The professional activities of doctors, lawyers, and entertainers involve unique characteristics closely tied to confidential client information.
Without a specialized legal framework, tax administration efforts could inadvertently infringe upon citizens' privacy, the confidentiality of their transactions, and their professional reputations.
Tax Authority tightens oversight of high-income earners
The Ho Chi Minh City tax authority has recently issued a targeted plan to strengthen personal income tax administration for high-income earners, focusing on sectors such as healthcare, education, culture, legal services, and real estate brokerage. According to the tax authority, these sectors include many individuals who earn high incomes from multiple sources but have not fully met their tax obligations.
Revenue generated by medical clinics, law firms, and entertainers stems from specialized, personalized services, and their records contain vast amounts of confidential information.
Under Points c and d, Clause 1, Article 4 of Decree No. 356/2025/ND-CP (detailing specific articles and implementation measures for the Law on Personal Data Protection), information regarding private life, personal secrets, family secrets, and health status is classified as sensitive personal data.
For lawyers, case files often contain data on criminal offenses or legal violations collected by law enforcement agencies, or other personal data required by law to be kept confidential. For entertainers, tax records involve not only performance contracts, which are highly sensitive regarding private life and personal finances, but also income derived from digital platforms. Tax audits can easily touch upon sensitive data concerning activity history and social media usage patterns.
To verify revenue, tax authorities often request bank statements; however, Point k, Clause 1, Article 4 of Decree No. 356/2025/ND-CP classifies financial and credit information as well as financial transaction histories at credit institutions as sensitive personal data. Consequently, to avoid legal violations, tax authorities cannot employ coercive review measures that compel the submission of original customer records.
Clause 7, Article 7 of the Law on Personal Data Protection strictly prohibits the intentional disclosure or loss of personal data. Organizations or individuals that leak customer information prior to an official conclusion being reached face administrative penalties of up to VND3 billion (Clause 5, Article 8 of the Law on Personal Data Protection) or criminal prosecution. Under Clause 1, Article 23 of the Law, in the event of a violation infringing upon the honor or property of a data subject, the data controller must report the incident to the Ministry of Public Security within 72 hours.
In principle, Point c, Clause 1, Article 19 of the Law on Personal Data Protection permits state agencies to process personal data without the data subject's consent, thereby allowing for information collection for tax administration purposes.
Nevertheless, Clause 2, Article 19 of the Law on Personal Data Protection mandates that relevant agencies establish strict oversight mechanisms when processing personal data without the subject's consent. Specifically, tax authorities must establish data processing procedures and clearly define the responsibilities of individuals and organizations; implement appropriate data protection measures while regularly assessing potential processing risks; conduct periodic checks on legal compliance and adherence to processing procedures; and maintain mechanisms to receive and address feedback from relevant organizations and individuals.
Data protection key to balancing tax oversight and privacy
To resolve the conflict between tax administration objectives and personal data protection, the tax sector needs to utilize data encryption and anonymization technologies. The legal basis for this lies in Clause 1, Article 12 of the Law on Personal Data Protection and Point c, Clause 3, Article 9 of Decree No. 356/2025/ND-CP, which require agencies and organizations to encrypt and anonymize personal data during transmission and processing. Therefore, the electronic invoicing system tailored for the medical, legal, and artistic sectors requires upgrading.
Upon invoice issuance, the system transmits only quantitative financial data such as transaction dates and contract values to tax authorities, while automatically anonymizing or encrypting sensitive information like patient identities or client details. This process enables regulators to accurately track revenue for tax assessment purposes without identifying the individuals involved in the transactions.
Regarding audits, inspection teams are permitted to cross-reference only those documents where non-financial information has been anonymized; accessing original records necessitates independent oversight by relevant professional bodies, such as Bar Associations or Departments of Health.
Establishing a balanced legal framework, comprehensively applying encryption and data anonymization technologies, and developing specialized inspection procedures constitute an essential roadmap. Respecting and protecting taxpayer privacy fosters a greater sense of voluntary compliance with tax laws.
