Most foreign-invested companies in Vietnam launch their local website with the group's privacy policy, written for the GDPR and lightly edited. That document is a reasonable skeleton, but published as it is, a GDPR policy misstates the legal bases, misses most of Vietnam's sensitive-data categories, promises response times Vietnamese law does not use and treats cross-border transfers as a contract question rather than a filing. A website privacy policy Vietnam's regulators will accept has to be rewritten against Law 91/2025/QH15 on Personal Data Protection and Decree 356/2025/ND-CP, plus the e-commerce and consumer rules if the site sells.
Whether you must publish one at all depends on what the site does. This article is for legal, IT and marketing teams of a Vietnamese subsidiary. It deals with the public policy page. What to tell people at the moment you collect their data, on the form or sign-up screen, is covered in our handbook entry on the privacy notice in Vietnam. The law is stated as of 27 October 2026.
Website privacy policy Vietnam: is publishing one mandatory?#
Law 91 has no general rule that every website must post a privacy policy. The obligation to publish one comes from three places (the consumer law calls it "consumer information protection rules"):
| Who | Source | What it requires |
|---|---|---|
| Websites and apps that sell goods or services, marketplaces, social commerce | Article 11 of Law No. 122/2025/QH15 on E-commerce; Articles 5 and 17(1)(a) of Decree 248/2026/ND-CP | A privacy policy with eight minimum items, in Vietnamese, placed on the main screen or linked from the main screen with a clearly distinguishable link |
| Social networks and online communication services | Article 29(6) of Law 91 | Publish a privacy policy explaining collection, use and sharing; tools to access, correct and delete data |
| Any business collecting consumer information, online or in store | Article 16 of Law No. 19/2023/QH15 on Protection of Consumer Rights | Consumer information rules (purpose, scope of use, retention, security), posted at the premises and on the website or app |
| B2B sites (no consumer data) with a contact form | Articles 9(2) and 11(1) of Law 91; Article 5(1) of Decree 356 | No statute names a "privacy policy", but users must be told the required information before consenting and how to exercise their rights |
The Law on E-commerce took effect on 1 July 2026 (Article 40), and Decree 248/2026/ND-CP replaced Decree 52/2013/ND-CP and Decree 85/2021/ND-CP from the same date (Article 52(3)). Group templates and local agencies still cite Decree 52; outside the transition case in Article 53 (platforms already notified or registered, until 30 June 2027), those references are now out of date. The consumer protection law predates Law 91 and still applies alongside it, because Article 5(2) of Law 91 keeps earlier laws' specific data rules in force where they are consistent with its principles.
A brochure site of a consumer-facing business is caught by Article 16(2) of Law 19/2023, which requires the rules to be posted on the website, even if the company only sells in store. "Consumer" also covers organisations buying for their own non-commercial use (Article 3(1)), so a company that sees itself as B2B may still be within Article 16. For a pure B2B subsidiary, the practical answer is the same as for a retailer: publish one policy page, because it is the simplest way to show users were told what Article 9(2) requires. It does not replace consent collected at the point of collection.
Where a GDPR policy goes wrong under Vietnamese law#
Legal bases: there is no "legitimate interests"#
The GDPR lets a controller rely on six legal bases, and group policies lean heavily on legitimate interests for analytics, fraud prevention and direct marketing. Law 91 starts from consent: personal data may be collected only with consent obtained before collection, unless the law provides otherwise (Article 11(1)). Consent must be given for each purpose, cannot be bundled with purposes outside the agreement, and silence is not consent (Article 9(4)).
The exceptions are the closed list in Article 19(1). The nearest thing to legitimate interests, Article 19(1)(a), covers protecting one's own or another's rights or legitimate interests "as necessary against an infringement" of those interests. That is a defensive ground, not a balancing test, and it cannot carry marketing or product analytics. Contract performance has a counterpart in Article 19(1)(d) (performing an agreement with the data subject), and, in our reading, processing required by a specific law (accounting, tax) fits under Article 19(1)(dd) (other cases provided by law).
Rewrite the purpose table so each purpose names either consent or a specific Article 19 ground. Every line that says "legitimate interests" needs a decision: move it to consent, find a statutory ground, or stop the processing.
Sensitive data is a much longer list#
Article 4(1) of Decree 356 lists sensitive personal data. Beyond the GDPR's special categories, it includes location determined by location services, ID card images, login credentials for electronic identification and bank accounts, bank card details and transaction history, financial and insurance information held by financial institutions, and data that tracks a person's behaviour on telecom, social media and other online services. That last item catches most analytics and advertising data.
When consent is sought for sensitive personal data, the person must be told the data is sensitive (Article 6(4) of Decree 356). Failing to tell data subjects their sensitive data is being processed carries a fine of VND 30 to 50 million (Article 43(1)(h) of Decree 330/2026/ND-CP). A GDPR policy that says "we do not process special category data" while running ad pixels is wrong in Vietnam. The tracking side is covered in our guide to cookie consent in Vietnam.
Withdrawal of consent and response deadlines#
Data subjects may withdraw consent by a written request, including electronic form (Article 10(2) of Law 91), and withdrawal does not affect earlier processing (Article 10(4)). Using methods to hide, block or obstruct withdrawal is fined VND 20 to 30 million (Article 45(1)(a) of Decree 330). An unsubscribe link alone is not enough if consent also covers other purposes; the policy should give a channel for every purpose relying on consent. See withdrawal of consent.
