The Vietnam data law is Law No. 60/2024/QH15 on Data, in force since 1 July 2025. It sits beside the Personal Data Protection Law (PDPL) but is wider: it covers all digital data, including data that identifies no one, and it applies to foreign-invested companies in Vietnam and to foreign parties connected with data activities in Vietnam (Article 2). Every company has one baseline duty under it: classify its data as core, important or other (Article 13(2)). Only companies that actually hold core or important data face the heavier regime of annual risk assessments, processing logs, a named data protection lead and filings with the Ministry of Public Security (MPS) before that data leaves Vietnam.
Many companies assume the core and important data categories are about state secrets and government databases. Most of the official list is. But the list in Decision 20/2025/QD-TTg also contains volume thresholds that private companies can reach: in our reading, non-public basic data of 100,000 Vietnamese citizens, or bank account and payment data of 10,000 Vietnamese businesses, is already important data. These duties have applied since 1 July 2025. What changes is enforcement: the penalty decree, Decree 363/2026/ND-CP, takes effect on 11 November 2026 and is not yet in force on 17 October 2026. This guide reflects the law as of that date.
Does the Vietnam data law apply to a foreign-invested company?#
Yes. The law on data in Vietnam applies to Vietnamese organisations (which includes your Vietnamese subsidiary), to foreign organisations in Vietnam, and to foreign organisations that take part in or are connected with digital data activities in Vietnam (Article 2). A parent company that receives data from its Vietnamese subsidiary may therefore be within reach. The MPS is the lead regulator (Article 8(2)(b)), as it is for personal data.
The Law took effect on 1 July 2025 with no transition period for businesses. Three implementing decrees and the data list took effect the same day; 2026 added a data exchange decree and a penalty decree:
| Document | What it does for businesses | In force |
|---|---|---|
| Law 60/2024/QH15 on Data | Classification, cross-border transfer, provision of data to the State, data services | 1 July 2025 |
| Decree 165/2025/ND-CP | Criteria for core and important data, transfer filings, protection duties, forms | 1 July 2025 |
| Decision 20/2025/QD-TTg | List of 26 core data items and 18 important data items | 1 July 2025 |
| Decree 169/2025/ND-CP | Licensing of data intermediary, analytics and exchange services | 1 July 2025 |
| Decree 314/2026/ND-CP | Data exchanges and the National Data Exchange | 25 September 2026 |
| Decree 363/2026/ND-CP | Administrative penalties in the data sector | 11 November 2026 |
How does the Vietnam data law differ from the PDPL?#
The PDPL (Law 91/2025/QH15) protects individuals' rights over information about them. The Law on Data treats data as a resource to be developed into an asset (Article 6(1)) and controls data whose misuse could affect security, the macro-economy or public health.
| Point | Law on Data 60/2024 | PDPL 91/2025 |
|---|---|---|
| What it covers | All digital data | Personal data |
| Data subject | Any agency, organisation or individual the data reflects | A natural person |
| Roles | Data owner, data administrator | Controller, processor, controller-processor |
| Categories | Core, important, other | Basic, sensitive |
| Cross-border control | Only core and important data | All personal data |
| Penalty decree | Decree 363/2026/ND-CP | Decree 330/2026/ND-CP |
Data owner and data administrator. The data owner decides how data is built, protected, processed, used and exchanged (Article 3(14)); its rights are property rights under civil law (Article 3(15)). The data administrator builds, manages, operates and exploits data at the owner's request (Article 3(13)). Most detailed duties in Decree 165/2025/ND-CP fall on the administrator. In-house, one company usually plays both roles. When a vendor runs the system, the vendor may be the administrator, so outsourcing contracts should say who carries the administrator's duties. The pairing resembles controller and processor but is not identical.
When data falls under both laws, three rules decide:
- A law issued before the Law on Data took effect, with specific rules consistent with its principles, prevails (Article 4(1) of the Law on Data). The PDPL was passed on 26 June 2025, before 1 July 2025.
