Regulations › Rest of world › Vietnam
PDPL
Law on Personal Data Protection (No. 91/2025/QH15)
WhenIn effect since 1 January 2026
Who enforces itMinistry of Public Security, Department of Cybersecurity and High-Tech Crime Prevention (A05)
Who it applies toOrganizations and individuals in Vietnam and foreign entities directly processing personal data of Vietnamese citizens and residents.
Tell the regulatorNotify the specialized agency (A05) within 72 hours of detecting a breach likely to cause seri…
DPO requiredMust appoint qualified data protection personnel or department, or hire a service provider
RegistrationNo controller registration
Transfers abroadTransfer impact assessment dossier must be filed with MPS within 60 days of first transfer, pl…
Request deadlineAcknowledge within 2 working days
Maximum fineUp to 5% of prior-year revenue for cross-border violations, 10x revenue for illegal data tradi…
43%
of Vietnam's 21 requirements are already met by European Union (GDPR). Here is what PDPL adds, biggest gaps first.
Lawful basisReach and lawful basisBig gap
GDPR1 Six lawful bases, including consent, contract, legal obligation, vital interests, public task and legitimate interests.
PDPL adds3 Consent is the default basis; the Law adds listed exceptions such as contract performance, legal obligations and protecting legitimate rights.
Art. 9 (exceptions in later articles) · source ↗
LocalizationTransfersBig gap
GDPR– Not addressed
PDPL adds2 Certain domestic and foreign service providers must store specified user data in Vietnam under cybersecurity rules.
Cybersecurity Law 2018 Art. 26; Decree 53/2022 · source ↗
Reach abroadReach and lawful basisGap
GDPR2 Applies to non-EU controllers offering goods or services to, or monitoring the behavior of, people in the EU.
PDPL adds3 Applies to foreign entities in Vietnam and to foreign entities directly processing data of Vietnamese citizens and residents in Vietnam.
Art. 1(2) · source ↗
ConsentReach and lawful basisGap
GDPR2 Consent must be freely given, specific, informed and unambiguous by clear affirmative action, and the controller must be able to demonstrate it.
PDPL adds3 Consent must be voluntary, informed, per purpose and provable in writing or verifiable form; silence, defaults and pre-ticked boxes are invalid.
Art. 9; Decree 356 Art. 6 · source ↗
Request deadlinePeople's rightsGap
GDPR2 Respond within one month, extendable by two further months for complex or numerous requests.
PDPL adds3 Acknowledge within 2 working days; access or correction within 10 days, restriction or objection 15 days, deletion 20 days (longer if processors involved).
Decree 356 Art. 5 · source ↗
DPO requiredGovernanceGap
GDPR1 DPO required for public bodies, large-scale systematic monitoring, or large-scale special-category or criminal data processing.
PDPL adds2 Must appoint qualified data protection personnel or department, or hire a service provider.
Art. 33(1)-(2) · source ↗
DPO qualificationsGovernanceGap
GDPR1 DPO chosen for professional qualities, especially expert knowledge of data protection law and practice; no certification required.
PDPL adds2 College degree or higher, at least 2 years relevant experience, and training in personal data protection law and skills.
Decree 356 Art. 13(2) · source ↗
RegistrationGovernanceGap
GDPR0 No general registration; controllers communicate DPO contact details to the supervisory authority.
PDPL adds1 No controller registration; impact assessment dossiers are filed with the Ministry of Public Security instead.
Arts. 21-22 · source ↗
DPIAGovernanceGap
GDPR2 DPIA required before processing likely to result in high risk; prior consultation if residual high risk remains.
PDPL adds3 Impact assessment dossier must be filed with the A05 department within 60 days of starting processing and updated every 6 months.
Arts. 21-22 · source ↗
RetentionGovernanceGap
GDPR1 Storage limitation: keep identifiable data no longer than necessary; erase when no longer needed.
PDPL adds2 Delete when purpose is complete, retention period ends, ordered by authorities, or on request.
Art. 14 · source ↗
Transfers abroadTransfersGap
GDPR2 Transfers outside the EEA need an adequacy decision or appropriate safeguards (SCCs, BCRs), or a listed derogation.
PDPL adds3 Transfer impact assessment dossier must be filed with MPS within 60 days of first transfer, plus a written agreement with the recipient.
Art. 20 · source ↗
Criminal liabilityEnforcementGap
GDPR1 Member States set other penalties, including criminal penalties, for infringements not subject to administrative fines.
PDPL adds2 Violations may be criminally prosecuted depending on severity under the Penal Code.
Art. 8(1); Penal Code Art. 288 · source ↗
Already covered by GDPR: Sensitive data, Children, Rights, Marketing, Records, Tell the regulator, Tell people, Maximum fine, Private action.
A gap means PDPL is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws