Vietnam Recording Laws: One-Party Consent Rules and Penalties (2026)

Vietnam leans one-party consent: a participant in a phone call or in-person conversation may generally record without notifying others, because Penal Code Article 159 criminalizes violating the secrecy of communications "of another person," a third-party construction aimed at outside interception rather than a participant's own recording. Third-party interception remains a criminal offense under Penal Code Article 159 (Law No. 100/2015/QH13), carrying fines or up to three years imprisonment.

Quick Answer: Is Vietnam a One-Party or All-Party Consent Country?

Vietnam leans toward a one-party consent rule for participant recordings, grounded in the construction of Penal Code Article 159 itself. This is frequently misunderstood: the Penal Code's recording prohibition targets unauthorized third-party interception of communications "of another person," not a participant capturing their own conversation. A person who is a party to a phone call or in-person discussion may generally record it without disclosing that fact to other participants, and such a recording can, in practice, be submitted as evidence in civil proceedings under the Civil Procedure Code's electronic-evidence rules. This is a case-by-case judicial assessment rather than a settled statutory rule: Vietnam has no explicit one-party-consent carve-out comparable to, for example, section 184(2)(a) of Canada's Criminal Code. What remains clearly criminal is intercepting or wiretapping a communication between other people that you are not a party to.

The legal framework governing recording in Vietnam draws from multiple overlapping sources: the 2013 Constitution (Article 21), the 2015 Penal Code (Articles 158-159, Law No. 100/2015/QH13, amended by Law No. 86/2025/QH15 effective July 1, 2025), the 2015 Civil Code (Articles 32-38), the Personal Data Protection Law (Law No. 91/2025/QH15, effective January 1, 2026), the new Cybersecurity Law (Law No. 116/2025/QH15, effective July 1, 2026), and the AI Law (Law No. 134/2025/QH15, effective March 1, 2026). This article addresses each layer in turn.

Jurisdiction scope: This article addresses recording and privacy law in the Socialist Republic of Vietnam under Vietnamese national legislation. It does not address recording laws in other Southeast Asian countries. For a comparison of recording consent laws across countries, see our international recording laws overview.

Constitutional Foundation: Article 21

Vietnam's 2013 Constitution provides the bedrock for all recording and privacy protections. Article 21 states:

Paragraph 1: "Everyone has the right to inviolability of private life, personal secrets and family secrets; and has the right to protect his or her honor and reputation."

Paragraph 2: "Everyone has the right to privacy of correspondence, telephone conversations, telegrams and other forms of private communication. No one may illegally break into, control or seize another's correspondence, telephone conversations, telegrams or other forms of private communication."

This constitutional language is deliberately broad. It covers telephone conversations, electronic data, postal mail, and any other form of private communication. The operative phrase is "illegally break into, control or seize" (Vietnamese: xam pham trai phap luat). Vietnamese courts and legislators treat this as prohibiting unauthorized third-party recording, interception, and monitoring of private communications. A participant's own recording of a conversation they are having is not ordinarily characterized as "seizing" another person's communication.

Because this protection sits at the constitutional level, it overrides conflicting provisions in lower-ranking legislation and serves as the interpretive lens through which Vietnamese courts evaluate recording disputes. All recording-related statutes and decrees operate within the bounds Article 21 establishes.

Penal Code Articles 158 and 159: Criminal Liability for Privacy Violations

The 2015 Penal Code (Law No. 100/2015/QH13), most recently amended by Law No. 86/2025/QH15 (effective July 1, 2025), contains two directly relevant provisions: Article 158 on infringement of private life, personal secrets, and family secrets; and Article 159 on infringement of the secrecy of communications.

Article 158: Infringing Private Life and Personal Secrets

Article 158 criminalizes the broader invasion of private life beyond communications. Prohibited conduct includes:

• Illegally accessing a person's private diary, personal letters, or private records
• Illegally collecting, keeping, using, or disclosing information about another person's private life without consent
• Using images, audio recordings, or other information about a person's private life in a way that causes harm without that person's consent

Penalties under Article 158 for a first offense include a warning, a fine of VND 20,000,000 to 100,000,000 (approximately USD 770 to USD 3,850), or a non-custodial reform sentence of up to 2 years. Aggravated violations (organized groups, use of technology, causing serious harm to reputation) carry imprisonment of 1 to 3 years.

Article 159: Infringing the Secrecy of Communications

Article 159 specifically targets the secrecy of correspondence, telephone conversations, telegrams, and other forms of private communication. Prohibited conduct includes:

• Appropriating another person's mail, telegraphs, telex, or fax communications
• Deliberately damaging, losing, or obtaining transmitted documents
• Listening to or recording telephone conversations without legal authorization
• Unlawfully searching or confiscating mail, telegraphs, or electronic communications
• Any other acts that violate the secrecy of private communications

The phrase "without legal authorization" is the interpretive pivot point, and the article's own title supplies the answer: it protects the secrecy of communications "of another person," meaning the offense is built around a THIRD PARTY reaching into a communication between two other people, the same construction that excludes participants under comparable statutes in Denmark, Sweden, and Austria. Vietnamese legal commentary treats a participant's own recording of a conversation they are party to, made to protect a legitimate interest and not unlawfully disseminated, as carrying a low likelihood of Article 159 exposure (see "Recordings as Evidence" below), though this rests on the statute's structure and case-by-case commentary rather than an explicit exemption. Article 159 is squarely aimed at outside interceptors: someone tapping a phone line, installing a listening device in another person's home, intercepting emails from a third party's account, or obtaining private communications through unauthorized system access.

Penalties Under Article 159

A person convicted of a first-offense Article 159 violation faces:

Aggravating factors that elevate penalties to 1 to 3 years imprisonment include:

• Committing the offense as part of an organized group
• Abusing a position of authority or power
• Committing the offense more than once
• Causing damage to the victim's reputation
• Causing the victim to attempt or commit suicide

Note on 2025 Amendment: Law No. 86/2025/QH15, which took effect July 1, 2025, amended the Penal Code primarily to address corruption-related offenses. Articles 158 and 159 do not appear to have been substantively changed by this amendment, based on available analysis from Baker McKenzie and other commentators. The penalty ranges stated above remain in force.

Civil Code Articles 32-38: Personality Rights

The 2015 Civil Code (Law No. 91/2015/QH13) establishes a comprehensive system of "personality rights" in Articles 32 through 38. These civil-law protections operate independently of criminal liability and give individuals private causes of action in Vietnamese courts.

Article 32: Right to Personal Image

Article 32 provides that each individual has the right with respect to their own image. Using a person's image requires their consent. This applies directly to video recording: capturing and then using another person's image (whether in film, photography, or video) without their consent violates this right and creates civil liability. Exceptions exist for images captured in public activities (conferences, sports events, art performances) that do not harm the person's honor or dignity, and for images used by government authorities in the performance of their duties.

Article 34: Right to Honor and Dignity

Article 34 protects each person's honor, dignity, and reputation, and requires that no one may insult or defame another. Recording a conversation and then publicly disseminating it in a way that harms the subject's reputation can trigger liability under Article 34 even if the recording itself was lawful.

Article 38: Right to Private Life, Personal Secrets, and Family Secrets

Article 38 states that private life, personal secrets, and family secrets are "inviolable and protected by law." Specifically:

• The collection, retention, use, and disclosure of information relating to private life and personal secrets requires the consent of the individual concerned.
• Correspondence, telephone conversations, telegrams, electronic data, and other private communications are protected and kept confidential.
• The collection, retention, use, and disclosure of information relating to family secrets requires consent from all family members, except where law provides otherwise.

For recording purposes, capturing someone's private conversation, storing that recording, or sharing it with others without consent exposes the recording party to civil liability. Victims can pursue damages in Vietnamese civil courts. The civil right to private life under Article 38 complements criminal liability under the Penal Code.

Personal Data Protection Law (2025 PDPL)

Vietnam's most significant recent development in recording and privacy law is the Personal Data Protection Law (Law No. 91/2025/QH15), which took effect on January 1, 2026. This law replaced the earlier framework established by Decree 13/2023/ND-CP and introduced substantially strengthened requirements. The implementing regulation, Decree No. 356/2025/ND-CP, was issued on December 31, 2025, and took effect on the same date.

