Protecting Privacy and Personal Data in Older-Person Care in Viet Nam: From Care Records and Family Communication to Privacy-Respecting Monitoring

Protecting Privacy and Personal Data in Older-Person Care in Viet Nam: From Care Records and Family Communication to Privacy-Respecting Monitoring

During a home visit, a care worker notices swelling in an older person's ankle and takes a photograph to seek clinical advice. At a residential care facility, a daughter asks to receive her father's daily care notes. Elsewhere, a provider considers installing cameras so staff can respond more quickly when residents need assistance.

Each situation begins with a reasonable concern about care or safety. Yet the information involved may reveal far more than is necessary for the immediate task. A photograph can remain on a personal phone, a care note can reach relatives who were not meant to receive it, and a camera installed for safety can capture moments that someone reasonably expects to remain private.

Older-person care depends on sharing information. Workers need to understand health conditions, functional limitations, medication arrangements and personal preferences. Family members often help coordinate appointments, treatment and everyday support. But the need to communicate does not remove the older person's rights concerning their personal information.

As home-based, community and residential care services develop in Viet Nam, privacy protection needs to become part of their everyday operations. The challenge is to ensure that relevant information reaches those who need it for a justified purpose without allowing access, disclosure or monitoring to extend beyond what is necessary and legally permitted.

Privacy Is Part of Care Quality, Not Only Information Security

An older person who needs help with bathing, dressing, medication or mobility may have to share details that would ordinarily remain private. This dependence can make personal boundaries harder to maintain, particularly when several workers or family members are involved.

A worker assisting with mobility may need to know about falls risk and physical limitations. A nurse may need access to medication records and recent clinical observations. Neither necessarily requires unrestricted access to the person's financial circumstances, family relationships or entire medical history.

Information recorded during routine care may also be legally sensitive. Article 4 of Decree No. 356/2025/NĐ-CP identifies categories of sensitive personal data that include health status, information concerning private life and personal or family secrets, biometric data and location information obtained through location services. Care notes may contain such information even when they are maintained by a provider outside the formal medical examination and treatment system.

Privacy also has a personal dimension that cannot be addressed through cybersecurity measures alone. Someone may wish to discuss a health concern without relatives listening, receive assistance with personal hygiene without unnecessary observation, or decide which family members are told about a sensitive diagnosis.

International aged care standards recognize these concerns as part of care quality. Australia's Strengthened Aged Care Quality Standards, which took effect on 1 November 2025 for providers within their regulatory scope, address dignity, respect and privacy under Outcome 1.2. Outcome 2.7 addresses information management, including the accuracy, accessibility, confidentiality and appropriate use of information.

These are Australian regulatory requirements, not Vietnamese legal standards. Nevertheless, they offer a useful reference for service improvement. Information needs to be available when it is required for safe care, while access remains appropriate to the person's circumstances, preferences and legal rights.

Understanding the Legal Responsibilities in Viet Nam

Viet Nam's personal data protection framework changed substantially at the beginning of 2026.

The Law on Personal Data Protection No. 91/2025/QH15 entered into force on 1 January 2026. Decree No. 356/2025/NĐ-CP, which details its implementation, became effective on the same date, replacing Decree No. 13/2023/NĐ-CP. Decree No. 330/2026/NĐ-CP subsequently took effect on 19 August 2026, establishing administrative sanctions for specified violations concerning cybersecurity and personal data protection.

A further change is scheduled. Decree No. 392/2026/NĐ-CP, issued on 20 October 2026 and due to take effect on 15 November 2026, amends certain administrative procedures under Decree No. 356/2025/NĐ-CP. Organizations preparing personal data processing impact assessments or cross-border transfer documentation should check which procedural requirements apply when their submissions are made.

For care providers, the central issue is whether collecting, using, storing or disclosing information meets the conditions established by the relevant legal provisions.

Article 9 of the Law on Personal Data Protection sets out requirements for valid consent. Consent must be voluntary and informed, with the individual aware of the categories of data being processed, the purposes of processing, the relevant controller or controller-processor, and the individual's rights and obligations. Consent must be expressed through a clear, specific and verifiable method for the relevant purposes. Silence or failure to respond cannot be treated as consent.

A general agreement to receive care should therefore not be interpreted as permission for every subsequent use of personal information. Collecting information to arrange home-care visits, for example, does not automatically authorize its use in promotional material or unrestricted sharing with relatives.

At the same time, Vietnamese law does not make consent the only circumstance in which personal data may be lawfully processed. Article 19(1) identifies situations in which consent is not required, including specified urgent circumstances involving the protection of life, health or other legally protected interests, and other circumstances established by law. These exceptions have their own conditions and should not be used as general justification for unrelated disclosures.

