According to Vietnamese laws, the primary legal basis for the processing of personal information is a consent given by the data subject (exemptions are available in certain cases, as discussed further below). Accordingly, consent requirements are among the most important regulations under the PDPL.

Consent obtained from the data subjects must be clear, specific and must be capable of being verified as to whether the data subject has given consent, including the time and scope of such consent. Consent must be voluntarily made based on the data subject's full understanding of:

• the type of personal data to be processed and the purpose of the personal data processing;
• the data controller or data controller-processor;
• the data subject's rights and obligations; and
• the data to be processed that is sensitive personal data, if any. 

In addition, consent must be expressed clearly and specifically in a format that can be printed out or reproduced in writing, including in electronic or verifiable formats, including in writing, by recorded phone calls, in consent syntax via mobile text messages, via email, websites, platforms, or applications with technical mechanisms established to obtain consent, and other appropriate methods. Silence or non-response by the data subject is not construed as consent. Furthermore, consent must be made for each purpose. That is to say, multiple purposes need to be demonstrated in a way that data subjects can give consent to one or more of them.

Additionally, the consent of the data subject must not be accompanied by conditions requiring mandatory consent to purposes other than those agreed upon in the content of the agreement. 

Circumstances where consent can be exempted: 

• to protect the life, health, honour, dignity, and legitimate rights and interests of the data subject or others in urgent cases; or to protect one’s own or others’ legitimate rights or benefits, or benefits of the State or agencies/organizations in a necessary manner against infringement on such rights or benefits. The controller, processor, controller-processor and third party are responsible for proving such situation;
• to address emergency situations or threats to national security that have not yet reached the level requiring the declaration of a state of emergency; to prevent and combat riots and terrorism, crimes, and violations of the law;
• to serve the operations of state agencies and the state management according to the law;
• to carry out the agreement between the data subject and a relevant agency, organization, or individual according to the law;
• to conduct audio and video recording and to process personal data obtained from audio and video recording activities in public places and public activities in certain cases as prescribed by law; and
• other cases according to the law.

Data subjects are allowed to withdraw their consent at any time, provided that such request to withdraw consent is made in accordance with statutory conditions. However, such consent withdrawal shall not apply to the processing activities that occur before the withdrawal request. The consent withdrawal request must be expressed in writing, including in electronic or verifiable formats.