You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

January 5, 2023

Vietnam’s Data Protection Regulations: What to Expect in 2023

Subscribe to Updates

Data protection in Vietnam has been an ever-changing area of law in the last few years, with many legislative and practical developments. From its initiative to build the very first comprehensive Personal Data Protection Decree to meet international standards, to its actions to tackle widespread illegal data processing and trading, the Vietnamese government has shown its determination to strengthen the protection of data, which it has recognized as one of the national key tasks in the Prime Minister’s Strategy for Development of E-Government.

The year 2023 is expected to be another year of many important changes made to the law and practices in this area. This article discusses what we anticipate to be the key upcoming developments in Vietnam’s data protection regime that businesses may wish to keep a close eye on to ensure compliance.

Tightened Rules on Data Collection and Data Transfer

The conditions for personal data processing under the current law are rather sketchily outlined. In general, the data subject’s consent to the scope and purposes of the data processing may be considered sufficient for any collection, use, retention, or sharing of personal data. Explicit consent is not clearly required, except when the data is collected in e-commerce, used for direct marketing purposes, or for other strictly controlled activities. This leads to the practice where data controllers usually do not treat consent as a serious matter. In addition, once consent has been obtained, data controllers tend to comfortably collect whatever data they want, since the law does not require the collection to be “proportionate.”

This situation is expected to change in 2023 with more stringent regulations on personal data processing underway. The first and most influential set of rules on data protection to come out early this year will likely be the much talked-about Personal Data Protection Decree (“PDPD”) developed by the Ministry of Public Security (MPS), which has been in draft form since early 2021. The first public version of the draft PDPD (dated February 2021) proposed ruling out silence by data subjects as a valid form of consent, as well as requiring consent to be expressed in writing with a printable and reproducible format.

These new requirements, once taking force, could render illegal any processing of personal data without explicit consent. Other conditions of consent include that it can be made partially and conditionally, and withdrawn at any time by the data subject. In addition, the draft PDPD also proposed introducing the principle of data minimization (proportionality), according to which personal data collected must be limited to only what is necessary to accomplish the specified purposes.

The Draft Amended Consumers Protection Law (“Draft CPL”), scheduled to be promulgated within 2023, has also proposed tightening the conditions on consent for processing of consumers’ personal data. The Draft CPL requires traders, in obtaining consent for collecting consumer data, to establish a mechanism for consumers to select the types of information that they agree for the traders to collect and express their consent in a suitable form. For special processing purposes like sharing, disclosure, or transfer of personal data to third parties, and use of personal data for sending advertisements and introducing products, the Draft CPL requires a mechanism for the data subjects to clearly opt in to giving or not giving their consent. This requirement is similar to what is currently required for e-commerce websites/applications. In addition, bundled consent, i.e., a clause in a consumer contract or general terms and conditions that makes the conclusion of the contract or the terms and conditions dependent on the consumer’s consent to the collection, storage, and use of his or her data, is likely to be invalid under the Draft CPL.

Interestingly, the Draft CPL provides that collection of personal data that has been publicly disclosed does not require any notification to the consumers. This means scraping of publicly available personal data might be acceptable in Vietnam once the Draft CPL is promulgated and takes effect. However, scraping of non-publicly available personal data is still prohibited and could constitute a crime.

Apart from consent, the regulations on cross-border transfer of personal data will also soon be strengthened. The potential new approach to regulate cross-border transfer of personal data is believed to be revealed by chance in the Draft Decree on Sanctioning Administrative Violations in the Field of Cybersecurity (dated September 2021), which stipulates violations against the draft PDPD. Accordingly, the newly proposed conditions for cross-border data transfer may include only an impact assessment dossier for the transfer, a data transfer agreement between the sender and the recipient, and a post-transfer report to the personal data protection authority.

Compared to the onerous set of conditions for cross-border transfer of personal data that the MPS originally proposed in the draft PDPD, which include among others a state approval prior to the transfer and the storage of the original data in Vietnam, the new conditions appear less burdensome.

Intensified Regulatory Scrutiny

Despite the data protection regulations in place, reports on actual enforcement in practice have been rather limited. One possible reason is that regulatory inspectors have not been focusing on personal data in their activities. Things may change shortly with the recent message from the Ministry of Information and Communications (MIC) on its enforcement plan in this area (source).

In particular, the minister of the MIC announced that the MIC would conduct comprehensive inspections into companies’ compliance with the regulations on collection, processing, and protection of customers’ personal data in the coming time. Telecommunications carriers are said to be the first enterprises to be inspected, followed by postal companies and social networking platforms.

The issue of consent for data processing was notably highlighted by the minister in his discussion. Therefore, compliance in obtaining customer consent can be anticipated to be key in the MIC’s inspection scope. The implementation of technical and managerial measures to protect personal data according to the law is also likely to be scrutinized.

Continued Assertive Action against Illegal Data Trading

Vietnam has for years been a hotspot for the unauthorized trading of personal data, according to recent reports by the MPS and the MIC. The most common violation is where the infringing companies or their employees sell packages of customers’ identity and contact information including phone numbers, email addresses, and ID card information to third parties without authorization. Most of these data buyers would use the personal information for marketing purposes, including to make advertising calls or to send spam SMS or email advertisements to the information subjects. The violators may even use the personal data to commit financial fraud, including to obtain bank loans under the name of the data subject victims, or to impersonate state authorities or acquaintances of the victims to request money transfers (source). Data crimes therefore have been and will continue to be under the enforcement focus of the high-tech police at both the central and provincial levels.

The police are also likely to take a strict view and initiate a criminal prosecution against any act of illegal data trading. The most recent actions reported in the media include two cases where the police of Phu Tho Province prosecuted five individuals for the criminal act of “trading, exchanging, giving […] lawfully private information of an organization or individual on the computer or telecommunications network without the consent of the information owner” under Article 288 of the Criminal Code.

In one of the cases, two individuals were found using self-developed software to collect personal data of over 2 million people by scanning and capturing the data from Facebook and Google accounts, and selling the data. The other case involved three individuals’ collection and sale of more than 400,000 personal information records containing phone numbers and addresses, generating about VND 1.1 billion (approx. USD 47,000) from the illegal business (source). With the government’s determination to tackle data crimes, more criminal actions like these are expected to be seen in 2023.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

