Regulations › Rest of world › Vietnam
PDPL
Law on Personal Data Protection (No. 91/2025/QH15)
WhenIn effect since 1 January 2026
Who enforces itMinistry of Public Security, Department of Cybersecurity and High-Tech Crime Prevention (A05)
Who it applies toOrganizations and individuals in Vietnam and foreign entities directly processing personal data of Vietnamese citizens and residents.
Tell the regulatorNotify the specialized agency (A05) within 72 hours of detecting a breach likely to cause seri…
DPO requiredMust appoint qualified data protection personnel or department, or hire a service provider
RegistrationNo controller registration
Transfers abroadTransfer impact assessment dossier must be filed with MPS within 60 days of first transfer, pl…
Request deadlineAcknowledge within 2 working days
Maximum fineUp to 5% of prior-year revenue for cross-border violations, 10x revenue for illegal data tradi…
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
3
Applies to foreign entities in Vietnam and to foreign entities directly processing data of Vietnamese citizens and residents in Vietnam.Art. 1(2) · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial.
Lawful basis
3
Consent is the default basis; the Law adds listed exceptions such as contract performance, legal obligations and protecting legitimate rights.Art. 9 (exceptions in later articles) · secondary source · source ↗
Exception article number not confirmed.
Consent
3
Consent must be voluntary, informed, per purpose and provable in writing or verifiable form; silence, defaults and pre-ticked boxes are invalid.Art. 9; Decree 356 Art. 6 · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial.
Sensitive data
2
Sensitive data list set by Government (now includes banking, credit, location and behavioral data); extra safeguards and notice required.Arts. 2(3), 26, 27, 31 · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial.
Children
2
Legal representative acts for children (under 16); child aged 7+ and representative must both consent for private-life data.Art. 24(2)-(3) · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial. Under-16 definition comes from the Law on Children.
People's rights
Rights
2
Be informed, consent and withdraw, access, correction, deletion, restriction, objection, complaint and lawsuit.Arts. 4(1), 10 · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial. Counted 5 core rights (access, correction, deletion, restriction, objection); no portability right confirmed.
Request deadline
3
Acknowledge within 2 working days; access or correction within 10 days, restriction or objection 15 days, deletion 20 days (longer if processors involved).Decree 356 Art. 5 · secondary source · source ↗
Decree 13 had 72 hours; Decree 356 replaced it on 1 Jan 2026.
Marketing
2
Consent required for behavioral and targeted advertising, with an opt-out mechanism, plus anti-spam rules.Arts. 28-29 · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial.
Governance
DPO required
2
Must appoint qualified data protection personnel or department, or hire a service provider.Art. 33(1)-(2) · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial. Small businesses/startups have a 5-year grace period; household and micro businesses exempt unless processing sensitive data or many data subjects.
DPO qualifications
2
College degree or higher, at least 2 years relevant experience, and training in personal data protection law and skills.Decree 356 Art. 13(2) · secondary source · source ↗
Registration
1
No controller registration; impact assessment dossiers are filed with the Ministry of Public Security instead.Arts. 21-22 · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial. Filing counted under dpia.
DPIA
3
Impact assessment dossier must be filed with the A05 department within 60 days of starting processing and updated every 6 months.Arts. 21-22 · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial. MPS reviews within 15 days (PwC).
Records
2
Controllers must keep evidence of consent and document processing in the filed impact assessment dossier.Decree 356 Art. 6(2); Art. 21 · secondary source · source ↗
No standalone ROPA article confirmed; scored on dossier documentation.
Retention
2
Delete when purpose is complete, retention period ends, ordered by authorities, or on request.Art. 14 · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial.
Breaches
Tell the regulator
2
Notify the specialized agency (A05) within 72 hours of detecting a breach likely to cause serious harm.Art. 23(1)-(2) · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial.
Tell people
1
Notify individuals only for biometric data incidents or financial-sector (bank) sensitive data incidents.Art. 23; Decree 356 Art. 8 · secondary source · source ↗
Narrow sectoral duty; no general individual notice confirmed.
Transfers
Transfers abroad
3
Transfer impact assessment dossier must be filed with MPS within 60 days of first transfer, plus a written agreement with the recipient.Art. 20 · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial. Filing rather than prior approval; some HR, hotel, visa and payment data exempt.
Localization
2
Certain domestic and foreign service providers must store specified user data in Vietnam under cybersecurity rules.Cybersecurity Law 2018 Art. 26; Decree 53/2022 · secondary source · source ↗
Outside Law 91; not re-verified this session. Check whether the 2025 Cybersecurity Law changes the rule.
Enforcement
Maximum fine
3
Up to 5% of prior-year revenue for cross-border violations, 10x revenue for illegal data trading, VND 3 billion for other violations.Art. 8(3)-(6) · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial.
Criminal liability
2
Violations may be criminally prosecuted depending on severity under the Penal Code.Art. 8(1); Penal Code Art. 288 · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial. Penal Code article not verified this session.
Private action
2
Violators must compensate damage; controllers and processors liable for losses caused by their processing.Arts. 8(1), 37 · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws