Data protection principles in Vietnam: the six principles in Article 3 of the PDPL
The data protection principles in Vietnam are the six principles in Article 3 of the Personal Data Protection Law No. 91/2025/QH15 (PDPL). All collection and processing of personal data must follow them: comply with the law; process only within a specific, clear scope and purpose; keep data accurate and store it only as long as the purpose requires; apply institutional, technical and human measures together; proactively prevent and handle violations; and balance national interests with the lawful rights and interests of organisations and individuals.
Personal Data Protection Law No. 91/2025/QH15 & Decree 356/2025/ND-CP
Official legal texts
Key takeaways for businesses
- Article 3 of Law 91/2025/QH15 sets six data protection principles. They are the benchmark for any processing activity, including activities not yet covered by detailed rules.
- Compared with the eight principles of Decree 13/2023/ND-CP (repealed from 1 January 2026), the ban on selling personal data is now a prohibited act (Clause 6, Article 7 of the PDPL). 'Demonstrating compliance' is no longer a separate principle, but specific duties to prove compliance remain.
- Household businesses, micro and small enterprises are exempted from, or may opt out of, certain duties (Articles 21 and 22 and Clause 2, Article 33) under Article 38 of the PDPL, but they must still follow the principles in Article 3.
What are the data protection principles in Vietnam?
The data protection principles are the core rules that every agency, organisation and individual must follow when collecting and processing personal data. They are set out in Article 3 of the Personal Data Protection Law No. 91/2025/QH15, which took effect on 1 January 2026.
The rest of the PDPL and Decree 356/2025/ND-CP set specific duties, such as obtaining consent, preparing impact assessment dossiers and reporting violations. The principles answer a broader question: is this processing reasonable and consistent with the purpose of the law? Where there is no detailed guidance yet, for example on using customer data to train AI or on how long to keep data, check the activity against these six principles first.
The six data protection principles in Vietnam's Article 3
The six data protection principles in Article 3 of Law 91/2025 and the duties that implement them
| Clause | Principle | What the business should do | Implementing provisions |
|---|---|---|---|
| 1 | Comply with the Constitution, the PDPL and related laws | Identify every applicable law, including sector laws (labour, credit, health, advertising) | Article 5, Articles 24–32 of Law 91/2025 |
| 2 | Collect and process data only within the correct scope and for specific, clear purposes | Record a purpose for each processing activity; do not collect "just in case"; a new purpose needs a new legal basis | Article 9 (consent per purpose), Article 17 of Law 91/2025; Article 7 of Decree 356/2025 |
| 3 | Keep data accurate, corrected and updated; store it only as long as the purpose requires | Let customers correct their details; set retention periods and deletion schedules | Articles 13 and 14 of Law 91/2025; Article 5 of Decree 356/2025 |
| 4 | Apply institutional, technical and human measures together | Adopt internal rules; access control, encryption, logging; appoint data protection staff | Article 33, Point c of Clause 1, Article 37 of Law 91/2025; Articles 13–16 of Decree 356/2025 |
| 5 | Proactively prevent, detect, stop and handle violations | Have an incident response process and notify the specialised authority within 72 hours where required | Article 23 of Law 91/2025; Articles 28–29 of Decree 356/2025 |
| 6 | Link data protection to national interests; balance it with the lawful rights and interests of organisations and individuals | Assess impact before transferring data abroad; balance business needs with privacy | Articles 19 and 20 of Law 91/2025 |
Scope and purpose: the principle most often breached
In LexData's compliance reviews, the most common problems involve Clause 2, Article 3. Three typical examples:
- Sign-up forms that collect ID card numbers, dates of birth and occupations when the service only needs a name and phone number.
- Customer data collected for delivery being reused for advertising without separate consent.
- Facial recognition timekeeping data being used to monitor employees' break times.
Each new purpose needs its own legal basis, usually consent (see what is consent) or one of the cases in Article 19.
Storage limitation
Clause 3, Article 3 does not set a fixed period. Data may be kept only "for a period appropriate to the processing purpose", unless the law provides otherwise. When that period ends, the data must be deleted or destroyed under Points b and c, Clause 1, Article 14. See the right to erasure.
