Customer data security for aesthetic clinics under the 2026 data law

Which regulations currently apply?

Decree 13/2023/ND-CP on personal data protection ceased to be effective on 1 January 2026. Consent that customers gave under Decree 13 remains valid, so clinics do not need to ask for it again.

Which customer data is sensitive data?

The Law divides personal data into two types: basic and sensitive. Sensitive data carries stricter obligations, and aesthetic clinics process this type of data every day.

Treating before-and-after photos as sensitive data is a cautious interpretation, not the wording of the decree. For clinics, though, it is the safest approach, because those photos are tied to the customer's health condition and treatment.

When is a customer's consent valid?

Under the Law (Article 9) and Decree 356/2025 (Article 6), consent is valid only when it is:

• Voluntary and informed: the customer knows the type of data, the purpose, who processes it and their own rights. For sensitive data, the customer must be clearly told that it is sensitive data.

• Given for each purpose: consent to treatment does not mean consent to advertising. Several purposes may not be bundled into one signature.

• Verifiable: in writing, by text message, by email, by recorded call, or through a mechanism on a website or app. The clinic must keep the evidence.

• Never silent, never pre-ticked: silence or no response is not considered consent, and pre-ticked consent boxes are prohibited.

For health information specifically, the Law (Article 26) requires the customer's consent to collect and process it, except in certain cases such as emergencies. Clinics also may not transfer a customer's data to another healthcare facility or an insurance company unless the customer requests it in writing.

The table below suggests how to separate purposes when drafting a consent form:

Are small clinics exempt?

This is a point many people misunderstand. The Law lets small businesses and start-ups choose whether or not to apply certain obligations for 5 years, and exempts household businesses and micro-enterprises, but only for two obligations: preparing an impact assessment dossier and appointing a person in charge of data protection.

More importantly, this exemption does not apply to facilities that directly process sensitive personal data (dữ liệu cá nhân nhạy cảm). Clinics process customers' health information, so they almost certainly belong to the group that must:

• Prepare a personal data processing impact assessment dossier and send it to the specialized personal data protection agency (Ministry of Public Security) within 60 days of starting processing.

• Appoint a department or person qualified to protect personal data, or hire an organization or individual that provides this service. Under Decree 356/2025, the appointed person needs a college degree or higher, at least 2 years of relevant experience, and training in personal data protection.

The remaining obligations, such as obtaining consent, keeping data secure and reporting incidents, apply to every facility, including spas and household businesses.

How large are the fines?

The Law sets a maximum fine of VND 3 billion for most violations, up to 10 times the revenue earned from buying and selling data, and up to 5% of the previous year's revenue only for violations involving transferring data abroad. Decree 330/2026/ND-CP sets out the specific fines. Below are some violations clinics are likely to run into (fines for individuals are half these amounts):

If a data breach occurs that could harm a customer's life, health, honor or property, the clinic must notify the specialized agency within 72 hours at the latest.

Customer data security day to day: permissions and logs

The Law sets the obligations, but customer data security day to day depends on how the clinic operates. The most common risk is not hackers. It is data sitting on staff members' personal phones, Excel files sent around in group chats, or shared accounts where anyone can see everything.

The basic principle is that each person sees only the data they need for their own work:

• Receptionists see schedules and contact details, but not treatment forms or photos.

• Consultants see the conversations and needs of the customers they look after.

• Doctors and technicians see the treatment records of customers in their own shift.

• Branch managers see their own branch's data, but not other branches'.

Every time customer data is viewed, edited, exported or deleted, the action should be logged with who did it and when. This log helps detect incidents and also serves as evidence that the clinic has protective measures in place. Our article on spa customer records management suggests who should see which groups of information.

10 things clinics should do now

1. 1

   List the data you collect, where it is stored and who can see it.

2. 2

   Rewrite your consent form so that each purpose is separate and sensitive data is clearly identified.

3. 3

   Keep evidence of each customer's consent, and do not use pre-ticked boxes.

4. 4

   Prepare the impact assessment dossier and submit it within 60 days.

5. 5

   Appoint a person in charge of data protection in writing, or hire a service.

6. 6

   Give each staff member their own account, and lock it as soon as they leave.

7. 7

   Do not consult with customers or store their photos on personal devices and accounts.

8. 8

   Set permissions by role and by branch, and turn on activity logs.

9. 9

   Export data only when necessary and with someone's approval.

10. 10

    Write an incident response procedure in advance, so you can notify within 72 hours.

Permissions and logs are the part that needs a supporting tool. Qub-X is one option, with permissions by role and by branch, plus activity logs on customer data. For licensed clinics, see also the security requirements for EMR for aesthetic clinics.

Frequently asked questions

Do spas have to comply with the Law on Personal Data Protection?

Yes. The Law applies to every organization and individual that processes personal data, including spas and household businesses. If a spa stores information about customers' skin condition, allergies or health, it should handle that information as sensitive data.

Do customers who consented under Decree 13/2023 need to consent again?

No. Consent obtained under Decree 13/2023/ND-CP remains valid. From now on, new consent requests must follow the Law and Decree 356/2025.

Do I need consent to send promotions to past customers?

Yes. Advertising and promotions are a separate purpose from treatment and care. Ask for separate consent for this purpose and give customers an easy way to opt out of messages.

What do I need before posting a customer's before-and-after photos on social media?

You need the customer's separate consent to use the photos in advertising, with evidence kept on file, and an agreement on payment, if any. Publishing photos without consent can be fined VND 30–50 million for organizations, with mandatory removal.

Sources

• Law on Personal Data Protection No. 91/2025/QH15 (Official Gazette) (in Vietnamese)

• Decree 356/2025/ND-CP guiding the Law on Personal Data Protection (Official Gazette) (in Vietnamese)

• Decree 330/2026/ND-CP on administrative penalties in cybersecurity and personal data protection (Official Gazette) (in Vietnamese)

• Law on Medical Examination and Treatment 2023, consolidated text 26/VBHN-VPQH (in Vietnamese)

• Civil Code 2015 (Official Gazette) (in Vietnamese)

This article summarizes documents issued up to October 2026. It is for reference only and does not replace legal advice. Clinics should consult a lawyer when drafting consent forms and impact assessment dossiers.