- A company that has done the PDPL impact assessment and cross-border transfer assessment does not also do the risk or transfer assessment under data legislation (Article 5(4) of the PDPL).
- Core or important data that is personal data is protected under the PDPL. For cross-border transfer, the data administrator files the PDPL dossiers and does not do the Decree 165 assessment (Article 16(2) of Decree 165, as amended by Article 42(3) of Decree 356/2025/ND-CP).
In our reading, none of these rules removes the duty to classify under Article 13. They decide which protection rules and which dossier apply once data has been classified.
What is core and important data under the Vietnam data law?#
Important data is data that may affect national defence, security, foreign affairs, the macro-economy, social stability, or public health and safety, and is on the Prime Minister's list (Article 3(6)). Core data is important data that directly affects those interests and is on the same list (Article 3(7)). Decree 165/2025/ND-CP frames the test as data that could cause (important) or directly causes (core) dangerous effects if collected or used unlawfully, excluding state secrets (Articles 3 and 4).
Decision 20/2025/QD-TTg lists 26 core data items and 18 important data items; item II.1 makes all core data important data as well. Most items are non-public data "collected or managed by state bodies": borders, defence, the state budget, customs, land, health statistics, education. A private company meets these only when the State shares such data with it, for example as a contractor building a government information system.
The volume thresholds that private companies can reach#
Items I.26 and II.18 ("non-public data on organisations and citizens") are not limited to state bodies, and Decision 20 does not say who the holder must be. In our reading, a private company holding the volumes below holds important or core data:
| Non-public data | Important data (II.18) | Core data (I.26) |
|---|---|---|
| Basic data of Vietnamese citizens | 100,000 or more citizens | 1,000,000 or more citizens |
| Sensitive data of Vietnamese citizens | 10,000 or more citizens | 100,000 or more citizens |
| Bank account, payment history and debt data of Vietnamese enterprises and organisations | 10,000 or more | 100,000 or more |
Three points when applying these thresholds:
- Decision 20 does not define "basic" or "sensitive" citizen data. The closest reference is the lists of basic personal data and sensitive personal data in Articles 3 and 4 of Decree 356/2025/ND-CP, but no official guidance confirms the link.
- Only Vietnamese citizens and Vietnamese enterprises count. Data on expatriates or foreign companies does not.
- For cross-border transfers, volumes are counted cumulatively from 1 July 2025 (Article 12(10) of Decree 165), so small batches add up.
The first two rows are personal data, so their protection and transfer follow the PDPL. The third row is not personal data, so the full regime of the Law on Data applies. That row can catch banks, payment intermediaries, credit information companies, lending platforms and accounting or invoicing software that pulls in business customers' bank statements.
Illustrative scenario. A Singapore-headquartered SaaS provider's Vietnamese subsidiary sells accounting software to 12,000 Vietnamese SMEs and syncs their bank statements for reconciliation; the servers sit in Singapore. In our reading, that dataset is payment history of more than 10,000 Vietnamese businesses, so it is important data under item II.18. Most of it is not personal data, so the Decree 356 carve-out does not help. Processing on a platform outside Vietnam is a cross-border transfer (Article 23(2)(c)), so the subsidiary must file an impact assessment with the MPS 15 days before processing and take on the duties below. At 100,000 customers the dataset becomes core data, which needs an MPS pass before transfer.
What must a company do with core and important data?#
The Vietnam data law requires administrators of core and important data to assess risk periodically and notify the MPS and the Ministry of National Defence (Article 25(4)), and to follow the data protection rules (Article 27(3)). Decree 165/2025/ND-CP fills in the detail:
| Duty | Decree 165 |
|---|---|
| A data protection management system; procedures for collection, storage, backup and recovery; least-privilege access control | Article 17(1) to (4) |
| Processing logs kept for at least six months | Article 17(10) |
| Annual risk assessment, with a report on Form 06 kept ready for inspection (not needed where a cross-border dossier exists) | Article 17(11) |
| A named person responsible for data protection and a data security unit; no one with a criminal record in IT or telecoms in that role; staff confidentiality undertakings; annual training | Article 18 |
| Report incidents involving core or important data to the MPS or the Ministry of National Defence as soon as possible; emergency drills every six months | Article 19(4) and (8) |
| Outsourcing: written contract, check the vendor's capability, encrypt and sign on handover; keep records for important data for three years | Article 16(3); Article 17(9) |
| Documented irreversible deletion; a data handling report to the authorities on reorganisation or dissolution | Article 17(7) and (8) |
Where the important data is personal data, in our reading these duties give way to the PDPL toolkit (impact assessments, a data protection function, 72-hour breach notification), because amended Article 16(2) of Decree 165 sends the protection of such data to the PDPL.
Cross-border transfers under the Vietnam data law#
The law on data in Vietnam does not ban transfers abroad and does not contain a general data localisation rule. Bringing data into Vietnam and processing foreign data in Vietnam are free (Article 23(1)). Control applies only to core and important data, in three forms (Article 23(2)): moving data stored in Vietnam to storage abroad; a Vietnamese party sending data to a foreign party; and a Vietnamese party using a platform outside Vietnam to process data. In our reading, the third form covers offshore cloud and SaaS, even if a copy stays in Vietnam.
The procedure under Article 12 of Decree 165/2025/ND-CP:
| Step | Important data | Core data |
|---|---|---|
| Impact assessment (once for the life of the business, updated on changes to purpose, scope, data types, the recipient's processing or control; Clauses 1 and 8) | Required | Required |
| Contract with the recipient containing the terms in Clause 3 | Required | Required |
| Filing with the MPS (or the Ministry of National Defence) | One original sent 15 days before processing; no approval needed | File for review; result within 10 days of a complete file, 15 if complex; transfer only after a pass |
The file is a report on Form 02 with supporting documents, sent with a Form 01b notice to the National Data Centre, MPS (Clause 4 and the forms appendix to Decree 165). Three exceptions need no prior approval or notice: emergencies to protect life, health or property; cross-border HR management under labour rules and collective agreements; and transfers truly needed to conclude or perform a contract, such as transport, payment, hotels or visas (Clause 11). The impact assessment must still be sent to the MPS afterwards; Clause 12 says "after 15 days from the date of carrying out", which we read as a deadline.
For core or important data that is personal data, these steps are replaced by the PDPL cross-border transfer impact assessment filed with the A05 Department of the MPS.
Must important data stay in Vietnam? The Law does not say so. Decree 363 fines an organisation that stores core or important data on systems outside Vietnam, or run by foreign parties, "in breach of the law" (Article 10(2)(c)). In our reading, offshore storage is lawful once the Article 12 steps are done. Data localization in Vietnam under the Cybersecurity Law is a separate regime that turns on the type of service, not on data classification.
When must a company hand data to the authorities?#
Under the Vietnam data law, a company must provide data on request of a competent authority, without the data subject's consent, in four situations: a state of emergency; a threat to national security short of a declared emergency; disasters; and riots or terrorism (Article 18(2)). Decree 165 lets the company check the request: it must be in writing or otherwise confirmed, state the data, volume, legal basis, purpose and period of use (Article 8(2)(a)), and come from a minister, a provincial chair, the Director of the National Data Centre or a provincial police director (Article 8(6)). Handover is recorded in minutes (Article 8(3)(c)). In the same four situations the authorities may decrypt data without the owner's consent (Article 22(4) of the Law).
For foreign-invested groups one rule matters in particular: requests from foreign law enforcement or judicial authorities for data of Vietnamese organisations and individuals are decided by the competent Vietnamese authority (Article 7(3)). A Vietnamese subsidiary asked by head office to hand over data for a foreign investigation should take advice before it does.
Data intermediaries, analytics and data exchanges#
Some data businesses are now conditional business lines. An intermediary service must register under investment law unless it is purely internal (Article 40(2)). Intermediaries between users and state bodies need an MPS certificate: the legal representative must be a Vietnamese citizen resident in Vietnam, the infrastructure must be in Vietnam and a deposit of at least VND 5 billion is required (Articles 23(3) and 25 of Decree 169/2025/ND-CP). Cloud and data centre services are outside this regime (Article 23(4)). Analytics products need a certificate when they run at AI levels 3 or 4 in state systems, connect to national databases, or use core or important data (Article 28(1) of Decree 169).
