You are using an outdated browser and your browsing experience will not be optimal. Please update to the latest version of Microsoft Edge, Google Chrome or Mozilla Firefox. Install Microsoft Edge

August 27, 2025

Vietnam’s New Personal Data Protection Law: A Closer Look

Subscribe to Updates

Vietnam officially enacted Law No. 91/2025/QH15 on Personal Data Protection (“PDPL”) on June 26, 2025, marking a major milestone in the country’s legal landscape. While the PDPL retains many provisions from its predecessor, Decree No. 13/2023/ND-CP on Personal Data Protection (“PDPD”), it adds new concepts, exemptions, and compliance obligations. Notably, it sets out a framework regulation for penalties for violations, including monetary fines of up to 5% of the corporate violator’s annual revenue in the previous year for cross-border data transfer breaches.

With an effective date of January 1, 2026, the PDPL will apply to (i) Vietnamese agencies, organizations, and individuals; (ii) foreign agencies, organizations, and individuals in Vietnam; and (iii) foreign agencies, organizations, and individuals directly involved in or related to the processing of personal data of Vietnamese citizens and persons of Vietnamese origin without a determined nationality, currently residing in Vietnam, who have been granted a personal identification certificate.

Although the PDPL does not explicitly define its relationship with the currently effective PDPD, the government is drafting a new decree to guide the PDPL’s implementation, the first draft of which is expected to be completed by September 2025, with an effective date aligned with that of the PDPL. Once both the PDPL and its implementing decree come into force, the PDPD will presumably cease to have legal effect. [Update: Decree No. 356/2025/ND-CP detailing and guiding the implementation of the PDPL was issued on December 31, 2025, and took effect on January 1, 2026. See our article here.]

Some key takeaways from the PDPL are presented below.

1. Definitions of “Personal Data,” “Basic Personal Data,” and “Sensitive Personal Data”

The PDPL introduces broad definitions for “personal data,” “basic personal data,” and “sensitive personal data.” It expands the scope of personal data to include both digital and non-digital formats, such as paper-based records. Notably, de-identified personal data is explicitly excluded from the definition of personal data. The PDPL further delegates authority to the government to issue exhaustive lists specifying which types of data qualify as basic and sensitive personal data. These lists are expected to be detailed in the PDPL’s implementing decree.

2. Data Subjects’ Rights and Obligations

The PDPL retains the rights of data subjects as previously outlined in the PDPD, with clarifications of the rights themselves and certain strengthened procedural requirements. In addition to the data subjects’ rights, the PDPL imposes specific obligations on data subjects, including the obligations to:

  • Self-protect their own personal data;
  • Honor and protect others’ personal data;
  • Provide adequate and accurate personal data according to applicable laws and regulations, contracts, or consent given to the processing of their own personal data; and
  • Comply with the personal data protection laws and regulations and participate in the prevention of personal data infringements/violations.

These provisions are designed to prevent misuse of personal data rights and promote a culture of shared responsibility in the digital environment, while reinforcing individuals’ control over their own data.

3. Personal Data Trading and Transfer

The PDPL strictly prohibits the sale and purchase of personal data, except as otherwise prescribed by the law. This prohibition is part of a broader effort to combat the widespread illegal online trading of personal data and prevent insider abuse. Violations of this provision may result in severe penalties, including fines of up to 10 times the revenue gained from the unlawful act of personal data trading.

The PDPL provides clarification, however, that certain types of data transfers do not constitute the “sale and purchase of personal data.” These include:

  • When the data subject has given consent.
  • When data is shared between departments within the same agency or organization for processing in line with the determined purpose.
  • When data is transferred for continued processing due to the division, separation, or merger of agencies, organizations, or administrative units; the reorganization or transformation of ownership of state-owned enterprises; the division, separation, merger, consolidation, or dissolution of entities or organizations; or the establishment of entities or organizations based on the dissolution of other entities or organizations.
  • When the data controllers or data controller-processors transfer data to a data processor or third party (e.g., independent data controllers) for processing as prescribed.
  • Upon request from competent state authorities.
  • In circumstances where personal data can be processed without the data subjects’ consent as prescribed under the PDPL (see item 5 below).

These exceptions are expected to be further detailed in the PDPL’s implementing decree.

4. Maximum Administrative Sanctions for Violations

In addition to the maximum fine for illegal personal data trading, the PDPL sets the maximum administrative fine on an organization for violations related to cross-border personal data transfers at 5% of the violator’s revenue in the preceding fiscal year. In cases where the organization has no revenue in the preceding year, or where the fine calculated based on such revenue is lower than VND 3 billion (approx. USD 114,500), the latter will apply. The maximum administrative fine for other violations in the field of personal data protection is VND 3 billion. The method to calculate revenue arising from violation of personal data protection regulations will be further prescribed by the government under the PDPL’s implementing decree.

5. Consent Requirements

The consent-centric approach and strict consent formality requirements of the PDPD are maintained in the PDPL, which provides additional cases of consent-exemptions. These include, among others, situations where personal data processing is necessary to protect one’s own legitimate rights or interests, or those of others, as necessary against acts that infringe upon such interests (e.g., legal defense), and the fulfillment of contractual obligations not only of the data subjects but also of the service provider.

While the PDPL uses the term “legitimate interest,” its scope is significantly narrower than under the GDPR, and applies only when data processing is required to prevent infringement by third parties.

For situations where consent is exempted, the PDPL introduces a requirement for the data controllers and relevant data processors to implement a monitoring mechanism to protect the data, including but not limited to implementing appropriate data protection measures and regularly assessing possible risks, periodically inspecting and assessing compliance with the law, and receiving and addressing feedback and petitions from relevant parties.

The PDPL includes a transition clause allowing personal data processing activities that have been carried out prior to the effective date of the PDPL with the consent of the data subject or based on an agreement in accordance with the PDPD, to continue, without requiring new consent or a new agreement. This provision offers continuity for businesses already compliant with the PDPD, while signaling the need for updated practices that align with the PDPL’s enhanced standards.

6. Data Processing and Data Transfer Impact Assessment

The requirements for the preparation, submission, and maintenance of a Data Processing Impact Assessment (“DPIA”) and a Data Transfer Impact Assessment (“TIA”) under the PDPD are inherited by the PDPL. The PDPL has assigned the government to provide detailed requirements on the dossier, conditions, order, and procedures for each impact assessment in the PDPL’s implementing decree. However, it is anticipated that these requirements will generally align with those outlined in the PDPD.

To reduce the compliance burden, the PDPL makes it optional for small businesses and startups to comply with the DPIA requirements for five years from the PDPL’s effective date, while household businesses and micro-enterprises are exempt. However, entities that provide personal data processing services, directly process sensitive personal data, or process the personal data of a large number of data subjects are not eligible for this exemption.

The PDPL mandates a six-month update cycle for both the DPIA and the TIA if there are any changes. Immediate updates are required in specific circumstances, such as (i) company restructuring, termination, dissolution, or bankruptcy; (ii) change of organization or individual providing personal data protection services; or (iii) introduction of new business lines/activities or changes to the current business lines/activities involving personal data as declared in the DPIA and TIA.

DPIAs and TIAs received by the Cybersecurity and High-Tech Crime Prevention Department under the Ministry of Public Security (known as the “A05” department) before the PDPL’s effective date (i.e., January 1, 2026) in accordance with the PDPD will remain valid. However, any updates made to these dossiers made after the PDPL comes into force must comply with the requirements set out under the PDPL.

7. Notification of Violations

One of the key changes introduced by the PDPL is the revised timeline for notification of detected violations. Organizations are now required to report violations within 72 hours of detection, rather than from the time of occurrence as previously mandated under the PDPD. Moreover, while the PDPD only requires notification to the regulator (specifically, the A05), the PDPL expands this obligation to include notifying affected data subjects in cases involving biometric data incidents or incidents related to financial service providers.

8. Special Personal Data Protection Mechanisms

Some special data protection mechanisms are introduced under the PDPL, as follows:

For specific data subject groups: The PDPL sets out enhanced and more comprehensive safeguards for the personal data of vulnerable groups, such as children and individuals with limited or lost civil act capacity, or those with cognitive or behavioral impairments. For instance, the processing of children’s data generally requires only parental consent. However, if the data pertains to the child’s private life or personal secrets, and the child is age 7 or older, dual consent from both the child and the parent must be obtained.

For specific businesses and operational activities: The PDPL outlines tailored safeguards for personal data processing activities across various sectors and operational activities, including employment (recruitment and employee management); health data and insurance business; financial, banking, and credit information activities; advertising services; social network platforms and online communications services; big data processing, artificial intelligence, blockchain, virtual universe and cloud computing; and audio and video recording in public places and public activities. While some provisions are sector-specific, some can be generally applied to all enterprises; for instance, the requirement for deletion/destruction of information provided by job applicants who are not hired, unless there is a different agreement with the applicant.

For specific types of sensitive personal data: Specific safeguards required for processing location and biometric data are also prescribed under the PDPL.

9. Personal Data Protection Department and Personnel

The PDPL requires organizations to either designate a qualified department and personnel dedicated to personal data protection, or engage external data protection service providers. Such personal data protection departments, personnel, and service providers are components of what the PDPL refers to as the “personal data protection forces.”

While the government has yet to issue detailed regulations on “personal data protection forces,” further guidance on the conditions, responsibilities, and tasks of the designated data protection department and personnel are expected in the PDPL’s implementing decree.

Small and startup enterprises are granted a five-year grace period from the PDPL’s effective date to determine whether to comply, while household businesses and micro-enterprises are exempted from this requirement (save for cases where these entities provide personal data processing services, directly process sensitive personal data, or process the personal data of a large number of data subjects).

Outlook

The promulgation of the PDPL represents a major advancement in Vietnam’s legal landscape, reinforcing the existing data protection framework for better safeguarding the privacy and personal rights of Vietnamese citizens in the digital era, and at the same time promoting the digital economy and international integration in the country. Businesses will need to reevaluate and consolidate their data governance practices and internal controls to ensure prompt and effective PDPL compliance. It is also important for businesses to keep an eye on upcoming regulations and guidance to properly implement the PDPL.

