Vietnam’s 2025 data law for device fleets

ABMDM Editorial Team. Published: 2026-10-04.

What the 2025 law means for a device fleet

The Personal Data Protection Law 2025 (Law 91/2025/QH15) and Decree 356/2025/ND-CP apply when a shop or company collects, stores or views data tied to a person — including serials, command logs, and especially location.

ABMDM is built around those limits. Security lists what is collected: device information, management status, command history; location only in Lost Mode or when a contract is overdue. No messages, calls, email, photos, passwords or browsing history.

The long form is the privacy policy. The operator is ISHI KOI FARM COMPANY LIMITED.

The law does not forbid a business from managing hardware it owns. It requires you to know which data you process, why, who may view it, how long you keep it, and how you handle a data-subject request. MDM is a tool; the shop still owns the decision when it sends a command to a phone used by someone else.

What counts as sensitive on an iPhone fleet

Device location is sensitive personal data. Do not turn on all-day tracking “for peace of mind”. View it only when:

• the device is in Lost Mode, or
• an instalment or lease is overdue and the contract already consents.

Every view logs who, which device, when. Branch staff should not see location for the whole fleet.

Serials, IMEI, model and iOS version support asset control, not a private-life file. A SIM number and carrier, if collected, are also tied to a person — use them to reclaim or support a device, not to sell or advertise.

Command logs (who locked, who wiped, when) are evidence when a complaint arrives. Keep them; do not clear logs to “tidy the books”.

Only devices you own or have consent for

Do not enrol an employee’s home iPhone just because they work for you. Company phones: a handover record with serial, date and recipient. Instalments: Civil Code 453 — the seller keeps title until payoff; the contract should mention management and location when overdue. Leases: the lessor owns the hardware.

Enrolment by QR or link for personal devices on ABMDM is still Coming soon. Do not invent a “please scan this” path to Supervise a home phone.

How to choose software by job: company iPhone management. When someone leaves: reclaim a staff iPhone.

Data / command	When you may	When you may not
Location	Lost or overdue, with a log	All-day tracking
Lock, wipe	Company-owned / consented	Home phones, someone else’s device
Reminders	7am–9pm, named party	After hours, relatives
On-device content	Do not read it	Messages, photos, passwords

What to do before you turn MDM on

1. Split the list: company, instalment, lease, staff home phones. Home phones stay off the list until you have written consent.
2. Handover records or contracts: consent to management; location when lost or overdue; restriction tiers if it is an instalment.
3. Roles in ABMDM: who may lock, wipe, view location. Do not share the owner password with the whole counter.
4. Keep logs for inspections, complaints and contract disputes.
5. After payoff or when someone leaves: remove management and check the device so the next holder does not see a company setup screen.

Website contact data is kept up to 24 months from the last exchange. Service data is kept while you use the product; if the term lapses, devices leave management after 30 days. Payment records follow accounting and tax law.

The data-protection contact is on the privacy policy. Employees and instalment customers may ask to know, access, correct, delete, restrict or object within the law; the shop cooperates when a request arrives.

Reminders, locks and hours

Overdue reminders and locks only from 7am to 9pm, only to the person named on the contract. Do not call relatives, do not message after hours, do not use location to “drop by at midnight”.

Tiered locks are gradual; the customer can still call and pay on screen. Wipe is a different command, for when you will not recover the hardware and must protect company data — not for a payment a few days late.

This article does not explain how to strip MDM or Activation Lock. For used phones, check the device itself. Serial lookup on this site only shows ABMDM serials, not every phone on the market.

Common mistakes

Watching the whole fleet’s location “for peace of mind”: stop; Lost Mode or overdue only.

Enrolling a home phone on a verbal “OK”: you need writing.

Handing over an instalment phone with no management clause: add the clause before the next handover.

Giving the owner account that can wipe devices to the evening shift: narrow the role.

Instalments, leases and customer data

An instalment customer is not staff, but the serial, payment schedule, remaining balance and lock-screen reminder are still personal data. The contract should state: the shop keeps title until payoff (Civil Code 453), the shop may manage the device, apply tiers when overdue, view location when overdue or lost, and remind only from 7am to 9pm.

Do not show someone else’s name on the lock screen. Do not post a debt schedule in a public Zalo group. A customer self-service portal is still Coming soon — not in the service; do not collect extra papers “for the portal” before it ships.

Leased iPads belong to the lessor. Record handover, term and loss terms. When the lease ends, remove management or take the device back; do not let a customer leave with an organisation screen still on the unit.

Roles and a data incident

Owner, accountant and evening-shift staff should not share one role. Location view and wipe stay narrow. Logs show who looked when a complaint arrives.

If you suspect a leak: freeze the related account, change the admin password, notify as the privacy policy describes (the DPO email is on that page). Do not post a customer serial on social media to “ask for help”.

ABMDM does not sell personal data or share it for advertising. Apple, carriers and banks sit outside what a shop can fully control — the terms page states that limit.

Trial 14 days, up to five devices. Call 0913 081 986 (8am–9pm) when you draft the first clause.