Personal data protection: the Personal Data Protection Law 2025 and Decree No. 356/2025/ND-CP, extraterritorial scope, controllers and processors, consent and the other legal bases, sensitive data, data subject rights and response times, impact assessments, breach notification, data protection officers, the SME grace period, penalties under Decree No. 330/2026/ND-CP and a compliance checklist

A law, not a decree

Vietnam's first comprehensive data protection instrument was Decree No. 13/2023/ND-CP. It was replaced on 1 January 2026 by Law No. 91/2025/QH15 on Personal Data Protection (the PDPL), passed on 26 June 2025, and by its implementing decree, Decree No. 356/2025/ND-CP, issued on 31 December 2025 and effective the next day (FAQ 81). The penalties are in Decree No. 330/2026/ND-CP, effective 19 August 2026, which also covers cybersecurity violations. Supervision and enforcement sit with the Ministry of Public Security's Department of Cybersecurity and High-Tech Crime Prevention (A05), which receives impact assessment dossiers and breach notifications, runs the national personal data protection portal and inspects compliance.

The PDPL applies to Vietnamese and foreign organisations and individuals in Vietnam, and to foreign organisations and individuals abroad that directly process, or are involved in processing, the personal data of Vietnamese citizens and certain persons resident in Vietnam. A foreign parent that runs the group HR system, a foreign e-commerce operator that sells to Vietnamese consumers, and a foreign cloud or analytics provider that processes data for a Vietnamese customer may all be within its reach. The same rules apply to domestic and foreign-owned companies. Personal data protection overlaps with the cybersecurity and data localisation rules, which are in Cybersecurity, data localisation and cross-border transfers.

Roles: controller, processor and third parties

The PDPL allocates duties by role. A personal data controller decides the purposes and means of processing; a personal data processor processes on the controller's behalf under a contract; a controller-processor does both; and a third party is any other person permitted to process the data. The controller carries the main obligations: identifying a legal basis, giving notice, obtaining consent, responding to data subjects, preparing impact assessments, implementing security measures and notifying breaches. The processor must process only as instructed, apply security measures, assist the controller and delete or return data at the end of the contract. Decree No. 356/2025/ND-CP requires a written agreement for transfers to processors and third parties and for transfers in a restructuring, covering the purpose, data subjects, types of data, duration, deletion, legal basis and responsibilities, and requires encryption, anonymisation or equivalent protection when sensitive data is transferred.

Within a group, the Vietnamese subsidiary is usually the controller of its customer and employee data, and its parent or a regional shared-service centre acts as processor or as a further controller. The intra-group data transfer agreement should reflect the actual roles; a parent that sets the purposes of a global HR or CRM system is likely to be a controller in its own right.

Legal bases and consent

Consent is the default basis. It must be given freely and expressly for a specific purpose, on the basis of notice of the purpose, types of data, recipients, the data subject's rights and the consequences of processing; silence or inaction is not consent. Decree No. 356/2025/ND-CP requires consent to be recorded so that its timing and content can be verified, prohibits pre-ticked boxes and unclear or misleading settings, and accepts consent given by phone, email, website, platform or application where the technical settings meet those standards. Consent can be withdrawn at any time, and the controller must then stop processing within the time limits described below. Separate consent is needed for each purpose, so a bundled consent in a long privacy policy is weak.

Article 19(1) of the PDPL lists five cases in which personal data may be processed without consent: to protect the life, health, dignity, rights or lawful interests of the data subject or others in urgent situations; to respond to emergencies, national security threats, terrorism, crime and other violations; to serve the activities of State agencies and State management under the law; to perform an agreement between the data subject and the relevant organisation or individual as the law prescribes; and other cases provided by law. Employment and customer contracts can therefore support processing necessary to perform them, but marketing, profiling, transfers to group companies for their own purposes and sharing with partners generally still need consent. The PDPL prohibits buying and selling personal data except as the law allows.

Sensitive personal data

The PDPL distinguishes basic and sensitive personal data, and Decree No. 356/2025/ND-CP lists each. Sensitive data includes data on political and religious views, health status, genetic and biometric data, sex life and orientation, criminal records, precise location, and, among the decree's additions, behaviour-tracking and usage data from telecommunications, social network, online media and other cyberspace services, usernames and passwords for electronic identification accounts, images of identity cards, and bank account, payment card and financial transaction data. Processing sensitive data requires notice that the data is sensitive, stronger security and access controls, and it removes the small-enterprise grace period described below. A business that tracks app users, processes card payments or keeps copies of customers' identity cards is therefore processing sensitive data and should plan accordingly.

Data subject rights and response times

Individuals have the rights to be informed, to consent and to withdraw consent, to access their data and obtain a copy, to correct it, to have it deleted, to restrict or object to processing, to complain and to claim compensation (FAQ 83). Decree No. 356/2025/ND-CP sets the clock. The controller must respond to any request within two working days. It must then implement a request to withdraw consent, restrict or object within 15 days (20 days where processors or third parties are involved); a request to access, correct or provide data within 10 days (15); and a request to delete within 20 days (30). Each period may be extended once, by up to the same number of days. A business with large consumer volumes needs a request-handling procedure, identity verification and a log; the response times are too short to be met by ad hoc handling.

Impact assessments

Controllers and processors must prepare a personal data processing impact assessment, and before sending personal data abroad, including by storing it on servers outside Vietnam or using an offshore cloud, a transfer impact assessment, and file them with A05 online (FAQ 82). Decree No. 356/2025/ND-CP allows 60 days from the start of the transfer to file the transfer dossier; A05 reviews a dossier within 15 days and may require it to be supplemented within 30 days. Dossiers must include the organisation's internal data protection policies, procedures and templates and a data-flow description for each role, and must be updated every six months where new purposes arise or the controller, processor or third party changes, and within ten days of a reorganisation, dissolution, change of protection service provider or change of business lines involving personal data. The decree exempts transfers made for personnel management under labour rules, internal rules and collective labour agreements from the transfer impact assessment, but the exemption is narrow, and global HR platforms used for wider purposes should still be assessed. Where personal data is also core or important data under the Data Law, the PDPL dossiers replace the separate Data Law assessment.

Breaches, officers and the SME grace period

A controller must notify A05 within 72 hours of detecting a reportable violation of the personal data protection rules, and processors must notify the controller promptly. Certain breaches must also be notified to the individuals affected, including breaches at financial service providers and those involving biometric or location data, within 72 hours of discovery or, where individual notice is not feasible, by public disclosure; breach records must be kept for at least five years after remediation. Organisations must designate a personal data protection department or officer with the qualifications Decree No. 356/2025/ND-CP prescribes, a college degree or higher, at least two years' relevant experience and data protection training, or engage a qualified external service provider.

Small enterprises and start-ups have a five-year grace period from 1 January 2026 for appointing a data protection officer or provider and for preparing, updating and filing impact assessments, and household businesses and micro-enterprises are largely exempt. The relief does not apply to an enterprise that provides personal data processing services, directly processes sensitive personal data, or processes the data of 100,000 or more data subjects, so many consumer-facing and technology start-ups do not benefit.

Penalties

Decree No. 330/2026/ND-CP, effective 19 August 2026, implements the penalty ceilings in the PDPL. Organisations may be fined up to VND 3 billion for most violations, and individuals half that. Unlawful buying or selling of personal data is fined up to ten times the proceeds. Violations of the cross-border transfer rules, such as transferring without the required dossier, concealing or falsifying data flows that lead to leakage, or continuing after a stop order, are fined as a percentage of the previous year's Vietnamese revenue: 1% to 2% where 10,000 to under 100,000 data subjects are affected, 2% to 3% from 100,000 to under one million, and 3% to 5% from one million, with fixed fines of up to VND 3 billion where there is no Vietnamese revenue or the percentage would be lower. Lesser fines apply to dossier and procedural failures, processing may be suspended until an impact assessment failure is cured, and serious cross-border violations can lead to suspension of transfers for six to 12 months. Individuals responsible may also face criminal liability for illegal use of information on computer networks under the Penal Code.