The GDPR's "one month, extendable by two" does not apply. Article 5 of Decree 356 requires a reply within 2 working days of a valid request, then completion within fixed periods:
| Request | Reply | Complete | If processors or third parties must act | One extension, at most |
|---|---|---|---|---|
| Withdraw consent, restrict or object | 2 working days | 15 days | 20 days | 15 days |
| Access, correct or provide data | 2 working days | 10 days | 15 days | 10 days |
| Delete data | 2 working days | 20 days | 30 days | 20 days |
| Apply protection measures to the person's data | 2 working days | 15 days | Not set separately | 15 days |
Not having a clear procedure and forms for data subject rights, or not telling people how to use them, is fined VND 10 to 20 million (Article 44(1)(a) and (c) of Decree 330). If the group runs a single global request portal, the Vietnamese clock still has to be met.
Cross-border transfers need a dossier, not a clause#
GDPR policies explain transfers through adequacy decisions and standard contractual clauses. Vietnam has neither mechanism. Hosting Vietnamese users' data with the group CRM, a US email platform or a global analytics tool is a cross-border transfer (Article 20(1) of Law 91). The transferor must prepare a cross-border transfer impact assessment dossier and send it to the A05 Department, Ministry of Public Security within 60 days of the first transfer (Article 20(2)), unless an exemption in Article 20(6) of Law 91 or Article 17(3) of Decree 356 applies.
The policy should name the destination countries and the type of recipient, but disclosure is not compliance. Article 17(3)(b) of Decree 356 exempts transfers that "have been made public in accordance with the law"; in our reading, describing the transfer in a privacy policy does not bring a company within that exemption. How the filing works is explained in our guides to foreign CRM and SaaS transfers and the transfer impact assessment.
Name the Vietnamese entity as controller#
Consent is valid only if the person knows which controller is processing (Article 9(2)(b) of Law 91). A group policy that says "Group Company and its affiliates" does not meet that test. Name the Vietnamese subsidiary, its enterprise code and address, and say which group companies receive which data and why. E-commerce sites must also publish the operator's name, address, enterprise registration and legal representative (Article 4 of Decree 248).
Language#
A website or app that sells online must publish its privacy policy in Vietnamese (Article 11(2) of the Law on E-commerce). For other sites no text says so expressly. In our reading, an English-only policy makes it hard to show that a Vietnamese user knew the purposes and rights before consenting, so we recommend a Vietnamese version for any site aimed at Vietnamese users, with a clause that the Vietnamese text prevails for them.
Children#
GDPR policies usually set a digital-consent age of 13 to 16. In Vietnam a child is a person under 16 (Article 1, Law on Children 2016), and that is the scope of Article 24 of Law 91: the child's legal representative exercises the child's data rights, and publishing or disclosing the private life of a child aged 7 or older needs the consent of both the child and the representative (Article 24(2)). Decree 330 Article 60(1) fines VND 30 to 50 million for processing a child's data without age verification, without the representative's consent (under 7), or without the joint consent of the child and the representative (7 and over); publishing or disclosing a child's private life without joint consent is fined VND 50 to 100 million (Article 60(2)(a)). A group policy with a 13-year threshold therefore leaves 13 to 15 year olds uncovered. If the service is not for children, say so and ask for age at sign-up; if it is, write a separate section on parental consent. See children's personal data.
Extra website privacy policy Vietnam rules if the site sells online#
From 1 July 2026 every e-commerce platform, including a company's own online shop, must publish a privacy policy covering at least eight items (Article 5(1) of Decree 248):
- Purpose and scope of collection.
- Scope of use.
- Retention period, or the method for determining it.
- Who may access personal information.
- Security measures.
- How users view and correct their data on the platform.
- How requests to delete, destroy or restrict processing are received.
- How complaints about information security are received and resolved.
The content must comply with personal data protection law (Article 5(2)), so these eight items sit on top of everything above. Three further points catch foreign groups:
- Placement. The policy, or a clearly marked link to it, must be on the platform's main screen (Article 17(1)(a) of Decree 248).
- Acceptance before sign-up. Users must be able to accept the published terms, including the privacy policy, before opening an account (Article 11(4) of the Law on E-commerce). This acceptance of terms is not the per-purpose consent Law 91 requires; keep marketing and tracking consents as separate choices.
- Notification. A company's own shop with an online ordering function must be notified to the authorities before it operates (Article 14(1) of the Law; Article 23(1) of Decree 248), and changes to the published content, which include the privacy policy, must be notified within 20 working days (Article 23(3)(d)). Platforms notified or registered before 1 July 2026 may operate under their existing filing until 30 June 2027 and must amend it in that period (Article 41(1) of the Law; Article 53 of the Decree).
Consumer-facing businesses also need consumer consent before hiring a third party to collect, store or use consumer information, with a written agreement setting each party's duties (Article 15(2) of Law 19/2023), and must notify consumers and obtain consent again before changing the purpose or scope of use (Article 18(1)). A policy clause saying "we may update this policy at any time" does not satisfy that.
What can stay from the group policy#
Not everything needs rewriting. The structure of a good GDPR policy, its plain-language style, the description of security measures, the cookie categories (provided non-essential cookies are opt-in), and a retention schedule set by purpose (Article 3(3) of Law 91 also ties retention to purpose) can all carry over. The comparison in GDPR vs Vietnam PDPL shows where the two regimes line up.
On enforcement: not giving people transparent information about data types, purposes, rights and the controller, so that consent is not informed, is fined VND 30 to 50 million (Article 43(1)(dd) of Decree 330). Social network and online communication providers that do not publish a transparent privacy policy face VND 50 to 70 million and a possible 1 to 3 month suspension (Article 65(1)(d) and (3)). These are amounts for organisations; individuals pay half (Article 7(1)).
LexData's PDPL compliance consulting reviews a subsidiary's website privacy policy against its actual forms, tags and transfer flows and prepares the Vietnamese version.