Related Professionals

Industries

Technology

Location

RELATED INSIGHTS​ 

September 30, 2026
On September 15, 2026, Vietnam’s Ministry of Finance (MOF) released for public consultation a draft circular on reporting and information disclosure in the pilot crypto asset market. The draft implements Resolution No. 05/2025/NQ-CP on the Pilot Implementation of the Crypto Asset Market in Vietnam and provides further detail on how licensed crypto asset service providers (“CASPs”) will be supervised once the market becomes operational. The draft indicates a data-intensive supervisory model, with licensed CASPs serving as the first line of market oversight. Public Disclosure Requirements The draft imposes detailed public disclosure requirements on CASPs, aimed primarily at market transparency. CASPs and crypto asset issuers must make disclosures in both Vietnamese and English, retain reported and disclosed information for at least 10 years, and keep information published on their websites accessible for at least five years. For CASPs, disclosure obligations arise both periodically and when specific events occur. A CASP must announce any crypto asset to be admitted to trading on its website at least seven days before trading begins and publish periodic financial statements. Certain extraordinary events and information requested by the MOF must generally be disclosed within 24 hours. CASPs must also provide ongoing market information. During trading hours, they must publish key trading data, including prices and volumes, daily highs and lows, average prices, the three best bid and offer levels, and transactions by foreign investors. By 9:00 a.m. each trading day, they must publish specified information on the previous day’s trading activity. Regulatory Reporting Requirements Separate from public disclosure, the draft requires CASPs to provide regulators with detailed information enabling ongoing supervision of their operations and the market. For market activity, CASPs must report decisions to admit or remove a crypto asset from trading within 24 hours, submit previous-day trading data to the State Securities Commission
Read More
September 24, 2026
Vietnam is implementing and developing a broad package of regulatory reforms that could reshape how IP, data, digital platforms, and product authenticity are regulated and enforced. Several of the key measures have been led by the Ministry of Public Security in its legislative and administrative capacity, as part of a broader government effort. The core reform package consists of four key legal instruments: proposed amendments to the Criminal Code, a proposed new Data Security Law, a draft Decree on Product Identification, Authentication and Traceability, and the newly enacted Decree No. 330/2026/ND-CP. These instruments include rules on criminal enforcement, data security, electronic identification, product identification and traceability, administrative violations, and cybersecurity sanctions. Combined, these measures will affect copyright enforcement, industrial property rights, trade secrets, AI training data, product provenance, online takedowns, valuation of counterfeit goods and electronic evidence. It is worth noting that, in addition to strengthening criminal penalties for IP crimes, Vietnam’s emerging regulatory framework increasingly treats infringement, data misuse, product authentication, and platform-enabled violations as interconnected regulatory and enforcement challenges. For rights holders and foreign investors, this could mean stronger tools against counterfeiting and online infringement, but also more compliance obligations around data, traceability, AI, platform controls and government-facing reporting. Expansion of Criminal IP Enforcement Proposed amendments to Article 225 of the Criminal Code would expand criminal copyright exposure beyond reproduction and distribution to cover large-scale commercial public performance and online communication of works, phonograms and video recordings. This is important because piracy is increasingly about streaming, unauthorized communication, and platform access models rather than physical copying. Aggravated copyright infringement could be subject to up to 10 years in prison for individuals and fines of up to VND 6 billion (about USD 228,300) for commercial legal entities. The amended Article 226 would expand criminal industrial property liability beyond
Read More
September 17, 2026
Thailand’s Office of the Consumer Protection Board (OCPB) has released for public comment a draft bill to amend the Consumer Protection Act B.E. 2522 (1979), the country’s foundational consumer protection legislation. The draft amendment aims to modernize the nearly five-decade-old framework to address the rapid growth of digital commerce, online advertising, influencer marketing, and new business models. The public consultation period is open until October 10, 2026. Expanded Definitions Covering Digital Commerce The draft significantly broadens several core definitions to capture modern commercial activities: “Consumer” is expanded to include natural persons and nonprofit juristic persons who purchase or receive services, including those solicited by businesses and end users who do not directly pay for the goods or services. “Business operator” now explicitly covers advertising business operators and hired advertising persons, such as influencers and content creators. “Advertising media” is expanded to include digital platforms, social media, and social media user accounts. “Label” now encompasses electronic labels—symbols, codes, or other electronic formats displaying product information. Influencer and Advertising Disclosure Requirements In addition to these expanded definitions, “hired advertising person for selling goods or services” is a new definition covering influencers, content creators, live streamers, affiliate marketers, and virtual online media operators who receive monetary compensation or other benefits for advertising goods or services. Hired advertising persons—including influencers and content creators—must disclose to consumers that content is advertising and reveal their relationship with the business owner. Disclosure is required when the business owner employs the advertiser, pays or provides other benefits for the advertisement, or provides free or discounted products or services. These requirements apply where consumers would not otherwise know that the business has a connection to the person presenting the content. Labeling Requirements for Importers The draft introduces a clearer labeling obligation for importers of label-controlled goods, who must
Read More
September 11, 2026
Thailand’s National Broadcasting and Telecommunications Commission (NBTC) has published a new five-year master plan that will bring significant regulatory changes to the broadcasting and digital media sectors, including formal licensing requirements for internet-based audiovisual services. The Master Plan for Broadcasting and Television, 3rd Edition (B.E. 2569–2573/2026–2030) was published in the Government Gazette on September 1, 2026, and will affect OTT platforms, internet-based audiovisual service providers, and traditional broadcasters. Licensing Reform The NBTC will develop new licensing frameworks ahead of existing digital television license expirations, which are slated to occur between 2028 and 2030. This creates both uncertainty and opportunity for incumbents and new market entrants. New licensing criteria will also be developed for audiovisual services delivered over the internet, meaning previously unregulated internet-based providers may face licensing, fee, and content obligations for the first time. The plan also calls for a new law to govern converged communications services. OTT Regulation and Content Oversight The plan explicitly acknowledges and aims to lessen the regulatory asymmetry between traditional broadcasters—which are subject to licensing, fees, and content regulation—and internet-based services that currently face fewer obligations. The NBTC intends to develop regulatory frameworks to bring internet-based audiovisual services, including OTT platforms, streaming services, and user-generated content platforms, under content, consumer protection, and licensing requirements. Consumer Protection and Digital Rights The NBTC will strengthen its oversight of broadcasting, television, and telecommunications operators to ensure compliance with consumer protection and personal data protection requirements. This includes updating relevant notifications and orders and more strictly enforcing rules against practices that unfairly exploit consumers. These measures may layer NBTC-specific requirements on top of Thailand’s existing Personal Data Protection Act obligations. Stricter enforcement against practices that exploit consumers is a priority, with particular scrutiny on advertising practices. The NBTC will modernize complaint resolution processes, meaning service providers should
Read More