August 6, 2025
Thailand’s Digital Government Development Agency (DGA) has released drafts of two pivotal documents to guide Thai government agencies in adopting cloud technology and classifying data for cloud usage. These draft guidelines, open for public hearing through August 12, 2025, are part of the national “Go Cloud First” policy, which aims to accelerate digital transformation, improve efficiency, and ensure robust data security across the public sector. The new standards will have significant implications for both government agencies and cloud service providers operating in Thailand. Highlights of the draft guidelines are presented below. Government Cloud Usage Guidelines Cloud-first transformation: All government agencies are directed to prioritize cloud solutions for new IT projects, in line with the cabinet’s “Go Cloud First” policy. Cloud model selection: Agencies must assess their needs and select the most appropriate cloud deployment model—public, private, hybrid, or community cloud—based on the sensitivity of the data and operational requirements. Service types: The guidelines provide criteria for choosing between Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS), emphasizing the importance of using standard, non-customized services where possible. Cost management: Agencies are required to plan and separate cloud-related expenses, ensuring transparency and efficient budget allocation. Cloud migration: The guidelines outline the steps for migrating to the cloud and highlight the role of cloud service providers in facilitating the process, including supporting innovation and enabling smooth exit strategies. Procurement compliance: All cloud procurement must comply with public sector procurement laws and regulations. Only providers meeting government-mandated standards can be selected. Security and shared responsibility: The guidelines clarify the division of security responsibilities between cloud providers and government agencies. While providers manage infrastructure security, agencies remain responsible for data, application, and access controls. Legal framework: Agencies must comply with the Digital Government Administration Act, Cybersecurity
Read More
August 1, 2025
Thailand’s Personal Data Protection Committee (PDPC) announced to the press on August 1, 2025, that it had issued eight new administrative fines under Thailand’s Personal Data Protection Act B.E. 2562 (2019) (PDPA) in five cases of noncompliance by public and private entities. The enforcement actions reflect a growing commitment by the PDPC to penalize noncompliance across all sectors, regardless of organizational type or size. The total amount imposed to date was approximately THB 21.5 million (approx. USD 654,690), underscoring the financial risks tied to PDPA violations. The five cases—one involving a state agency and the remainder in the private sector—are summarized below. Case 1: State Agency Providing Online Services to the Public The order in this case stemmed from a cyberattack on a state agency’s web app, resulting in personal data of 200,000 data subjects being leaked to and sold on the dark web. The software developer was also found to have implemented no privacy by design, lacked an access control system, had no data breach prevention measures, and failed to conduct risk assessments or review existing security measures. Key noncompliance identified: Lack of appropriate security measures Weak password protection No risk assessment or ongoing review of security measures No data processing agreement with software developer that acted as data processor The state agency and the developer were each fined THB 153,120 (approx. USD 4,670). Case 2: Private Hospital This case involved a hospital that engaged an individual contractor to destroy patient medical record documents. However, the contractor stored the documents at their own premises, failed to follow the required destruction protocols, and ultimately used the medical records to wrap sweets, resulting in the leak of over 1,000 records during the destruction process. The contractor also failed to notify the hospital of the data breach. Although there was a
Read More
August 1, 2025
On July 30, 2025, Myanmar’s Cybersecurity Law No. 1/2025 came into effect with the State Administration Council’s issuance of Notification 113/2025. The law, which was enacted on January 1, 2025, aims to regulate various aspects of digital security and online activities. Below are some key provisions, implications, and penalties under the Cybersecurity Law. Extraterritorial penalties. The law contains an important provision that authorizes penalties against Myanmar citizens who are found guilty of violations, even if these occur outside the country’s borders. VPN definition and regulation. Virtual private networks (VPNs) are defined by this law as specific systems that function as backup networks by using technological means in order to ensure the safety of linking networks to each other. This definition sets the framework for subsequent regulations and penalties associated with VPN usage. The law does not restrict individuals or entities from using VPNs; it regulates VPN service providers. Penalties for unapproved VPN services. Establishing a VPN or providing VPN services without approval from the designated ministry (to be appointed later by the government) can result in significant penalties. For individuals, the punishment may be imprisonment for 1–6 months, a fine of MMK 1–10 million (approx. USD 476–4,760), or both, with the proceeds of the violation being confiscated. If the violator is a company or organization, the minimum fine will be MMK 10 million, and the proceeds will be confiscated. Government oversight. The ministry designated by the government is authorized to investigate and take control of cybersecurity services and digital platform services for national defense and security purposes, or upon request from a government department or organization in accordance with respective laws. Licensing requirements. The Cybersecurity Law introduces two types of licenses, valid for a period of 3–10 years, for (1) cybersecurity services and (2) digital platform providers. Digital platforms with
Read More
August 1, 2025
On July 21, 2025, Thailand’s National Cyber Security Agency (NCSA) released a draft amendment to the Cybersecurity Act B.E. 2562 (2019) for public hearing, aiming to address the rapid evolution of technology and increasing complexity of cyber threats. The proposed changes to the country’s cybersecurity framework would extend regulatory oversight to cloud service providers and data center operators hosting data for critical information infrastructure (CII) organizations regulated under the Cybersecurity Act. The NCSA will accept comments on the draft until August 5, 2025. Following the close of the public consultation period, the draft amendment will be subject to further revision during the legislative process. Key proposed amendments are discussed below. Expanded Critical Infrastructure Scope The Cybersecurity Act currently applies only to state agencies, supervising or regulating organizations, and designated CII organizations as announced by the National Cyber Security Committee (NCSC). It defines CII organizations as public or private organizations related to or providing national security, significant public services, banking and finance, information technologies, telecommunications, transportation and logistics, energy and public utilities, or public health. The draft amendment expands the scope of CII organizations to include public and private organizations related to or providing industrial work (to be further defined in subregulations) as well as service providers that store or possess data for CII organizations, such as cloud and data center service providers. CII organizations must comply with cyber threat reporting requirements and are subject to the NCSA’s interception powers. Updated Definitions and New Terminology The draft amendment more clearly distinguishes between “cyber threats” (which have yet to occur but have the potential of causing damage or impact) and “cyber incidents” (which have already occurred and have caused or are expected to cause damage or impact). The draft amendment also expands the definition of “cybersecurity” to explicitly cover both prevention
Read More