Personal Data Protection in Vietnam’s Public Administration: A Comparative Analysis with the EU General Data Protection Regulation

Abstract

Background: The expansion of data-driven governance has intensified personal data protection within public administration. Although contemporary data protection regimes share common principles, their operation in the public sector remains uneven. This study examines how the General Data Protection Regulation (GDPR) and Vietnam’s Law No. 91/2025/QH15 regulate personal-data processing by public authorities and what their differences imply for institutional accountability and individual rights. Method: The study assesses normative architecture, institutional responsibilities, and compliance frameworks in the two legal systems. It combines systematic comparative legal analysis of primary legal instruments with thematic analysis of secondary sources, allowing for both structural comparison and contextual interpretation across jurisdictions. The doctrinal analysis identifies formal legal requirements, while observations concerning implementation are derived from secondary literature and are not presented as original empirical findings. Results and Conclusions: The findings demonstrate that robust legal frameworks do not ensure effective protection. The two systems show partial convergence in general data-protection principles but significant differences in public-sector processing, impact assessment, internal compliance functions, supervisory independence, and enforcement. Differences in administrative capacity, organizational culture, oversight arrangements, and digital governance strategies identified in the secondary literature may influence compliance. Accordingly, formal convergence should not be interpreted as institutional or functional equivalence. The research concludes that meaningful personal data protection in public administration depends on the alignment of law, institutions, and governance practices. Context-sensitive harmonization, supported by effective oversight and administrative capacity, is essential to safeguarding individual rights and enhancing trust in data-driven public governance.