Hotel personal data protection: what resorts and chains need to review

Part 1: The legal framework, and why chains and resorts rarely qualify for exemptions

• Law on Personal Data Protection No. 91/2025/QH15, passed on 26/6/2025, in force from 01/01/2026.
• Decree 356/2025/ND-CP of 31/12/2025 provides the detailed rules, takes effect at the same time and replaces Decree 13/2023/ND-CP; consent validly obtained under Decree 13/2023 remains valid.
• Decree 330/2026/ND-CP of 19/8/2026 on administrative penalties, in force from 19/8/2026.

Exemptions rarely fit a chain

• Only small businesses are exempt from the data processing impact assessment dossier and from appointing data protection staff: household businesses and micro-enterprises are exempt; small enterprises and start-ups may opt out for 05 years. Medium and large enterprises have no such option.
• A threshold of 100,000 people, counted cumulatively across the entire guest history: at or above this threshold, even a small enterprise loses the exemption.
• Sensitive data — for hotels, images of ID cards, bank card details, transaction history, health conditions, biometric data and location via positioning services (Decree 356/2025): an entity that processes it directly also loses the exemption.

Penalties: read the scope correctly

For organisations, the Law sets a maximum of VND 3 billion for ordinary violations; the cap of up to 5% of the previous year's revenue applies only to violations involving transfer of data abroad. Decree 330/2026 (amounts for organisations; individuals and household businesses pay half) imposes VND 20–30 million for failing to apply adequate protection measures leading to data leakage or loss, VND 40–60 million for reporting a breach later than 72 hours, and may add a requirement to notify and apologise publicly — for a brand serving corporate clients, that part often weighs more than the fine.

Part 2: Redraw how guest data flows across departments and properties

Without a data map, permissions, the impact assessment dossier and the incident process are all built on assumptions. Six points guest data passes through in a portfolio:

• Reservations: data from online sales channels, travel companies and group rooming lists — often via email and spreadsheets.
• Front desk: ID details for residence notification, phone numbers, special notes.
• Restaurants, treatment areas, entertainment: bills charged to the room, appointments, sometimes health notes provided by the guest.
• Housekeeping, security, car park: room numbers linked to guest names, licence plates.
• Accounting and payments: card details, bank transfers, corporate invoices.
• Chain level: the unified guest profile, guest care, reports for the owner.

For each point, answer four questions: what data, basic or sensitive; for what purpose and on what legal basis; where it sits; who sees it and how long it is kept. The layer of side data — group-list spreadsheets, ID photos taken "temporarily", export files sent to partners — is the place to clean up first, because it sits outside every permission and every log.

Part 3: Permissions by property, by role, and leaving a trail

The requirements to restrict access through permissions (Decree 356/2025) and to apply appropriate managerial and technical measures (Law 91/2025) translate into three principles for a multi-property portfolio:

• By property: by default, staff see only their own property's guests; cross-property access is granted deliberately, and only to chain-level roles that genuinely need it.
• By role: the restaurant needs to know which room a guest is in to charge the bill, not their ID number; housekeeping needs room status, not phone numbers.
• By trail: important actions and lookups of contact details should leave a log — not to suspect staff, but so questions are answered with facts rather than memory.

Part 4: The impact assessment dossier, the person in charge and partners receiving data

• Data processing impact assessment dossier: submitted to the specialised personal data protection authority under the Ministry of Public Security within 60 days of starting processing, and updated every 06 months or immediately upon changes such as opening a property, adding a system or adding a partner. The map from Part 2 is the main input; how the timing applies to properties already operating should be checked by your legal team.
• Person in charge: designate a department or staff member, or engage a data protection service — for a chain, one chain-level focal point and one contact person at each property.
• Partners processing data on the hotel's behalf — management companies, outsourced accounting, software vendors — may receive data only under a contract or agreement, and must promptly inform the hotel when they detect a breach. With sales channels and travel companies, agree in writing which party is responsible for which part.
• Systems or partners outside Vietnam: using a platform hosted outside Vietnam to process data collected in Vietnam also counts as cross-border data transfer, requiring a data transfer impact assessment dossier within 60 days. Decree 356/2025 exempts this dossier when data is provided abroad to sign contracts or carry out procedures relating to hotels, payments, visa applications and certain other cases; hosting the guest database abroad is a different situation that needs separate legal review.

