Call Centers & Call Recording under Vietnam’s Personal Data Protection Law: What Businesses Must Do

Every day, a business phone system handles hundreds of phone numbers, hours of recordings and countless customer notes — all of it personal data. Since 1 January 2026, Vietnam’s 2025 Personal Data Protection Law has been in force, elevating many rules from Decree 13/2023/ND-CP into law and significantly raising penalties. This article summarizes what businesses should do when operating a phone system, from a telecom practitioner’s point of view.

1. What Counts as Personal Data in a Phone System?#

• Contact details: customers’ phone numbers, names, emails and addresses in contacts and CRM.

• Call detail records (CDR): who called whom, when, and for how long.

• Recordings: voices and the full content of conversations. For clinics, banks and insurers, recordings may contain sensitive data such as health or financial information.

• Employee data: extension accounts, login history, and recordings of the employees’ own calls.

2. 7 Things to Do When Running a Phone System#

• Announce recording at the start of the call: Use an IVR greeting such as "This call may be recorded for quality purposes" and state the purpose. On outbound calls, agents should mention it in the first sentence.

• Have a lawful basis for your lead lists: Numbers you call must be collected with consent or another basis permitted by law. Never buy or sell phone lists — this is prohibited.

• Keep data only as long as needed: Set a retention period per use case (e.g., 6–12 months for customer service, shorter for telesales) and delete expired recordings regularly.

• Restrict access: Only those who need it may listen to recordings or export customer lists; revoke access as soon as an employee leaves.

• Secure accounts: Strong passwords, two-factor authentication for admin accounts, no shared logins.

• Honor data-subject rights: Have a process for requests to view, correct or delete personal data. Call monitoring (listen-in) must be disclosed to employees in internal policy.

• Prepare and keep a data processing impact assessment: Document what data you process, why, who can access it, how long you keep it and how it is protected — ready to provide on request by authorities.

3. Common Risks with Traditional Phone Setups#

• Agents calling from personal SIM cards: customer data and call history stay on private phones and leave with the employee.

• Customer lists scattered across Excel files shared over chat.

• Recordings stored on the PBX hard drive with no access control, no encryption and no deletion schedule.

A cloud phone system centralizes data, which makes it easier to control. Still, the business remains the data controller and bears primary responsibility; the phone-system provider acts as a data processor under contract.

4. How VitaPBX Supports Compliance#

• Recording-notice IVR greetings: Configurable per hotline, queue and time window.

• Role-based access: Admins, supervisors and agents have different permissions; only authorized users can listen to recordings.

• Encryption: Admin portal and app connections use TLS; browser and app voice is encrypted with SRTP; extension passwords and 2FA secrets are encrypted at rest with AES-256.

• Plan-based recording retention: Recordings beyond your plan’s retention period are locked; you delete them according to your own policy.

• Tenant isolation: Each customer has its own data space on the platform.

5. Quick Checklist Before Enabling Recording#

1. A greeting announces recording and its purpose.

2. A retention period and an owner for deleting expired recordings are defined.

3. You have reviewed who can listen to recordings and export data.

4. There is a process for customer requests to view or delete their data.

5. Your data processing impact assessment is up to date.

This article is general guidance based on operating experience and is not legal advice. Businesses handling sensitive data (healthcare, finance) should consult a lawyer to design suitable procedures.