map. It is one document.

Vietnam's Law on Personal Data Protection took effect on 1 January 2026, and most micro-businesses responded by opening two folders - one for the lawyer, one for the software - and doing the same discovery work in both. This article is an argument for one folder, done once, used twice.

What law are we actually talking about?

Vietnam's Law on Personal Data Protection, Law No. 91/2025/QH15, was passed by the National Assembly on 26 June 2025 and took effect on 1 January 2026. It runs to five chapters and 39 articles, and it establishes a set of individual rights over personal data: to be informed, to consent, to access, to correct, and to request deletion.

It is accompanied by Decree No. 356/2025/ND-CP, issued on 31 December 2025 and effective on the same date, which sets out detailed procedures and implementation measures across five chapters and 42 articles.

Read those five rights again as an engineer rather than a lawyer. "Be informed" is a notice you must be able to produce. "Access" and "correct" mean you must be able to find one person's data on request. "Delete" means you must know everywhere it lives. Those are not legal properties. They are system properties.

Why do compliance and automation start from the same document?

Because both are blocked by the same missing thing: nobody has written down how the business actually handles information. Ask a micro-business where a customer's phone number lives and the honest answer is usually four places, one of which is a personal messaging app.

To comply, you must be able to answer that question. To automate, you must be able to answer that question. The document you produce - what data, entering where, held how long, visible to whom - is the compliance data inventory and the automation process map, unchanged, with different headings.

The same overlap runs through the details. One artefact, two names, depending on who is asking for it:

A consent checkbox is a compliance control and an automation trigger. A structured intake form replaces a chaotic inbox and gives you a lawful, recorded basis at the same moment. A retention rule is both a legal obligation and the thing that stops your database rotting.

"Every micro-business we help has already done half the compliance work and does not know it, because they did it while trying to make the WhatsApp mess stop." - [LotusGuard internal expert - title to be confirmed] (placeholder quote: must be approved and attributed before publication)

Does the law really apply to a five-person business?

Yes. The baseline obligations - a privacy policy, a consent mechanism, and honouring data subject rights - apply regardless of company size. Some documentation duties may be adjusted for small and start-up operators under Decree 356/2025/ND-CP, but the core duties are not switched off because you are small.

This surprises people who assume data law is an enterprise concern. It is not, and the reason is straightforward: the individual whose data you hold has the same rights whether you are a bank or a bakery with a customer spreadsheet.

The practical read for a micro-business is that the obligations are proportionate, not absent. You are not expected to run a bank's privacy programme. You are expected to know what you hold and be able to act on a request about it.

What does doing it once look like in practice?

One pass, five outputs. The sequence below produces both your compliance baseline and your automation backlog from a single piece of work.

1. List every intake point. Website form, Zalo, Facebook messages, phone, paper, POS, spreadsheet. Every place a name or number enters.
2. For each one, record four things. What data, why you hold it, where it goes, when it is deleted.
3. Mark the ones with no lawful basis or no notice. These are your compliance gaps.
4. Mark the ones a human retypes. These are your automation candidates.
5. Fix them together. The intake points that fail both tests are the ones to rebuild first, because one build closes two problems.

Steps 1 and 2 are the whole job. Most micro-businesses can do them in an afternoon with a whiteboard, and most never do them because neither the lawyer nor the software vendor asks for them in that form.

What goes wrong when you automate first?

You build on data you had no basis to hold, and then the automation becomes load-bearing. This is the expensive failure mode, and it is common because automation has a visible payoff and compliance does not.

A typical sequence: a business connects its customer list to a messaging tool, the tool works, the workflow spreads, and eighteen months later someone asks where the consent for marketing messages came from. There is no answer, and by then the workflow cannot simply be switched off because the business runs on it.

Undoing that costs more than building it correctly, because you are now changing a live system, re-contacting customers, and explaining a gap rather than preventing one. Order matters more than effort here: the same total work, done in the wrong sequence, produces a rebuild.

Can I put customer data into an AI tool?

Only if you have a lawful basis and your customers were told. The tool is rarely the problem. The problem is pasting identifiable customer data into a service that your privacy notice never mentioned and your customer never agreed to.

Decide in advance what the tool is allowed to see. In most micro-business cases the useful answer is: not names, not phone numbers, not addresses. A chatbot can be genuinely useful working from your policies, prices and FAQs while never touching an identifiable record.

Where the tool does need real data, that becomes a disclosed processing activity like any other - named in your notice, covered by your basis, and subject to the same access and deletion duties as the spreadsheet it came from. That is a design decision, and it is much cheaper to make before you connect the tool than after.

Where should a micro-business start on Monday?

With a list, not a purchase. Write down every place personal data enters your business. That single page is the prerequisite for both the compliance work and any automation worth building, and it is the step almost everyone skips in favour of buying a tool.

Then pick the one intake point that is both a compliance gap and a manual burden, and fix that one. You will have a working example of the principle rather than an argument about it.

Be wary of anyone selling you compliance and automation as separate engagements with separate fees. That pricing reflects how the vendor is organised, not how the work is shaped. LotusGuard takes no third-party commission and does not resell software, which is why we can tell you the second project is mostly the first one again.

Frequently asked questions

Does Vietnam's personal data law apply to very small businesses? Yes. Baseline obligations such as a privacy policy, a consent mechanism and respecting data subject rights apply regardless of size under Law 91/2025/QH15, in force since 1 January 2026. Some documentation duties may be lighter for small operators, but the core duties are not waived.

What is the first step to comply with Vietnam's data protection law? Map your data. Write down every place personal data enters your business, where it is stored, who can see it and when it is deleted. Almost every other obligation, and almost every automation you would want to build, depends on having that map first.

Can I use ChatGPT or a chatbot with customer data in Vietnam? Only if you have a lawful basis and have told customers. The problem is rarely the tool itself; it is pasting identifiable customer data into a service your privacy notice never mentioned and your customer never agreed to. Decide what the tool may see before you connect it.

Is compliance worth it for a business with five staff? The compliance work is largely the same work as making your operations legible enough to automate. If you do it once and use it for both, the marginal cost is small. If you treat them as two projects, you pay twice for the same map.

What happens if I automate first and comply later? You usually rebuild. Automations get wired directly to data you had no basis to hold, or to tools that were never disclosed. Unpicking that later costs more than designing it correctly, because by then the workflow is load-bearing.

Conclusion

Three things to take away. Vietnam's data law has applied to businesses of every size since 1 January 2026, so "we are too small" is not a position. The document that unlocks compliance is the same document that unlocks automation, so doing them separately is paying twice. And sequence matters: automating before you have mapped your data usually means rebuilding it later.

If you want that map built once and used for both, talk to LotusGuard - we do not resell the software we recommend, so the map is the deliverable, not the sales hook.