Data protection measures in Vietnam: what businesses must apply under Law 91/2025 and Decree 356

What are data protection measures in Vietnam?

Under Clause 4, Article 2 of the Personal Data Protection Law No. 91/2025/QH15, personal data protection means the use of forces, means and measures to prevent and combat infringement of personal data. Clause 4, Article 3 then requires institutional, technical and human measures to be applied in a coordinated and effective way. This principle is one of six discussed in data protection principles.

LexData groups the measures in three layers:

• Managerial (institutional) measures: a data processing policy, assigned responsibilities, contracts with processors, periodic compliance assessment and an incident response procedure.
• Technical measures: access control, authentication, encryption, anonymisation, logging and monitoring, backup and secure deletion.
• People measures: appointing personnel or a unit for data protection (Clause 2, Article 33 of Law 91/2025), confidentiality undertakings and regular awareness training.

Which data protection measures in Vietnam are mandatory under Law 91/2025?

In short: the law requires you to have measures, but it gives no single list that applies to every business. Neither Law 91/2025 nor Decree 356/2025/ND-CP has an article listing all mandatory measures. The obligation comes from three tiers:

1. The general standard. Point c, Clause 1, Article 37 requires a controller to apply appropriate managerial and technical measures, and to review and update them when necessary. Point c, Clause 2, Article 37 imposes the same on a processor. Point g, Clause 1, Article 37 makes the controller answerable to the data subject for damage caused by processing.
2. Measures tied to a specific activity. The Law sets its own requirements for secure deletion (Clause 3, Article 14), publication of data (Clause 5, Article 16), biometric data (Clause 4, Article 31) and big data, AI, blockchain and cloud (Clause 3, Article 30).
3. Specific measures in Decree 356/2025/ND-CP. This is where "appropriate" becomes measurable, as in the table below.

"Appropriate" is a flexible standard: businesses of different size and risk apply different levels, and must be able to justify their choices. In other words, data protection measures in Vietnam are judged by the risk of the data and the processing, not by the number of tools. This is also why this entry does not give a fixed list for every business. The approach is close to Article 32 of the GDPR ("appropriate technical and organisational measures"), but Decree 356 goes further than the GDPR by naming specific measures such as MFA and cloud encryption in defined contexts.

Data protection measures in Vietnam by processing context

Two cautions when reading the table. First, the big data requirements rest on a specific definition: Clause 1, Article 9 of Decree 356 describes large-scale, continuous processing that integrates many sources and can analyse behaviour, predict trends or classify users. An ordinary customer database is not automatically "big data". Second, these are the measures stated expressly. If your activity falls outside these contexts, the standard remains "appropriate" measures under Article 37.

What is a sensible minimum set of data protection measures?

The list below is LexData's view of a baseline for showing that measures are "appropriate". It is not a statutory checklist, but each item rests on the provisions cited:

1. Role-based access and need-to-know. No shared accounts; review access periodically and revoke it when staff leave or change roles (Clause 2, Article 4 of Decree 356 for sensitive data).
2. Strong authentication for administrator accounts and accounts that access customer or HR data. MFA is the minimum for big data (Point b, Clause 3, Article 9 of Decree 356) and an easily evidenced benchmark elsewhere.
3. Encryption in transit and at rest, first for sensitive data and cloud data. Mandatory in the cases in the table; remember encrypted data is still personal data (Clause 1, Article 12 of Law 91/2025).
4. Access logs and anomaly alerts, kept long enough to investigate incidents (Point d, Clause 3, Article 9 of Decree 356 for big data; Clause 1, Article 8 for finance and banking).
5. Backup and recovery, with a secure-deletion process that also covers backups.
6. Secure deletion. Deleting unsafely, or failing to prevent unauthorised restoration of deleted data, is fined VND 10–30 million (Points b and c, Clause 1, Article 51 of Decree 330/2026/ND-CP). See right to erasure and de-identification.
7. Contracts with processors and vendors stating security measures, cooperation deadlines and deletion or return of data at the end; see the data processing agreement.
8. Internal policy and a named owner. Organisations must appoint a qualified unit or personnel, or hire a data protection service provider (Clause 2, Article 33 of Law 91/2025); its tasks include implementing technical security measures and an emergency response plan (Point e, Clause 1, Article 14 of Decree 356). See what is a DPO.
9. Regular staff training. Expressly required for big data processing (Point d, Clause 2, Article 9 of Decree 356).
10. An incident response plan and the 72-hour notification; see the data breach 72-hour rule.

Household businesses and micro-enterprises are not required to comply with Articles 21 and 22 and Clause 2, Article 33 (impact assessment, updating dossiers, appointing personnel) under Clause 3, Article 38 of Law 91/2025, unless they provide personal data processing services, directly process sensitive data or process the data of a large number of data subjects (Decree 356 sets this at 100,000 data subjects or more, Clause 2, Article 41). This does not remove the duty to apply protection measures under Article 37.

What are the fines for missing data protection measures?

Decree 330/2026/ND-CP has no single fining article for all protection measures; fines attach to specific acts and contexts. The amounts below apply to organisations (individuals pay half):

Besides fines, the authority may order remedies, such as applying appropriate protection measures and supplying evidence (Point dd, Clause 4, Article 47), or applying multi-factor authentication, access control and encryption (Point b, Clause 5, Article 66). For the wider picture see PDPL penalties.

How can a business prove the data protection measures it applied?

Decree 330/2026/ND-CP repeatedly requires a violation to be remedied with evidence "supplied to the competent authority" (Point dd, Clause 4, Article 47; Point d, Clause 4, Article 51; Clause 5, Article 66). In practice, a measure is only as good as the record behind it. The minimum file LexData recommends:

• A personal data processing and protection policy, with an issue date and approver.
• An access-rights matrix and minutes of periodic access reviews.
• An inventory of systems holding personal data and the measures applied to each (which can be tied to a record of processing activities).
• Contracts and annexes with processors and cloud providers.
• A risk assessment or DPIA where one is required.
• Training records, and the plan and minutes of incident response exercises.

A short route to applying data protection measures: (1) map your data to see which data is sensitive, where it sits and who can access it; (2) choose measures by risk and by the context in the table above; (3) keep records and review at least once a year, which is also the cycle Decree 356 sets for finance and banking, AI, blockchain and cloud.