What is a data breach? The 72-hour rule for data breach notification in Vietnam under the 2025 PDPL

What is a data breach? Common types of data leak incidents

Data breaches and the 72-hour rule for data breach notification in Vietnam form an emergency response mechanism that is vital for every organisation running information systems. Under Article 23 of Law 91/2025/QH15, responding quickly in the first 72 hours is critical to helping the business both contain cybersecurity damage and avoid maximum legal penalties.

Most incidents fall into a few recurring patterns:

• Credential theft and phishing: an attacker logs into email, CRM or cloud consoles with stolen passwords.
• Ransomware: data is encrypted and often copied out before the ransom demand, so a loss of availability is usually also a disclosure.
• Misconfigured cloud storage: a storage bucket, database or backup is left open to the internet.
• Misdirected communications: payslips, contracts or medical results sent to the wrong recipient, or files shared with "anyone with the link".
• Insider misuse: staff exporting customer lists before leaving, or looking up records without a business reason.
• Lost or stolen devices: laptops, phones and USB drives without encryption.
• Vendor incidents: a breach at a payroll, hosting or marketing provider that holds your data as your processor.

Which violations trigger data breach notification in Vietnam

Law 91/2025 does not use the GDPR term "personal data breach". Article 23 speaks of violations of personal data protection rules, which is a wider concept. It has two layers.

The 72-hour layer (Clause 1, Article 23). The controller, controller-processor or third party that detects a violation must notify the A05 Department no later than 72 hours after detection where the violation may harm national defence, national security, social order and safety, or infringe the life, health, honour, dignity or property of the data subject. A processor that detects a violation must promptly notify the controller or controller-processor.

The general notification layer (Clause 3, Article 23). Agencies, organisations and individuals notify the A05 Department when:

• they detect a violation of personal data protection rules (Point a);
• personal data is processed for the wrong purpose or not in line with the agreement between the data subject and the controller (Point b);
• data subject rights are not ensured or are applied incorrectly (Point c);
• other cases provided by law apply (Point d).

In addition, the controller or controller-processor must make a written record confirming the violation and cooperate with the A05 Department in handling it (Clause 2, Article 23). All parties involved must stop the violation and remedy its consequences (Clause 4, Article 23).

The 72-hour rule: responding to a breach and data breach notification in Vietnam

72-hour emergency response plan:

The hour marks below are LexData's recommended plan; statutory deadlines are identified at each step.

• Hours 0–12: activate the incident response team (in-house or an outsourced DPO), isolate the compromised servers and stop the leak.
• Hours 12–36: carry out digital forensics and determine the number of individuals and the types of data affected.
• Hours 36–60: draft the official violation notice on Form No. 08 (Article 28 of Decree 356/2025/ND-CP) for submission to the A05 Department (Ministry of Public Security); the statutory deadline is 72 hours from detection.
• Hours 60–72: notify the affected data subjects and run a crisis communications campaign. Notifying data subjects within 72 hours is mandatory where the incident involves location data or biometric data (Article 29 of Decree 356/2025/ND-CP) or sensitive data in finance, banking and credit information activities (Clause 3, Article 8 of Decree 356/2025/ND-CP); for other incidents the law sets no 72-hour deadline for this step, and it is a recommendation.

The clock starts at detection, not when the investigation is complete. In practice, the most time is lost between the first alert and the decision that the incident is a reportable violation. Decide in advance who in the company can make that call, and log the time of detection as soon as the first credible evidence appears.

What a data breach notification in Vietnam must contain

The notice follows Form No. 08 in the appendix to Decree 356/2025/ND-CP. Under Article 28 of the Decree, it must describe:

1. The nature of the violation: time, place, conduct, the organisations and individuals involved, and the types and amount of personal data concerned.
2. The contact details of the unit or officer responsible for personal data protection, such as your DPO.
3. The possible consequences and damage of the violation.
4. The measures taken to resolve the violation and mitigate the harm.

The notice is sent to the A05 Department or through the National Personal Data Protection Portal (Clause 2, Article 28). Fill in what is known at the deadline rather than waiting for a complete forensic report. Keep the working file up to date as facts change, so that the A05 Department receives consistent information if it asks for more.

Notifying the individuals affected

Law 91 focuses on notifying the authority, and Decree 356 adds mandatory notice to individuals in two situations:

• Location data and biometric data: affected data subjects must be notified within 72 hours of detection, and the incident must also be reported to the A05 Department under Article 28 (Points a and b, Clause 1, Article 29). This applies to any such incident, without the harm threshold of Clause 1, Article 23. If this is not possible for technical or urgent reasons, the business must post a public notice on its website or app and send individual notices as soon as conditions allow. Records of the violation must be kept for at least 5 years after the remedy is complete (Article 29 of Decree 356/2025/ND-CP). The notice to individuals must state at least when and how the violation was detected, which data was affected (location, biometric or both), how serious it is and the risks, the measures taken, what the individual should do next, and the contact details of the data protection unit (Clause 2, Article 29).
• Finance, banking and credit information: a leak or loss of sensitive data must be notified to both the A05 Department and the data subjects within 72 hours (Clause 3, Article 8 of Decree 356/2025/ND-CP). See data protection in banking for the sector rules.

In other cases, notifying individuals is good practice rather than a fixed legal deadline. A clear notice tells people what happened, what data was involved, what the business is doing and what they should do, for example change passwords or watch for phishing calls. Insurers handling health data should also read data protection in insurance.

Data breach notification in Vietnam vs GDPR

A group-wide playbook can keep one workflow, but it needs a Vietnam branch: a differently worded threshold, a wider scope of reportable violations, special rules for location, biometric and financial data, the Form No. 08 template in Vietnamese, and the A05 Department as the recipient.

Penalties for failing data breach notification in Vietnam

Decree 330/2026/ND-CP sets the fines for organisations in Article 54:

• VND 10–20 million: a processor that does not promptly notify the controller; a controller that does not make the written record confirming the violation; or a report that deliberately conceals or misstates the scale or types of data (Clause 1).
• VND 20–40 million: failing to notify the A05 Department of a violation, of wrong-purpose processing or of an infringement of data subject rights (Clause 2).
• VND 40–60 million: notifying the A05 Department later than 72 hours after detecting a violation that harms or may harm security, order, or the life, health, honour or property of data subjects (Clause 3).
• VND 60–80 million: failing to take measures to stop the violation or remedy its consequences, or failing to cooperate with the authority (Clause 4).

For damages to data subjects and recourse against processors and employees, see data breach liability in Vietnam.

Sector rules carry their own fines of VND 50–70 million: failing to notify the A05 Department and data subjects within 72 hours of a leak of sensitive data in finance, banking and credit information, or giving an incomplete notice (Points a and b, Clause 1, Article 64); and, for location or biometric data, failing to notify within 72 hours, giving an incomplete notice to individuals, not keeping violation records for 5 years, or not posting a public notice when individual notice is impossible (Points dd to h, Clause 1, Article 70).

Fixing the technical problem does not replace the legal duty to notify. The underlying incident may also be penalised separately, for example under the rules on security measures or on cross-border transfers if data left Vietnam.

Preparing for data breach notification in Vietnam before an incident

1. Write an incident response plan that names the decision-maker, the legal reviewer and the person who files Form No. 08.
2. Prepare a threshold decision tree based on Clause 1, Article 23, so the team can decide quickly whether the 72-hour notice applies.
3. Keep a Form No. 08 template in Vietnamese, pre-filled with company details and DPO contacts.
4. Set processor notice deadlines in every data processing agreement, commonly 24–48 hours, so vendors report early enough.
5. Know where your data is. An up-to-date record of processing activities tells you quickly which data sets and individuals are affected.
6. Keep logs long enough to reconstruct what happened, and protect them from tampering.
7. Run a tabletop exercise at least once a year, including a weekend or holiday scenario.