Data protection & privacy law in Vietnam (2026)
Data protection in Vietnam: comprehensive law.
Vietnam enacted its first standalone comprehensive Personal Data Protection Law (Law 91/2025/QH15) on 26 June 2025, which came into force on 1 January 2026, elevating the previous decree-level framework (Decree 13/2023) to full statutory law. The law imposes GDPR-influenced obligations on data controllers and processors, including consent, breach notification, and impact assessments. Decree 356/2025/ND-CP, also effective 1 January 2026, provides detailed implementing rules and replaces Decree 13.
Legal framework
Law No. 91/2025/QH15 on Personal Data Protection (effective 1 January 2026), implemented by Decree No. 356/2025/ND-CP; supervised by the Ministry of Public Security (Department of Cybersecurity and Prevention of Cybercrimes)
Key points: data & privacy in Vietnam
Primary Law
Law No. 91/2025/QH15 on Personal Data Protection was passed by the National Assembly on 26 June 2025 and took effect 1 January 2026, replacing Decree 13/2023/ND-CP as the primary framework. Decree 356/2025/ND-CP (promulgated 31 December 2025) provides the detailed implementing regulations.
Supervisory Authority
The Ministry of Public Security (MPS), specifically its Department of Cybersecurity and Prevention of Cybercrimes, is the primary enforcement authority. The Ministry of Information and Communications retains supplementary jurisdiction over digital and telecom-related data matters.
Consent & Data Subject Rights
Explicit, documented consent is required before processing personal data (with enumerated exceptions). Data subjects hold 11 statutory rights including access, rectification, deletion, restriction of processing, data portability, and the right to object; requests to restrict or object must be addressed within 72 hours.
Impact Assessments & Breach Notification
Data Protection Impact Assessments (DPIAs) must be completed within 60 days of commencing processing activities. Cross-border transfers require a separate Cross-border Transfer Impact Assessment (CTIA), submitted to the MPS within 60 days of the first transfer. Data breaches must be notified to authorities within 72 hours of detection.
Sensitive Data & Data Localisation
Decree 356 expands the sensitive data category to include location data, online account credentials and behavioural tracking, bank account and transaction details, and images of ID documents. Domestic websites and social networks are required to store Vietnamese users' data on servers with IP addresses located within Vietnam.
Penalties
Sanctions include fines of up to 5% of a corporate violator's preceding-year annual revenue for unauthorised cross-border data transfers, up to 10 times illicitly gained revenue from unlawful buying or selling of personal data, and monetary penalties up to VND 3 billion. An administrative sanctions decree with fuller enforcement detail was in final drafting as of early 2026.
Timeline of decisions
- Law · officialLaw on Personal Data Protection No. 91/2025/QH15 takes effect
Passed by the National Assembly on 26 June 2025, this landmark statute elevates personal-data rules from decree to primary legislation for the first time, establishing data-subject rights (access, rectification, erasure), a 72-hour breach-notification duty, and fines up to VND 3 billion or 10× illegal profits. Implementing Decree No. 356/2025/ND-CP was promulgated on 31 December 2025.
LuatVietnam (official English translations, Vietnam News Agency)
- Law · officialDecree 356/2025/ND-CP: Implementing Regulation for the Personal Data Protection Law
Issued on 31 December 2025 and effective 1 January 2026 alongside the PDPL, Decree 356 replaces Decree 13/2023 and converts the new law into concrete operational obligations, prescribing Data Protection Officer qualifications (minimum college degree, two years' experience), mandatory written data-transfer agreements, sector-specific rules for AI/fintech/blockchain/metaverse, and stricter verifiable-consent documentation standards.
Thư Viện Pháp Luật – Vietnam National Legal Database
- Law · officialLaw on Personal Data Protection (No. 91/2025/QH15) Enacted, Effective 1 January 2026
Vietnam's first dedicated Personal Data Protection statute elevated data-privacy rules from decree level to primary legislation, superseding Decree 13/2023. It applies extraterritorially to any entity processing data of Vietnamese citizens, shortens breach notification to 72 hours from detection, and authorises fines of up to 5% of annual revenue for cross-border data-transfer violations.
LuatVietnam — Official Gazette of Vietnam
- Law · officialNational Assembly Enacts Personal Data Protection Law (Law No. 91/2025/QH15)
Vietnam's first statutory personal data protection law, effective 1 January 2026, elevates the framework from decree-level rules to national legislation, explicitly bans the sale and purchase of personal data, mandates Data Processing Impact Assessments within 60 days of processing commencement, introduces Cross-border Transfer Impact Assessments, and sets penalties up to 10× revenue from illegal data sales or 5% of prior-year revenue for cross-border transfer violations.
Thư Viện Pháp Luật – Vietnam National Legal Database
- EnforcementMinistry of Public Security Launches Inaugural Decree 13 Compliance Enforcement Campaign
In late 2024 the Ministry of Public Security conducted Vietnam's first systematic compliance inspection campaign under Decree 13/2023, focusing on lawful data sharing and network-security measures for personal data; marked the transition from a purely legislative phase to active regulatory oversight and signalled heightened enforcement risk for non-compliant organisations.
KPMG Vietnam
- LawPersonal Data Protection Decree No. 13/2023/ND-CP Takes Effect
Vietnam's first comprehensive personal data protection rules (issued 17 April 2023, effective 1 July 2023) applied to any entity processing Vietnamese residents' data, including AI systems using personal data for training or inference. It established consent requirements, data-subject rights, and mandatory data-processing impact assessments, directly shaping permissible AI data pipelines.
KPMG Vietnam
- Law · officialDecree 13/2023/ND-CP on Protection of Personal Data Takes Effect
Issued 17 April 2023 and effective 1 July 2023, this was Vietnam's first comprehensive personal data protection instrument: it introduced a two-tier classification (basic vs. sensitive personal data), a consent-centric processing framework, mandatory 72-hour breach notification to the Department of Cybersecurity and High-Tech Crime Prevention, Data Processing Impact Assessment filings, and fines of up to 5% of Vietnam revenue for disclosures affecting over one million data subjects.
Thư Viện Pháp Luật – Vietnam National Legal Database
- LawDecree 13/2023/ND-CP on Personal Data Protection enters into force
Vietnam's first comprehensive personal-data regulation (issued 17 April 2023) took effect, requiring data controllers and processors to conduct and submit Personal Data Processing Impact Assessments to the Ministry of Public Security within 60 days, notify breaches within 72 hours, and appoint a data-protection officer for sensitive-data processing. It applied to all entities processing Vietnamese citizens' data regardless of where processing occurs.
DLA Piper
- Law · officialDecree 13/2023/ND-CP: First Comprehensive Personal Data Protection Instrument
Effective 1 July 2023, Decree 13 was Vietnam's first dedicated data-protection legal instrument, introducing GDPR-style consent requirements, a 72-hour breach-notification obligation to the Ministry of Public Security's Cybersecurity Department, and explicit cross-border data-transfer conditions, applying to any entity processing personal data of Vietnamese users regardless of where processing occurs.
LuatVietnam — Official Gazette of Vietnam
- LawDecree 53/2022/ND-CP Operationalises Data Localisation Under the Cybersecurity Law
Effective 1 October 2022, Decree 53 gave the Cybersecurity Law's vague data localisation mandate enforceable substance: telecoms, e-commerce, social networks, online payment, and other internet-service providers must store personal data, user-relationship data, and user-generated data in Vietnam for at least 24 months, and foreign firms must establish a branch or representative office within 12 months of a formal ministerial request.
KPMG Vietnam (Decree 53/2022/ND-CP Legal Alert)
- Incident · officialVNG Data Breach: 163 Million Zing Accounts Exposed
Personal data from more than 163 million Zing ID accounts, including usernames, hashed passwords, emails, phone numbers, and IP addresses, were offered for sale on hacking forum Raidforums; the Ministry of Public Security later cited this incident as a primary catalyst for drafting comprehensive personal data protection legislation.
Vietnam.vn – Vietnam Government Portal
- Law · officialCivil Code 2015 (No. 91/2015/QH13) Codifies Right to Privacy and Personal Data
Effective 1 January 2017, the Civil Code explicitly recognised the right to privacy and protection of personal information as enforceable civil rights, providing a foundational legal basis for data protection claims in Vietnamese courts and underpinning all subsequent sector-specific data regulations.
Thư Viện Pháp Luật – Vietnam National Legal Database
- Law · officialLaw on Cyber Information Security No. 86/2015/QH13 Enacted
Effective 1 July 2016, this law established the first dedicated personal data protection obligations in Vietnam's online environment, defining personal information, requiring owner consent for collection and use, mandating appropriate security measures, and granting individuals rights to access and correct their data, superseding the IT Law's narrower provisions.
Thư Viện Pháp Luật – Vietnam National Legal Database
- LawLaw on Information Technology No. 67/2006/QH11, Vietnam's First Statutory Personal Data Provisions
Article 21 of this law marked the first time personal information protection was codified in Vietnamese law: it required consent before online collection of personal data, established purpose-limitation principles, and granted individuals rights to access and correct their information, laying the conceptual foundation on which all subsequent data protection legislation was built.
Securiti (citing Law No. 67/2006/QH11)
Sources
- tilleke.com/insights/vietnams-new-personal-data-protection-law-a-closer-look/
- vietnam-briefing.com/news/vietnam-personal-data-protection-regulation-decree-356.html/
- hoganlovells.com/en/publications/vietnam-enacts-landmark-law-on-personal-data-protecti
- iapp.org/news/a/vietnams-pdpl-in-focus-what-to-know-and-watch-for
- dlapiperdataprotection.com/?t=law&c=VN
- mondaq.com/privacy-protection/1731760/key-developments-in-personal-data-protecti
- english.luatvietnam.vn/dan-su/law-on-personal-data-protection-law-no-91-2025-qh15-405135-d1.
- dfdl.com/insights/legal-and-tax-updates/vietnam-personal-data-protection-2026-
- rouse.com/insights/news/2025/vietnam-s-new-personal-data-protection-law-what-bu
- kpmg.com/vn/en/home/insights/2023/04/legal-alert-on-decree-13.html
- itif.org/publications/2025/03/07/vietnam-data-localization-regulation/
Next for Vietnam: Digital Payments & FintechLicensing regime
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026