Consent Requirements Under the PDPL

Article 9 of the PDPL requires that consent for processing personal data must be:

• Voluntary (not coerced or bundled with unrelated services)
• Specific (tied to a particular processing purpose)
• Fully informed (the individual understands what data is collected and why)
• Provided separately for each processing purpose

Recording someone's voice or capturing their image constitutes personal data processing under this law. Any recording that captures personal data requires prior consent meeting all four criteria. This standard applies to organizations and businesses; individuals recording for purely personal purposes in a private context are not treated as data controllers under the law.

Article 29: Social Media and Online Communication Platforms

Article 29 targets technology companies and social media platforms operating in Vietnam. It prohibits organizations and individuals providing social network services and online communication services from:

• Eavesdropping on users
• Wiretapping or recording phone calls without user consent
• Reading text messages without user consent
• Collecting personal data beyond the scope agreed upon with the user
• Requesting images or videos of identification documents for account verification
• Tracking user activity without providing opt-out mechanisms

This provision directly addresses concerns about smartphone apps and communication platforms that may access microphones, record calls, or monitor messaging activity without clear user authorization.

Administrative Penalties Under the PDPL

The PDPL and Decree 356/2025/ND-CP introduced a tiered penalty structure:

These penalties apply to organizations. Individual violators may face additional criminal liability under Penal Code Articles 158 or 159 as described above.

Recording Phone Calls in Vietnam

A participant in a phone call may generally record that call without informing the other parties to the conversation. This position derives from the structure of Article 159 itself, which protects communications "of another person" and so targets third-party interception rather than participant recording. Vietnamese legal commentary treats a participant's own recording, made to protect a legitimate interest and not unlawfully disclosed, as carrying a low likelihood of criminal exposure, though the position is assessed case by case rather than resting on a settled statutory carve-out.

The 2013 Constitution (Article 21) and Penal Code Article 159 protect telephone communications from outside interference, not from the parties themselves. The PDPL consent requirements apply to organizational processing of personal data and to platforms providing communication services (Article 29), but do not alter the underlying one-party-leaning analysis for individual participants.

When Recording a Phone Call Becomes Illegal

A phone call recording crosses into illegal territory when:

• A person who is NOT a party to the call intercepts it (Article 159 criminal violation)
• The recording is made by bugging a telephone line or using unauthorized interception equipment
• A platform records calls without user consent in violation of PDPL Article 29
• A business records customer calls without proper consent disclosures required by the PDPL
• The recording captures special categories of personal data (health, biometric, financial) without the heightened consent required for sensitive data under the PDPL
• The recording is used to harm the subject's reputation (Article 34 Civil Code, Article 158 Penal Code)

Law Enforcement Exceptions

Vietnamese law permits recording of communications in limited circumstances:

• Law enforcement: Competent state authorities may authorize monitoring of private communications during criminal investigations, subject to procedural safeguards under the Criminal Procedure Code.
• National security: The Cybersecurity Law (and its successor, Law No. 116/2025/QH15) grants security agencies authority to monitor communications when national security is at stake.
• Court-ordered surveillance: A judge or prosecutor may authorize wiretapping or recording in connection with specific criminal proceedings.

Recording In-Person Conversations

The one-party-leaning treatment extends to in-person conversations. A participant in a face-to-face conversation may generally record it without the knowledge of other participants, consistent with the third-party construction built into Article 159 and Vietnamese commentary on participant recording. Article 159 references "telephone conversations" specifically; Article 158 addresses broader privacy infringement but requires the conduct to be "without consent" in a way that implies a non-participating third party.

The same caveat applies: the recording must not be used in a way that causes harm to the subject's reputation or discloses personal data in violation of the PDPL. Recording someone and then posting the recording publicly without their consent may violate Article 34 (honor and dignity) and Article 158 (infringement of personal secrets) even if the initial capture was permissible.

Public Spaces

In public spaces where people have a reduced expectation of privacy, recording carries less legal risk than recording a private conversation. Security cameras in businesses and public areas are regulated primarily through technical standards rather than outright prohibition. However, deliberately targeting an individual in a public place to capture their private conversation or personal data without consent can trigger liability under the Civil Code and the PDPL. The PDPL requires that the purpose of any recording be disclosed and consented to when the recording captures identifiable personal data.

Recording Police Officers and Public Officials

This is an area of active legal tension in Vietnam. Circular 46/2024/TT-BCA, issued by the Ministry of Public Security and effective November 15, 2024, addressed the recording of traffic police operations. The circular states that citizens are not permitted to audio or video record traffic police officers while they are carrying out their official duties.

However, legal commentators and official clarifications from the Traffic Police Department have noted that citizens who are directly involved in an enforcement action (for example, a driver being cited for a traffic violation) retain some right to document that interaction. The prohibition is directed primarily at uninvolved bystanders, journalists, and content creators who approach ongoing operations to film police activity for social media.

The rationale given by the Traffic Police Department is that police operations extend beyond traffic enforcement to include coordination with criminal investigation units, and indiscriminate filming may compromise ongoing operations or reveal operational methods.

Watch out: If you are not a direct party to a traffic enforcement action in Vietnam, recording the police conducting that action may violate Circular 46/2024/TT-BCA and expose you to administrative fines. If you are the driver or person subject to enforcement, you are in a stronger position to argue legitimate interest in documenting the interaction, but the legal position is not settled.

This restriction on recording public officials is more expansive than in many democracies. It reflects Vietnam's broader regulatory framework, in which the Ministry of Public Security has significant authority over surveillance and monitoring activities.

Workplace Recording and Employee Monitoring

Vietnam's Labor Code authorizes employers to monitor employees in the workplace to ensure compliance with internal labor regulations (ILRs). The 2025 PDPL has significantly narrowed the scope of permissible workplace surveillance, however.

What Employers May Do

Employers in Vietnam may:

• Install security cameras in common work areas (with appropriate notice to employees)
• Monitor company-owned computer and internet usage
• Block access to specific websites on company networks
• Use time-tracking and attendance systems that do not involve biometric data

What Requires Explicit Consent

The PDPL requires explicit consent from employees before an employer may:

• Use fingerprint or facial-recognition timekeeping systems
• Collect employee health information
• Track employee locations via company vehicles or work devices
• Use security camera footage for purposes beyond physical security
• Share employee data with third-party service providers
• Transfer employee data to entities outside Vietnam

Article 25 of the PDPL further specifies that employers may only collect job-relevant personal data. Data collected from job applicants who are not hired must be deleted unless the applicant agrees otherwise.

Recording Work Conversations

An employee who secretly records a workplace conversation with a colleague or supervisor does not face automatic criminal liability, because Article 159 addresses third-party interception rather than participant recording. However, the employee could face civil liability under Article 38 if the recording constitutes an invasion of personal secrets, and administrative penalties under the PDPL if the recording captures personal data without appropriate notice. An employer who discovers a surreptitious employee recording may treat it as a disciplinary matter under the labor regulations.

Employers who record employee conversations through hidden microphones, phone monitoring, or similar tools without disclosing the practice face civil liability under Article 38 and administrative penalties under the PDPL.

CCTV and Video Surveillance

Vietnam has tightened regulations around surveillance cameras significantly since 2024. Circular QCVN 135:2024/BTTTT, issued by the Ministry of Information and Communications, established mandatory technical security standards for all IP cameras sold or used in Vietnam. Full compliance was required by January 1, 2026.

The regulation imposes 11 technical requirements covering:

• Secure password mechanisms and access controls
• Login attempt limits to prevent brute-force hacking
• Vulnerability management and secure software update processes
• Data transmission encryption
• Secure storage protocols

Businesses operating CCTV systems in Vietnam must comply with both these technical standards and the PDPL's consent and data processing requirements. Using surveillance footage for purposes beyond the originally stated reason (such as repurposing security footage for employee performance evaluation) requires separate, explicit consent.

Voyeurism and Hidden Cameras

Vietnam has seen growing public concern about hidden cameras (spy cameras) in hotels, changing rooms, and restrooms. The legal response draws on several overlapping provisions.

Under Penal Code Article 158, using recording devices to capture another person's private life without consent constitutes an infringement of personal secrets. Installation of a hidden camera in a private space (bedroom, bathroom, hotel room, changing room) where a person has a clear expectation of privacy meets the Article 158 threshold and may result in imprisonment of 1 to 3 years under aggravated circumstances.

Administrative penalties for possession or installation of spy cameras in prohibited locations range from VND 3,000,000 to 30,000,000 (approximately USD 115 to USD 1,165) under the decree on administrative violations in information technology. The trade of disguised recording devices is restricted in Vietnam: sales of such equipment are permitted only to Ministry of Public Security-affiliated establishments, Ministry of Defense units, or entities with verified security certification.

In practice, prosecutions for hotel and accommodation voyeurism in Vietnam have increased, though the available administrative fines are widely criticized as insufficient deterrents given the severity of harm to victims. Civil Code Article 32 (image rights) and Article 38 (private life) both provide separate avenues for civil damages claims by victims of voyeuristic recording.

Deepfake and AI-Generated Content

Vietnam enacted the Law on Artificial Intelligence (Law No. 134/2025/QH15) on December 10, 2025. The law took effect on March 1, 2026, making Vietnam one of the first countries in Southeast Asia to establish a comprehensive AI regulatory framework.

Prohibited AI and Deepfake Conduct

The AI Law establishes an "unacceptable risk" category for AI systems that:

• Generate deepfakes that threaten national security, public order, or social stability
• Produce non-consensual explicit imagery
• Create political deepfakes designed to deceive the public
• Deploy large-scale facial recognition in public spaces without user consent
• Use techniques to manipulate individuals' cognitive behavior

Disclosure and Labeling Requirements

Organizations deploying AI systems that generate audio, image, or video content must:

• Conspicuously mark or label AI-generated content in a machine-readable format
• Clearly notify users if AI-generated content poses a risk of confusion regarding the authenticity of real events or persons
• Disclose when a user is interacting with an automated AI system (rather than a human)

Implementation Timeline

The law took effect on March 1, 2026. An 18-month grace period applies for AI systems in finance, healthcare, and education, and a 12-month grace period applies for all other sectors. AI systems already deployed before March 1, 2026 must be brought into compliance by the end of the applicable grace period.

These provisions interact directly with recording law: using AI to synthesize a person's voice in a recording that is then presented as authentic, or creating a deepfake video to simulate events that did not occur, violates the AI Law's prohibition on deceptive synthetic content and may also constitute defamation under Penal Code provisions and Civil Code Article 34.

Cybersecurity Law Considerations

Vietnam's new Cybersecurity Law (Law No. 116/2025/QH15) was passed on December 10, 2025 and takes effect on July 1, 2026. It consolidates and replaces the 2018 Cybersecurity Law (Law No. 24/2018/QH14), which remains in force until that date.

2018 Law (In Force Until June 30, 2026)

Article 26 of the 2018 Cybersecurity Law requires certain entities to store data, including user communication content and access logs, within Vietnam's territory. Cyberspace service providers must maintain system logs for at least 12 months to assist law enforcement investigations.

New 2025 Cybersecurity Law (Effective July 1, 2026)

Law No. 116/2025/QH15 explicitly prohibits:

• Intentional eavesdropping, recording, or filming of internet communications
• Illegal collection, use, dissemination, exchange, transfer, or trading of personal information and data
• Using new technologies to conduct prohibited activities in cyberspace

The 2025 law is more explicit than its predecessor in directly addressing recording of internet communications as a prohibited act. It also retains and strengthens data localization requirements. Organizations providing communication services or platforms in Vietnam will continue to be required to store specified categories of data within Vietnamese territory.

Cross-Border Considerations for Businesses

Foreign businesses that collect or process the personal data of Vietnamese individuals are subject to the 2025 PDPL regardless of where the business is physically located. The PDPL's territorial reach covers any entity that processes personal data of Vietnamese citizens, including multinational companies whose recording or data-collection activities affect Vietnamese users.

Cross-Border Data Transfer Requirements

Businesses transferring personal data out of Vietnam must:

• Conduct a Cross-Border Transfer Impact Assessment
• Submit a copy of that assessment to the Ministry of Public Security within 60 days of beginning the transfer
• Ensure the recipient jurisdiction or entity provides adequate data protection

For businesses that record communications involving Vietnamese users (such as call center recordings, video conference recordings, or AI-processed audio), those recordings constitute personal data under the PDPL. Transferring them to servers outside Vietnam requires the full cross-border transfer compliance process.

Penalty Exposure for Foreign Businesses

Cross-border personal data transfer violations under the PDPL carry fines of up to 5% of the entity's total revenue from the preceding financial year. This revenue-based penalty structure means that large multinational companies face substantially higher exposure than the VND 3 billion cap that applies to general data protection violations.

Recordings as Evidence in Vietnamese Courts

Vietnamese law allows audio and video recordings to be submitted as evidence, but admissibility depends on how they were obtained.

Legal Framework for Evidence

Article 94 of the Civil Procedure Code 2015 classifies audio recordings as a form of electronic evidence. Article 95 requires the submitting party to demonstrate both authenticity and legality.

Admissibility Requirements

For a recording to be admitted as evidence, it must:

• Be clearly audible with identifiable speakers
• Be directly connected to the parties in the case
• Include time-stamping or other contextual indicators
• Be supported by corroborating evidence when possible
• Withstand technical verification if the opposing party challenges its authenticity

The One-Party-Leaning Treatment and the Evidence Framework

Vietnam's own evidence rules for recordings sit in the Civil Procedure Code 2015. Article 94 classifies audio and video recordings as a form of electronic evidence, and Article 95 requires the submitting party to prove both the recording's authenticity (it has not been fabricated or altered) and its legality (it was not obtained through illegal means, such as unlawful interception under Penal Code Article 159).

Whether a participant's own recording of their conversation counts as legally obtained turns on Article 159's construction: because the offense protects communications "of another person," a participant capturing their own side of a call or conversation is not, by that act alone, the third-party interception the statute targets. Vietnamese legal commentary supports this reading: it treats a participant who records a conversation to protect a legitimate interest, and who does not unlawfully disseminate the recording, as carrying a low likelihood of Article 159 exposure. Recording another person's private conversation to harm their reputation or apply improper pressure, by contrast, can still fall within Article 159 or trigger civil liability under Article 158 and Civil Code Article 34.

This is a case-by-case judicial assessment rather than a settled statutory carve-out: Vietnam has no explicit one-party-consent exception comparable to, for example, section 184(2)(a) of Canada's Criminal Code. In practice, a participant-made recording in a business context (such as documenting an oral contract discussion) may be admitted when the court is satisfied it did not violate privacy rights or Article 159. A recording made by bugging someone's home or intercepting a call between other people will be excluded and may expose the person who made it to criminal charges.

Recordings work best as supporting evidence combined with documentary evidence and witness testimony, rather than as standalone proof.

Recording in Court Proceedings

Journalists and members of the public face restrictions on recording inside Vietnamese courtrooms. Under the Ordinance on Sanctions of Administrative Violations for obstructing procedural activities, recording video or audio of a trial without the consent of the presiding judge can result in fines of up to VND 15 million (approximately USD 575). Recording participants in court proceedings without their consent is also prohibited.

Business Compliance Checklist

Companies operating in Vietnam need to address recording and surveillance practices proactively. Under the 2025 PDPL and Decree 356/2025/ND-CP, organizations must:

• Conduct a Data Processing Impact Assessment (DPIA) within 60 days of beginning any data processing activity that includes recording or surveillance
• Appoint data protection personnel or engage an external data protection service provider (small businesses and startups that do not process sensitive data or provide data processing services receive a five-year grace period under PDPL Article 38)
• Obtain specific, informed consent before recording phone calls, monitoring communications, or using surveillance equipment that captures personal data
• Provide opt-out mechanisms for tracking and data collection on digital platforms
• Report data breaches within 72 hours of detection (changed from the prior "immediately upon occurrence" standard under Decree 13/2023)
• Comply with data localization requirements under the Cybersecurity Law for communication data
• Delete job applicant data if the applicant is not hired, unless the applicant consents to retention
• Conduct a Cross-Border Transfer Impact Assessment and notify the Ministry of Public Security if transferring recorded personal data out of Vietnam
• Comply with AI Law transparency requirements by March 1, 2026 (or within the applicable grace period) if using AI for voice synthesis, image generation, or deepfake detection

Penalties Summary

Vietnam imposes penalties for illegal recording through multiple channels: