Vietnam PDPL
In force Vietnam · In force Jan 1, 2026 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Vietnam's first statute on personal data protection, replacing Decree 13/2023. It covers consent, data subject rights, processing and transfer impact assessments filed with the regulator, cross-border transfers, breach reporting, and bans on buying and selling personal data. Decree 356/2025 took effect alongside it and details DPIA/TIA and DPO requirements.
- Who it applies to
- Vietnamese and foreign agencies, organizations and individuals directly processing or involved in processing personal data of Vietnamese citizens and people in Vietnam. Household businesses and micro-enterprises are exempt from DPIA/TIA unless they provide data processing services, process sensitive data directly, or process data of large numbers of people. DPIA/TIA must be filed within 60 days of starting processing.
- Penalties
- Cross-border transfer violations: up to 5% of prior-year revenue. Illegal buying or selling of personal data: up to 10x the illegal proceeds (VND 3 billion cap if proceeds cannot be determined). Other violations: up to VND 3 billion for organizations. Criminal liability may apply. A separate penalty decree is still expected.
- Enforced by
- Ministry of Public Security (Department of Cybersecurity and High-Tech Crime Prevention, A05)
- Official name
- Law on Personal Data Protection (Law No. 91/2025/QH15)
- Citation
- Law No. 91/2025/QH15; implemented by Decree No. 356/2025/ND-CP
- Topics
- privacy, data-residency, children, breach-notification
Research notes
source_url is the Government legal documents portal (vanban.chinhphu.vn) record for Law 91/2025/QH15: issued 26 Jun 2025 by the National Assembly (signed by Tran Thanh Man), effective 1 Jan 2026; the signed PDF is in extra_sources. The same portal lists Decree 356/2025/ND-CP as issued 31 Dec 2025, effective 1 Jan 2026. Reports of a 5-year exemption for small enterprises and startups from some duties were not verified. The implementing penalty decree was still pending as of the latest source.
Related
Australia Cyber Security Act (ransomware reporting)Questions about Vietnam PDPL
- What are the Vietnam PDPL compliance deadlines?
- Jan 1, 2026: PDPL and Decree 356/2025 take effect.
- When does Vietnam PDPL take effect?
- Vietnam PDPL took effect on Jan 1, 2026.
- Who does Vietnam PDPL apply to?
- Vietnamese and foreign agencies, organizations and individuals directly processing or involved in processing personal data of Vietnamese citizens and people in Vietnam. Household businesses and micro-enterprises are exempt from DPIA/TIA unless they provide data processing services, process sensitive data directly, or process data of large numbers of people. DPIA/TIA must be filed within 60 days of starting processing.
- What are the penalties under Vietnam PDPL?
- Cross-border transfer violations: up to 5% of prior-year revenue. Illegal buying or selling of personal data: up to 10x the illegal proceeds (VND 3 billion cap if proceeds cannot be determined). Other violations: up to VND 3 billion for organizations. Criminal liability may apply. A separate penalty decree is still expected.