Health-related information receives specific treatment under Article 26. Its collection and processing are subject to consent requirements, except in the circumstances provided under Article 19(1). Article 26(2) also restricts organizations and individuals operating in the health sector from providing personal data to third parties that are healthcare service providers or providers of health or life insurance, except where the data subject makes a written request or an applicable Article 19(1) exception applies.

This provision is particularly relevant when designing arrangements for referrals, external consultations and information exchange with other organizations. The applicable legal conditions need to be considered in the context of each arrangement, including the status of the parties involved and any relevant sector-specific requirements.

Other Vietnamese laws remain important. Article 32 of the Civil Code No. 91/2015/QH13 addresses rights relating to personal images, while Article 38 protects private life, personal secrets and family secrets, subject to legally specified exceptions.

For licensed medical examination and treatment services, the Law on Medical Examination and Treatment No. 15/2023/QH15, as amended, adds specific requirements. Article 10 protects patients' privacy and confidentiality in medical care, while Article 69 governs medical records, including their protection and the circumstances in which they may be accessed.

A hospital, residential social assistance establishment and nonmedical home-care provider may therefore share general personal data protection responsibilities while being subject to different requirements concerning medical records, professional practice and service operations.

An ordinary home-care note should not automatically be treated as a statutory hospital medical record. Equally, personal information does not fall outside data protection requirements simply because it was recorded in someone's home rather than in a hospital.

Family Involvement Does Not Mean Unlimited Access

Family participation is often central to older-person care in Viet Nam. Adult children may arrange appointments, pay for services, coordinate transport, communicate with workers and provide much of the assistance needed at home.

Their contribution can be essential. However, close involvement in someone's care does not automatically create an unrestricted right to that person's personal information.

Consider an older woman receiving home-care services. Her son manages payments and transport, while her daughter accompanies her to medical appointments. She may be comfortable with both receiving scheduling updates but prefer that only her daughter be involved in discussions about a sensitive medical condition.

The provider needs a way to respect these differences rather than treat the family as a single group with identical access rights.

At the beginning of a care arrangement, the organization should establish whom the older person wishes to involve, which information may be shared, for what purposes and through which communication channels. The relevant permissions and preferences should be documented appropriately and reviewed when circumstances change.

The distinction between an emergency contact and an authorized recipient of sensitive information is particularly important. A person listed for emergencies may need to be contacted quickly if something goes wrong, but that designation alone does not establish authority to receive complete care records. Similarly, responsibility for payment does not necessarily confer authority over confidential health information.

Questions become more complex when an older person has dementia, fluctuating cognition or communication difficulties. A diagnosis of dementia should not automatically be equated with a legal determination that the person cannot make decisions. Their ability to understand and express preferences may vary according to the decision, circumstances and support available.

Care workers should seek to involve the older person as far as possible, using appropriate communication support where necessary. When legally recognized representation is required, the organization must establish the representative's authority rather than assume it from family relationship alone.

Article 24 of the Law on Personal Data Protection addresses the exercise of data subject rights through legal representatives in specified circumstances, including those involving people who have lost or have limited civil act capacity or have legally recognized difficulties in cognition and behavioral control. The Civil Code provides the broader legal framework for determining capacity and representation.

These provisions require careful application, particularly when relatives disagree about what information they should receive or who should make decisions.

Urgent circumstances may justify particular disclosures under an applicable statutory exception to protect life or health. In such situations, the disclosure should remain appropriate to the emergency and be documented in accordance with relevant requirements.

These safeguards are not intended to exclude families from care. They help providers involve relatives appropriately while preserving the older person's rights and preferences.

Keeping Care Records Accessible Without Making Them Exposed

Many privacy failures arise through ordinary work practices rather than deliberate misuse.

A paper assessment may be left where visitors can read it. Several workers may use the same electronic account. A photograph taken for a legitimate care purpose may remain on an employee's personal phone. A daily update may be forwarded to a family messaging group without checking who belongs to it.

None of these situations requires a sophisticated cyberattack. They can occur in services that have never experienced a major information security incident.

An organization first needs to understand what information it collects, why it is needed, where it is stored and who requires access. Permissions should reflect actual responsibilities. Workers should be able to obtain the information needed for safe care without gaining access to unrelated records.

Paper-based services require secure storage, appropriate handling during transfers and safe disposal when records are no longer required. Electronic systems need suitable authentication, account management, access restrictions and procedures for reviewing inappropriate or unauthorized access.

Shared accounts can make it difficult to determine who viewed or changed a record. Staff access should therefore be linked to identifiable users wherever appropriate and reviewed when roles change or employment ends.

Information accuracy is another aspect of responsible management. An outdated emergency contact, incorrect medication entry or unverified statement carried forward through successive care notes can create practical risks. Records should distinguish documented facts and observations from interpretations and unconfirmed information, especially when sensitive personal or family circumstances are involved.

Photographs require particular care. An image of a wound or swollen limb may help an appropriately qualified professional understand a clinical concern, but its collection, transmission and storage must meet the applicable legal requirements. The organization should also consider whether the image needs to identify the person and whether the same purpose could be achieved with less information.

A photograph taken for care should not later be used in staff training, marketing or social media merely because it is already available. Each materially different purpose must be considered under the applicable consent and other legal requirements.

Messaging applications present similar challenges. They can make communication faster, especially when workers visit different homes or coordinate care across locations. Yet a familiar application is not necessarily an approved or suitable channel for exchanging sensitive personal information.

Providers should establish which communication methods are permitted, who may create or join groups, what information can be shared and how important care communications are documented when necessary. They also need procedures for verifying recipients and responding when information is sent to the wrong person.

Good information governance does not necessarily begin with purchasing an expensive electronic record system. A small provider can make meaningful improvements by establishing clear rules about documentation, access, photography and communication, then ensuring that workers understand and follow them.

Monitoring Technology Requires More Than a Safety Justification

Cameras, movement sensors, emergency alerts and other monitoring technologies may help care providers identify certain risks or respond when assistance is needed. Their usefulness, however, depends on how they are selected, implemented and managed.

Monitoring can reveal details about someone's movements, daily routines, personal relationships and private activities. The fact that equipment is intended to improve safety does not automatically make every form of recording appropriate.

A camera covering a facility entrance creates different privacy concerns from one continuously recording a resident's bedroom. Audio recording may capture confidential conversations. A device installed in a shared room may affect several residents, visiting relatives and workers, even if its original purpose concerns only one person.

Before introducing monitoring, an organization should be clear about the problem it is trying to solve. A concern about residents leaving an area without assistance may call for a different response from a concern about delayed emergency alerts or unauthorized entry.

Less intrusive arrangements should be considered where they can reasonably achieve the intended purpose. In some circumstances, an alert system or movement sensor may provide useful information without continuous identifiable video recording. Such alternatives still require assessment because sensor data may also constitute personal data.

The Care Quality Commission in England provides guidance on surveillance in care services, including the importance of establishing legitimate purposes, consulting affected people and minimizing intrusion into privacy. Its guidance emphasizes that surveillance should be considered in relation to the rights and circumstances of those being monitored.

These principles are useful for quality improvement, but UK regulatory requirements do not apply automatically in Viet Nam.

Vietnamese law must be assessed independently. Article 31 of the Law on Personal Data Protection contains specific provisions concerning personal location and biometric data. Article 32 addresses personal data obtained through audio and video recording in public places and during public activities under specified conditions.

The circumstances in which recording may take place without consent in public settings should not be interpreted as general authorization to record private bedrooms, bathrooms or other intimate care environments.

The Civil Code's protections concerning personal images and private life are also relevant. Where monitoring affects employees, applicable employment-related personal data protection rules must be considered alongside those protecting residents and visitors.

A provider considering surveillance should therefore assess the proposed location, purpose, legal conditions, people affected and extent of information collected. Particularly intrusive arrangements warrant careful documented assessment and appropriate legal review before installation.

Even where monitoring is lawfully justified, organizations need controls over who can view live information, retrieve recordings or share them with others. Retention periods should be appropriate to the purpose and applicable law, with safeguards against unauthorized access or later reuse.

Family access to camera feeds deserves particular caution. A relative's desire to check on an older person does not automatically justify unrestricted remote viewing, especially where other residents or workers may be recorded.

Similar concerns arise when relatives install cameras in a private home where care workers provide assistance. The older person's wishes, the rights of other household members and the privacy of visiting workers may all require consideration.

Monitoring should also be reassessed when circumstances change. Equipment introduced to manage a specific risk may no longer be necessary after changes in health status, mobility or care arrangements.

Technology should support rather than replace competent care. A camera may capture an event, but it does not ensure that someone will recognize the problem, respond in time or provide appropriate assistance.

Managing External Providers and Cross-Border Information

Care organizations increasingly rely on external software vendors, cloud services, administrative contractors and digital platforms. These arrangements can improve coordination, but they also introduce additional parties into the handling of personal information.

Providers should understand which organizations determine the purposes and means of processing, which process data on behalf of others and what responsibilities apply to each arrangement.

Contracts and operating procedures should address authorized purposes, access, security, incident reporting, retention and the return or deletion of information where applicable. A service agreement with a technology vendor should not leave the care provider unable to explain where sensitive information is stored or who can access it.

Cross-border processing requires particular attention.

Article 20 of the Law on Personal Data Protection addresses cross-border personal data transfers. Its scope includes transferring personal data stored in Viet Nam to overseas storage systems, transferring data from Viet Nam to foreign organizations or individuals, and specified uses of overseas platforms to process personal data collected in Viet Nam.

The Law and Decree No. 356/2025/NĐ-CP establish relevant impact assessment and procedural requirements, together with specified exceptions. Amendments under Decree No. 392/2026/NĐ-CP will also need to be considered once they take effect.

Using an overseas platform is not automatically prohibited, but neither should a provider assume that a widely used international service is automatically compliant. The actual data flows, processing activities, applicable exceptions and required documentation need to be examined.

These questions are best addressed before introducing a new system. Once personal information has been distributed across multiple accounts, devices or external platforms, correcting inappropriate access and retention arrangements can become considerably more difficult.

Retention, Individual Rights and Privacy Incidents

Information does not become safer simply because it is stored for longer.

Care organizations should establish retention arrangements that reflect the purpose of each record and any applicable legal requirements. Medical records maintained by licensed healthcare facilities may be subject to statutory obligations that differ from those applying to ordinary service administration or communication records.

An older person's request to delete information must be considered under the relevant personal data protection provisions and any continuing legal duties. Such a request should not be rejected automatically, but it does not necessarily override statutory record-retention requirements.

Article 4 of the Law on Personal Data Protection recognizes rights concerning knowledge of data processing, consent, access, correction and other requests, subject to applicable legal conditions. Article 14 addresses deletion, destruction and de-identification, including circumstances in which information must be deleted and limitations on deletion requests. Decree No. 356/2025/NĐ-CP provides further procedures for exercising relevant rights.

These rights need to be workable in practice. An older person who notices an incorrect entry or wants to understand how their information is being shared should know where to direct the request and how it will be handled.

Despite preventive measures, incidents may still occur. A care note may be sent to the wrong recipient, an unauthorized person may access information, or a device containing personal data may be lost.

Workers need a clear way to report such events promptly. They should not be expected to decide independently whether every incident creates a legal notification obligation.

The organization's immediate response should focus on containing the problem, identifying potentially affected information, preserving relevant evidence and assessing possible harm. Responsible personnel must then determine which legal notification and documentation requirements apply.

Article 23 of the Law on Personal Data Protection requires specified parties to notify the competent personal data protection authority no later than 72 hours after discovering a violation that may cause the types of harm identified in the provision. It also establishes other notification duties, including prompt reporting by a data processor to the relevant controller or controller-processor when a violation is detected.

Additional requirements may apply to particular categories of information. Article 29 of Decree No. 356/2025/NĐ-CP establishes specific notification and recordkeeping obligations for incidents involving personal location or biometric data, including notification to affected data subjects within 72 hours after discovery.

Organizations must therefore consider the full set of applicable requirements rather than assume that all incidents follow an identical notification rule.

A useful incident review goes beyond identifying the person who made a mistake. Repeated messages sent to incorrect recipients may reveal weaknesses in contact verification or communication procedures. Unnecessary access to records may indicate that permissions are too broad. Unprotected photographs may show that the organization has not established a practical process for clinical imaging.

The aim is to understand why the problem occurred and reduce the likelihood of recurrence.

Making Privacy Protection Part of Everyday Care

A privacy policy has limited value when workers are unsure how to apply it during routine care.

In a home-care service, practical improvement may begin with documenting the older person's communication preferences, establishing approved methods for exchanging care information and clarifying when a request from a family member requires additional review.

For residential care facilities, priorities may include secure handling of resident records, photography and monitoring arrangements, visitor information, staff access rights and procedures for dealing with sensitive information requests.

Hospitals and licensed healthcare facilities need to integrate these practices with medical-record governance, professional confidentiality and their existing clinical information systems.

Responsibility must also be clear. Workers should know who can authorize a disclosure, who handles access or correction requests, who reviews a proposed monitoring arrangement and who coordinates the response to a suspected privacy incident.

Organizations should identify their applicable duties concerning data protection personnel, impact assessments, documentation and reporting. The precise requirements depend on the nature of the organization, its activities and the data it processes.

Periodic quality reviews can then examine whether the arrangements are working. Family communication permissions may become outdated when relationships or care responsibilities change. Access rights may remain active after a worker leaves. Monitoring equipment may continue operating after the original safety concern has been resolved.

These issues are difficult to detect through policy review alone. Organizations need to examine actual practices and involve older people in evaluating their experience.

Someone receiving care may not know who has accessed their record or what happens to photographs taken during a home visit. They may be uncomfortable with a camera but reluctant to object because they depend on the service. They may also worry that raising a concern will cause difficulties for their family or care workers.

A low number of complaints is therefore not necessarily evidence that privacy is well protected.

Care organizations should make it possible for people to ask questions, express preferences and raise concerns without unnecessary difficulty or fear of adverse treatment. Staff should also be supported to identify and report inappropriate practices before they become serious incidents.

Responsible information governance becomes visible when these everyday decisions are handled consistently, not merely when an organization avoids a reported data breach.

Building Trust Through Responsible Information Governance

Good older-person care requires information to move between people and services. Workers need to know about relevant changes in health status. Healthcare professionals may need accurate information to make decisions. Families often require updates to provide appropriate support.

Privacy protection should make these exchanges more trustworthy, not prevent information from reaching those who genuinely need it.

The distinction is between sharing information through an appropriate, lawful process for a justified purpose and allowing it to circulate because doing so is convenient or technically possible.

For Viet Nam, where family involvement remains important and formal home, community and residential care services continue to develop, this distinction deserves greater attention.

Protecting personal information does not have to begin with sophisticated technology. It begins with knowing why information is collected, respecting the older person's rights and preferences, limiting access appropriately and ensuring that those responsible for care understand their obligations.

A care organization should be able to explain why particular information is needed, who is permitted to use it, how it is protected and what happens when something goes wrong.

When these responsibilities are taken seriously, information can support safer, better coordinated care without compromising the older person's private life.

That is an important foundation for high-quality, person-centered and trustworthy older-person care.

References and Further Reading

1. National Assembly of Viet Nam. Law on Personal Data Protection No. 91/2025/QH15. Adopted 26 June 2025; effective 1 January 2026.

2. Government of Viet Nam. Decree No. 356/2025/NĐ-CP Detailing Certain Provisions and Measures for Implementing the Law on Personal Data Protection. Issued 31 December 2025; effective 1 January 2026.

3. Government of Viet Nam. Decree No. 330/2026/NĐ-CP on Administrative Sanctions in Cybersecurity and Personal Data Protection. Issued and effective 19 August 2026.

4. Government of Viet Nam. Decree No. 392/2026/NĐ-CP Amending and Supplementing Decrees Concerning Administrative Procedures and Business Conditions in the Security and Public Order Sector, including certain provisions of Decree No. 356/2025/NĐ-CP. Issued 20 October 2026; effective 15 November 2026.

5. National Assembly of Viet Nam. Civil Code No. 91/2015/QH13. Adopted 24 November 2015; effective 1 January 2017. Particularly Articles 32 and 38 concerning personal images, private life and personal and family secrets.

6. National Assembly of Viet Nam. Law on Medical Examination and Treatment No. 15/2023/QH15, as amended. Particularly Articles 10 and 69 concerning patient confidentiality and medical records.

7. Aged Care Quality and Safety Commission, Australia. Strengthened Aged Care Quality Standards: Outcome 1.2 — Dignity, Respect and Privacy; Outcome 2.7 — Information Management. Implemented under the Aged Care Act 2024 from 1 November 2025.

8. Care Quality Commission, England. Using Surveillance in Your Care Service. Official guidance addressing legitimate purposes, consultation, privacy protection and the management of surveillance technologies.

Editorial Note

This article is an independent, evidence-informed discussion of privacy, personal data protection and quality improvement in older-person care in Viet Nam. It is intended for general educational and organizational improvement purposes. It does not constitute legal advice, a regulatory determination, an assessment of any individual provider's compliance or a certification standard.

Legal obligations depend on the provider's activities, legal status, data processing arrangements and applicable sector-specific requirements. International standards and regulatory guidance are presented as comparative references for quality improvement, not as substitutes for Vietnamese law. Organizations should seek appropriate professional advice when developing or reviewing information governance policies, contracts, monitoring arrangements and compliance procedures.

The legal review reflects provisions in force as of 1 November 2026 and identifies the scheduled 15 November 2026 amendments where relevant. Subsequent changes should be checked before applying the discussion to specific organizational arrangements.

Legal and guidance review date: 1 November 2026.