Recording and analyzing customer calls in Vietnam: legal conditions and how to get consent

Many businesses already record sales and service calls, and now add AI that turns recordings into text, summaries and quality scores. At scale, the legal question and the customer's trust stop being side issues.

Checked as of October 21, 2026, this article rests on provisions Click Star read in Personal Data Protection Law 91/2025/QH15, Decree 356/2025/ND-CP, the Civil and Penal Codes, and the Laws on Consumer Protection, Electronic Transactions and Artificial Intelligence.

It asks what a business should do to record and analyze calls lawfully and keep trust. The practice sections are a Click Star reference framework, not legal advice. Click Star sells the call analysis service Speech Insight AI, so its view is separate.

Key points

• The texts read have no provision specific to a business recording service calls, so the article does not claim the law allows or bans it and relies on general personal data rules.
• Article 9 of Law 91/2025/QH15: consent is valid only if voluntary, informed about data, purpose and rights, and given per purpose; silence is not consent. Decree 356, Article 6, lists a "recorded call" as 1 way to consent.
• Penal Code Article 159 covers "listening to or recording a conversation unlawfully" but does not explain it for businesses. Notice and consent before recording lower the risk.
• Using an AI platform abroad for data collected in Vietnam is a cross-border transfer (Article 20); the AI vendor is a processor and needs a contract (Article 37).
• When a customer withdraws consent or asks for deletion: reply within 2 working days, stop processing within 15 days, delete within 20 days; longer when a processor is involved (Decree 356, Article 5).
• Recordings used as evidence must show origin and reliable storage (Law on Electronic Transactions, Article 11).

What Vietnamese law says about business call recording

The texts read do not say outright whether a business may record a customer call. Two articles mention recording but cover other cases: Article 32 of Law 91/2025/QH15 (public places) and Article 29, clause 5, which bars social networks and online media services from recording calls without consent.

General rule: Article 11, clause 1 of Law 91/2025/QH15 requires consent before personal data is collected, unless the law says otherwise. The Law on Consumer Protection 2023, in its section on consumer information, also requires notice of purpose, scope and retention period, and consent.

The Civil Code 2015 (Article 38, clause 3) guarantees the secrecy of telephone and other private communications; monitoring or seizure only where the law says so.

The Penal Code 2015 (Article 159, clause 1, point c) lists "listening to or recording a conversation unlawfully". Clause 1 applies to someone already disciplined or administratively sanctioned for the act who offends again.

The Law on Artificial Intelligence 134/2025/QH15, in force from March 1, 2026, bans running AI on data in breach of personal data law (Article 7, clause 3).

Click Star has articles on data protection law and call analysis.

What kind of data a call recording is

A recording linked to a phone number or name is personal data: Article 2, clause 1 of Law 91/2025/QH15 covers data that identifies or helps identify a person, and Decree 356 (Article 3) lists phone numbers as basic data.

Articles 3 and 4 of Decree 356 do not name "voice" or "audio recording" as a category. Call content can still touch sensitive categories such as health, bank cards or private life.

A "voiceprint" identifying speakers may count as biometric data (Article 31, clause 2); this is Click Star's inference, not explicit in the law. For sensitive data, Decree 356 requires telling the customer when asking for consent (Article 6, clause 4) plus access control (Article 4, clause 2).

Consent: valid conditions and how to record it

Article 9, clause 2 requires voluntary consent with the customer knowing the data types, purpose, controller, rights and obligations. Clause 4 adds: consent per purpose, no forced consent to other purposes, validity until the customer changes their mind, and silence is not consent.

Decree 356, Article 6 allows several ways to ask for consent (writing, recorded call, text, email, platform) if it is verifiable who consented, when and to what. The controller must store and prove it, and must not default to consent.

In practice: the notice must play before recording starts, and the choice must be stored. No guidance says staying on the call is enough; as the law excludes silence, Click Star's framework uses an active action (a key press or "I agree").

Article 19 lists cases needing no consent; Click Star found no guidance placing call recording there, so the framework below requires consent.

AI vendors, foreign servers and the processing contract

An AI vendor processing recordings for the business under a contract is a processor (Article 2, clause 8) and may receive data only after an agreement (Article 37, clause 2). The business stays liable to the customer for damage (clause 1, point g).

If servers or models sit outside Vietnam, that is a cross-border transfer (Article 20, clause 1, point c). The sender must file an impact assessment dossier with the specialized agency within 60 days of the first transfer (clause 2).

Article 38 lets small businesses opt out of Articles 21 and 22 for 5 years (with exceptions) and does not name Article 20; confirm with a lawyer.

For the contract, Decree 356 Article 12 (cloud) is a useful question list: processing flow, roles, security, deletion deadlines, support for data subject rights, encryption at rest and in transit.

The Speech Insight AI page (read October 21, 2026) says analysis runs on Anthropic's Claude, call data is not used for training, retention is configurable with a deletion process, and storage location is confirmed in writing. This is the vendor's own claim.

