Selling personal data in Vietnam: when is it prohibited and when is it a lawful transfer?

Is selling personal data prohibited in Vietnam?

Yes. Clause 6, Article 7 of the Personal Data Protection Law No. 91/2025/QH15 lists "buying and selling personal data, unless otherwise provided by law" as a prohibited act. Under the former Decree 13/2023/ND-CP, not selling personal data was one of the data protection principles. The PDPL now makes it a prohibited act with its own penalty cap of up to 10 times the proceeds (Clause 3, Article 8).

The PDPL does not define "buying and selling". Instead, it says what is not a sale: a transfer in one of the six cases in Clause 1, Article 17 is not buying or selling personal data, whether or not a fee is charged (Clause 2, Article 17). In practice, the test works in reverse. If you exchange personal data for money or another benefit, and the exchange does not fit one of those six cases, it may be treated as selling personal data in Vietnam.

For readers used to the GDPR: the GDPR has no general ban on selling personal data. It asks whether each disclosure has a lawful basis. Vietnam adds a separate prohibition with revenue-based fines, so a data-sharing model that works in the EU needs to be re-checked before it is used in Vietnam.

According to LexData's summary of Decree 330/2026/ND-CP, Article 53 of that decree penalises the following: buying, selling or exchanging data for unlawful gain; paid transfers without an agreement or for a different purpose; and trading personal data on a data exchange without de-identification.

Six transfers that are not selling personal data in Vietnam

Clause 1, Article 17 of Law 91/2025/QH15 permits a transfer of personal data in these cases:

For Point e, see processing without consent. Also note that providing data to the data subject at their own request is not a transfer (Clause 6, Article 7 of Decree 356/2025/ND-CP). For how a transfer differs from supply, internal sharing and cross-border transfer, see transfer of personal data.

Conditions for a paid transfer of personal data

Many guides on this topic miss this part. When a transfer under Point a or Point d of Clause 1, Article 17 is paid, to provide a service to the data subject or serve their lawful interests, Clause 3, Article 7 of Decree 356/2025/ND-CP requires:

1. A technical system and transparent mechanism so the data subject can consent precisely and clearly to each transfer, knowing the purpose and the recipient.
2. Processing only for the transfer purpose the data subject agreed to, and within the recipient's registered business lines.
3. The types of data transferred must be limited to what the purpose needs.
4. No personal data may be collected, stored or built into a personal data repository from the transfers for any purpose other than those the data subject agreed to.
5. Clear roles of controller, processor and third party in the transfer (see controller vs processor).
6. A transfer and processing agreement signed before the transfer, with commitments to the data subjects.

What must a transfer agreement contain?

For transfers under Points a, c and d of Clause 1, Article 17, Clause 1, Article 7 of Decree 356/2025/ND-CP requires the agreement with the recipient to state: the purpose; the data subjects and types of data; the processing period and deletion requirements once the purpose is achieved; the legal basis; responsibility for protecting the data; responsibility for honouring data subject rights; and cooperation duties when a violation is found. Transfers of sensitive personal data also need physical security, encryption and anonymisation measures during the transfer (Clause 2, Article 7).

Situations that can amount to selling personal data in Vietnam

From LexData's compliance reviews, these are the arrangements businesses often see as "normal data sharing" but which carry a high risk of being treated as selling personal data in Vietnam:

• Buying lead lists from brokers for telesales or advertising. The seller can almost never prove consent to each transfer.
• Swapping customer lists with a partner ("your data for mine"). No money changes hands, but it is still an exchange for a benefit, and it usually fits none of the Article 17 cases.
• Employees taking customer data with them when they leave and selling it. The business must have controls on internal sharing and measures to stop staff sharing data unlawfully with third parties (Clause 4, Article 7 of Decree 356/2025/ND-CP).
• A processor reusing client data for its own business, for example a call centre reselling phone numbers to its other clients.
• Selling "anonymised" data that is not properly de-identified, where names are removed but birth dates, addresses and transaction histories remain. See de-identification.

Penalties for selling personal data in Vietnam

Clause 3, Article 8 of Law 91/2025/QH15 caps the fine for buying or selling personal data at 10 times the revenue earned from the violation. If there is no revenue, or the revenue-based figure is below VND 3 billion, the cap is VND 3 billion (Clause 5, Article 8). These caps apply to organisations; individuals face up to half (Clause 6, Article 8).

According to LexData's summary of Decree 330/2026/ND-CP, Article 53 imposes fines of 2 to 10 times the revenue. Where there is no revenue, the fine depends on the number of data subjects affected, from VND 70 million (fewer than 1,000 data subjects with basic data) up to VND 1 billion, and VND 1–3 billion where national defence, security, or the life, health or property of data subjects is harmed. Remedial measures include surrendering the unlawful revenue and deleting or destroying the data. Beyond administrative fines, a violation may lead to criminal liability and compensation for damage (Clause 1, Article 8 of the PDPL). See the overview of PDPL penalties.

Checklist before sharing or receiving personal data for a fee

Use these steps to check that a paid data deal is a lawful transfer and not selling personal data in Vietnam:

1. Identify which point of Clause 1, Article 17 of the PDPL the transaction falls under. If none fits, stop.
2. Decide the recipient's role: a processor acting on your instructions, or a new controller using the data for its own purposes.
3. If relying on consent, keep evidence of consent to this specific transfer, recipient and purpose.
4. Sign a transfer agreement or data processing agreement covering the seven items in Clause 1, Article 7 of Decree 356/2025/ND-CP.
5. Limit the data fields to what the purpose requires.
6. Encrypt and secure the channel if sensitive personal data is involved.
7. Record the data flow in your data map and, if you are required to prepare one, your impact assessment dossier.