Only public service units and state-owned enterprises may run a data exchange (Article 42(2) of the Law). Decree 314/2026/ND-CP, in force since 25 September 2026, governs the National Data Exchange, which the National Data Centre of the MPS builds, manages and operates (Article 5). A foreign legal entity that wants to buy or sell on an exchange needs a commercial presence, branch or representative office in Vietnam (Article 16(2)). Personal data may not be traded, and data derived from it only once de-identified (Article 4(6)); core and important data may not be traded at all (Article 33(6)(a) of Decree 169).
Vietnam data law fines from 11 November 2026#
Decree 363/2026/ND-CP, the penalty decree for the Vietnam data law, applies from 11 November 2026 (Article 34); on 17 October 2026 it cannot yet be used to impose fines. The maximum fine for an individual is VND 100 million; organisations pay double, except where an article states the organisational rate directly (Article 6). The limitation period is one year (Article 3(1)).
| Breach | Fine for an organisation | Decree 363 |
|---|---|---|
| Not classifying data, or not updating the classification | VND 30-50 million | Article 9(1)(a) and (b) |
| Storing core or important data offshore in breach of the rules | VND 30-70 million | Article 10(2)(c) |
| Late impact assessment filing; transfer contract missing mandatory terms | VND 40-80 million | Article 19(1) |
| Transferring core data without an assessment or written approval | VND 120-160 million | Article 19(3) |
| No periodic risk assessment of core or important data | VND 40-80 million | Article 22(2)(a) |
| Not reporting an incident involving core or important data to the MPS | VND 120-200 million | Article 22(4)(a) |
| Running an intermediary service without a certificate | VND 120-160 million | Article 24(3)(a) |
Cross-border transfers can also be suspended for 3 to 12 months and unlawfully transferred data ordered deleted (Article 19(5) and (6)). Decree 363 does not cover conduct within the scope of the cybersecurity and personal data protection penalty decree (Article 1(2)), currently Decree 330/2026/ND-CP. Conduct that starts before 11 November 2026 and continues after it is fined under Decree 363 (Article 35(1)).
The framework is still moving. The task list of the National Data Strategy for 2026-2030 attached to Decision 1308/QD-TTg of 18 July 2026 asks the MPS to lead amendments to Decision 20/2025/QD-TTg and a review of the Law on Data, both in 2026-2027. Press reports also say a draft Law on Data Security was added to the 2026 legislative programme and is expected at the National Assembly session that opened on 17 October 2026; we have not checked the official resolution.
What to do now#
For most foreign-invested companies, complying with the Vietnam data law is mainly a paper exercise showing that no dataset reaches the thresholds. These duties have applied since 1 July 2025; 11 November 2026 is when continuing breaches become finable, not the compliance deadline. Step 1 applies to everyone; steps 2 to 6 apply once a dataset reaches a threshold:
- Write a dated classification record: each dataset, the Decision 20 item checked, the count of Vietnamese citizens and Vietnamese businesses, the conclusion and the approver.
- For important data that is not personal data, map which systems process it offshore and file the Form 02 assessment with the MPS; for core data, wait for the MPS result.
- Name a data protection lead and a data security unit, switch on processing logs kept for six months, and schedule the annual risk assessment and six-monthly drills.
- Add the Article 12(3) and Article 17(9) terms to cloud, SaaS and outsourcing contracts.
- For important data that is personal data, make sure the PDPL impact assessment and transfer dossier are complete, since they stand in for the Decree 165 filings.
- Set a procedure for data requests from Vietnamese authorities and from foreign authorities via head office.
LexData helps foreign-invested companies apply the Vietnam data law, classify data and prepare transfer filings through its PDPL compliance consulting and DPIA and cross-border transfer dossiers services.