Data protection principles in Vietnam compared: PDPL, Decree 13/2023 and GDPR
Businesses that already comply with Decree 13/2023/ND-CP or the GDPR often ask what has changed. LexData's comparison:
Data protection principles under Law 91/2025, Decree 13/2023 and the GDPR
| Topic | Law 91/2025 (Article 3) | Decree 13/2023 (Article 3, repealed) | GDPR (Article 5) |
|---|---|---|---|
| Lawfulness | Clause 1 | Yes | Yes (lawfulness, fairness) |
| Transparency / data subject is informed | Not a separate principle; it is the right to be informed in Point a, Clause 1, Article 4 | Yes | Yes (transparency) |
| Purpose limitation | Clause 2 | Yes | Yes |
| Data minimisation | Included in "correct scope" in Clause 2 | Yes (collection limited to what processing needs) | Yes |
| Accuracy | Clause 3 | Yes | Yes |
| Storage limitation | Clause 3 | Yes | Yes |
| Security | Clause 4 (institutional, technical and human measures) | Yes | Yes (integrity and confidentiality) |
| Demonstrating compliance | Not a separate principle; proof duties sit in specific rules, e.g. Clause 2, Article 6 of Decree 356/2025 | Yes | Yes (accountability) |
| Ban on selling personal data | Now a prohibited act in Clause 6, Article 7 | Yes | No |
| Proactively preventing and handling violations | Clause 5 | No | Not a separate principle |
| Link to national interests, defence and security | Clause 6 | No | No |
Two points matter for foreign-invested businesses. First, the PDPL adds principles rooted in state management (Clauses 5 and 6) that tie data protection to national security. This helps explain why Vietnam's rules on transferring data abroad are stricter than the GDPR's. Second, although "demonstrating compliance" is no longer a stand-alone principle, the controller still bears the burden of proving consent in a dispute (Clause 2, Article 6 of Decree 356/2025/ND-CP). Compliance records matter as much as before.
Applying the data protection principles in Vietnam in daily operations
This is how LexData usually helps clients turn the six principles into concrete work:
- Map your data: list each processing activity with its data types, purpose, legal basis, storage location, retention period and recipients. See the record of processing activities.
- Review each activity against Clauses 2 and 3: remove unnecessary fields and set retention periods.
- Adopt internal rules that give effect to Clause 4.
- Appoint data protection staff or engage a service provider under Article 33. See what is a DPO.
- Rehearse incident response to meet the 72-hour notification deadline (Clause 5). See the 72-hour breach rule.
- Assess impact before new processing or cross-border transfers (Clause 6). See what is a DPIA.
Insight from lawyer Ho Thi Ha Nhi
"In an inspection, the first question is usually: why are you collecting this data, and why do you need each field? A business that can answer that for every processing activity already meets most of the data protection principles in Article 3 of Law 91/2025."
Frequently asked questions
Does Vietnam's PDPL have a data minimisation principle like the GDPR?
Article 3 of Law 91/2025/QH15 does not use the term 'data minimisation'. However, Clause 2 of Article 3 allows collection and processing only 'within the correct scope and for specific, clear purposes'. Clause 1, Article 30 requires personal data in big data, AI and cloud environments to be processed 'within the necessary scope'. Clause 3, Article 7 of Decree 356/2025/ND-CP limits transferred data to the scope of the transfer purpose. In practice, applying minimisation is a good way to meet Clause 2, Article 3.
Do household businesses have to follow the data protection principles?
Yes. Clause 3, Article 38 of Law 91/2025/QH15 only exempts household businesses and micro-enterprises from Article 21 (impact assessments), Article 22 (dossier updates) and Clause 2, Article 33 (data protection staff), with some exceptions. The principles in Article 3, the consent rules, data subject rights and the prohibited acts still apply in full.
Is there a maximum period for keeping personal data?
There is no single period. Clause 3, Article 3 of Law 91/2025/QH15 requires data to be 'stored for a period appropriate to the processing purpose', unless the law provides otherwise. Businesses set a period for each type of data, based on the purpose and on sector laws such as accounting, tax and labour law, and state it in their privacy notice. When the period ends, the data must be deleted or destroyed (Points b and c, Clause 1, Article 14).
What is the penalty for breaching the data protection principles?
The principles are put into effect through specific duties in Law 91/2025/QH15 and Decree 356/2025/ND-CP. Penalties are imposed under Decree 330/2026/ND-CP for each specific breach, such as processing without valid consent, failing to honour data subject rights or failing to report a violation. The general cap is VND 3 billion for an organisation (Clause 5, Article 8 of the PDPL).
The Vietnamese original of this entry has been reviewed for legal accuracy against the Personal Data Protection Law No. 91/2025/QH15 and current implementing legislation. This English edition is an unofficial translation for reference; the official legal texts are in Vietnamese.
Meet the LexData teamGo further with LexData
PDPL Compliance Consulting for Businesses
Work with our lawyers on the filings and documents, end to end.
Learn about the service