Part 5: Guest rights, deadlines and the 72-hour incident window

Consent. Collecting ID details for residence notification is an obligation under the Law on Residence; the Law on Personal Data Protection sets out cases where processing does not require consent, including processing required by law (Article 19). Using phone numbers and email addresses for guest care or sending offers is a different purpose — it should have separate consent. This is an interpretation; no guidance yet addresses it by name. When asking for consent: one purpose at a time, no pre-ticked boxes, keep evidence, and tell the guest when the data concerned is sensitive data.

Guest requests. Respond within 02 working days; access, correction and provision within 10 days; withdrawal of consent, restriction and objection within 15 days; erasure within 20 days, or 30 days if a processor or third party must carry it out. One guest may have data at three properties and two partners, so the chain needs one focal point and one shared tracking log. Guest stay information that must be retained under Decree 96/2016/ND-CP (Article 44: at least 36 months) usually does not have to be erased; in that case, tell the guest why.

Incidents. When a breach is detected that may harm a guest's life, health, honour or property, or damage national defence, security or public order: report to the specialised authority within 72 hours at the latest and make a written record. 72 hours pass very quickly over a weekend, so the process must state clearly who decides and who drafts the notification at both property and chain level. Failing to contain and remedy the breach, or failing to cooperate with the specialised authority, can be fined VND 60–80 million (amount for organisations).

Summary table: a review for chains and resorts

Part 6: A platform that supports compliance — DiHotel and DiCRM

No platform can take over a hotel's legal obligations, but its design determines how much the portfolio has to carry through human discipline. This is where AI hotel management software DiHotel and its accompanying modules help:

• ID scanning stores only the extracted information, not the image. The system keeps full name, ID number and date of birth — basic data — and does not keep images of ID cards, so every property in the portfolio has one less type of sensitive data to protect. The other obligations remain.
• Permissions by role and by property, together with an activity log recording who did what and when. The platform architecture is described in the article an enterprise platform for 4–5 star hotels.
• Residence notification: export a file in the correct template for the front desk to submit. Guest information is already available from check-in; DiHotel exports a file in the template the portal requires so the front desk can upload it without retyping. Submission is done by someone holding the property's account, because the portal requires login and authentication.

DiCRM: lookup logs, encryption and erasure on request

The unified chain-level guest profile is where contact details are most concentrated. DiCRM — the customer relationship management module in operation within the DiHotel ecosystem — provides a log of lookups of guests' phone numbers and email addresses together with the reason for each lookup, AES-256 encryption of personal data, a process for erasing personal data at the guest's request and permissions to view data by property. See also the article CRM for chains and resorts and DiHotel's hotel CRM page.

A platform cannot replace choosing the purposes, the legal bases for processing, the content of the impact assessment dossier, the contracts with each partner receiving data, or discipline over the layer of side data.

Are hotel chains and resorts exempt from preparing an impact assessment dossier?

The exemption applies only to household businesses and micro-enterprises, and to small enterprises and start-ups for 05 years from 01/01/2026. Even a small enterprise loses the exemption when it directly processes sensitive data or data of 100,000 people or more, counted cumulatively. Enterprises outside the exemption must submit the dossier within 60 days and update it every 06 months.

Is guest consent needed to collect ID card and passport details for residence notification?

Collecting ID details for residence notification is an obligation under the Law on Residence; the Law on Personal Data Protection sets out cases where processing does not require consent, including processing required by law (Article 19). Using phone numbers and email addresses for guest care or sending offers is a different purpose — it should have separate consent. This is an interpretation; no guidance yet addresses it by name.

How long does a chain have to handle a guest's request to erase data?

Respond within 02 working days and erase within 20 days, extendable by no more than 20 days; 30 days if a processor or third party is involved. Guest stay information that must be retained by law usually does not have to be erased; in that case, tell the guest why. For a chain, the request must reach every property and partner holding that guest's data.

Does using a booking system hosted abroad count as transferring data abroad?

The Law treats using a platform hosted outside Vietnam to process data collected in Vietnam as cross-border data transfer, requiring a data transfer impact assessment dossier within 60 days. Decree 356/2025/ND-CP exempts this dossier when data is provided abroad to sign contracts or carry out procedures relating to hotels, payments, visa applications and certain other cases. Specific situations should be checked by your legal team.

If guest data leaks, how quickly must the chain report it?

Within 72 hours of detection at the latest, to the specialised personal data protection authority under the Ministry of Public Security, with a written record. Data processing partners must promptly inform the hotel. Reporting later than 72 hours is fined VND 40 to 60 million for organisations; individuals and household businesses pay half.