When a customer withdraws consent or asks for deletion

Customers may withdraw consent, restrict processing and ask for deletion (Articles 4, 10, 14). Article 10, clause 2 requires a written request, electronic form included, so the business needs a clear place to receive it. Withdrawal does not undo processing already done (clause 4).

Decree 356, Article 5 sets the deadlines. Withdrawal, restriction, objection: reply in 2 working days, act in 15 days, or 20 if a processor must stop. Deletion: reply in 2 working days, act in 20 days, or 30 if a processor is involved.

One extension is allowed, up to 15 days (withdrawal) or 20 days (deletion), with reasons. If deletion is impossible for a legitimate reason, tell the customer (Article 14, clause 5).

Notice, retention, access and masking: a reference framework

A Click Star reference framework, not from outside sources and not legal advice; settle specifics with a lawyer.

Sample notice. "This call may be recorded and analyzed by software to note your request and check service quality. [Company name] keeps it for [period]; only authorized staff can listen. Press 1 to agree, or 2 to decline and still be helped as normal."

Consent log. Per call, record call ID, customer ID, time, notice version and the customer's choice; keep it at least as long as the recording. Other purposes such as advertising need separate consent.

Retention. Click Star found no fixed number of days in the law. Article 3, clause 3 requires retention suited to the purpose, and Article 14, clause 1, point b requires deletion once it is met. Set a period per purpose, with reasons.

Access and logs. Staff hear their own calls, managers their team's, and a log shows who opened, downloaded or deleted which recording. The law mandates full logs only for finance and banking (Decree 356, Article 8); logs help prove compliance.

Masking. Bank card details, passwords and ID card images are sensitive (Decree 356, Article 4). ID numbers are basic data (Article 3) and OTP codes are not listed; Click Star infers they should still be masked.

Train staff not to let customers read them out, pause recording when needed, and mask them in transcripts before analysis; automatic masking still needs human checks, as it can miss Vietnamese names and addresses.

Recording staff and recording as evidence

Recording also captures staff voices. Article 25, clause 3 of Law 91/2025/QH15 allows technology to manage workers only if lawful, protective of their rights, and with workers clearly informed.

Click Star's framework: put purpose, viewers and retention in internal rules; let staff see their own scores; never let an AI score alone decide pay, bonuses or dismissal.

On evidence, the Law on Electronic Transactions 2023, Article 11 judges value by how reliably data was created and stored, how integrity is kept and how sender and recipient are identified. Civil Procedure Code 2015, Article 95, clause 2 requires audio material to come with a statement of origin.

So keep the unedited original, timestamps, access logs and proof of notice. Click Star found no provision on excluding a recording made in breach of rules as evidence; ask a lawyer.

Click Star's view. Recording calls is not forbidden, but cannot be switched on first and sorted out later. With no dedicated article, the risk lies in how general rules on consent, purpose and retention apply to recordings. Notice first, a real right to decline and kept evidence are safer.

With AI, the issue is where recordings go. Click Star suggests starting with automatic CRM notes and adding scoring once staff trust the data is for coaching, not punishment.

30-day plan

A Click Star reference plan, not from outside sources.

• Week 1: list where calls are recorded, who listens, retention and recipients; pick 1 analysis goal, e.g. CRM notes.
• Week 2: write the notice, decline option, consent log and staff policy; send the AI vendor a question list and contract, asking for deletion faster than the legal deadlines, covering transcripts, scores, summaries.
• Week 3: test 20 real calls: notice, consent records, masking; delete 1 recording end to end and time it.
• Week 4: ask a lawyer about What is not known, fix retention, switch on for the whole team, name who receives customer requests.

How to measure: share of calls with a consent record, share of customers who decline, and deletion handling time against the legal deadlines.

Common mistakes

1. Recording first and giving notice later, or only small print on the website.
2. Treating a silent or continuing customer as consent, though silence is excluded.
3. Bundling quality recording, advertising and model training into 1 consent.
4. Sending recordings to an AI vendor with no contract or idea where its servers are.
5. Having no deletion process, so deadlines are missed when customers ask.
6. Letting customers read out card numbers, ID numbers or OTP codes and storing them as is.
7. Using AI scores to reward or punish staff without notice or human review.

What is not known

• The texts read do not classify voice or call recordings as sensitive; no guidance says whether a voiceprint is biometric.
• No guidance says whether staying on the call after the notice is consent, or whether service call recording falls under an Article 19 exception.
• The law sets no retention days; Click Star has no reliable market practice and found no case law or penalty on service call recording.
• Decree 330/2026/ND-CP (signed August 19, 2026) sets penalties for cybersecurity and personal data violations; Click Star has not read the original, so it states no fine for call recording.
• luatvietnam.vn says Decree 392/2026/ND-CP amends Decree 356 at Articles 17, 18 and 19; Click Star has not read it.
• Provisions were read via copies on ketoananpha.vn, caselaw.vn and luatvietnam.vn. The Official Gazette page confirms the number and effective date of Law 91/2025/QH15; its PDF could not be read.
• Not checked: sector rules (banking, insurance, health, debt collection) and recent Civil Procedure Code amendments.