Transfer of personal data in Vietnam: the six lawful cases and the transfer agreement under Law 91/2025
A transfer of personal data in Vietnam means passing personal data from one organisation or individual to another, or between departments of the same organisation, so that the recipient can continue processing it. Article 17 of the Personal Data Protection Law No. 91/2025/QH15 allows a transfer of personal data only in six cases, and Article 7 of Decree 356/2025/ND-CP requires a written transfer agreement for most of them.
Personal Data Protection Law No. 91/2025/QH15 & Decree 356/2025/ND-CP
Official legal texts
Key takeaways for businesses
- A transfer is a form of personal data processing (Clause 6, Article 2 of Law 91/2025/QH15) and is allowed only in the six cases in Clause 1, Article 17, such as with the data subject's consent, sharing between departments, corporate reorganisation or disclosure to a processor.
- Transfers under Points a, c and d of Clause 1, Article 17 need a transfer agreement covering the seven items in Clause 1, Article 7 of Decree 356/2025/ND-CP. Sharing between departments of the same organisation needs no agreement but does need internal controls (Clause 4, Article 7).
- A transfer agreement that omits the responsibility clauses, or the lack of internal sharing controls, is fined VND 20 to 30 million; transferring sensitive personal data without encryption and other safeguards is fined VND 50 to 80 million (Article 52 of Decree 330/2026/ND-CP).
What is a transfer of personal data in Vietnam?
The Personal Data Protection Law No. 91/2025/QH15 (PDPL) lists transfer as one form of personal data processing (Clause 6, Article 2), but does not define the term. Reading Article 17 of the PDPL together with Article 7 of Decree 356/2025/ND-CP, a transfer of personal data in Vietnam means passing personal data from the organisation or individual that holds it to another organisation or individual, or between departments of the same organisation, so that the recipient can continue processing it.
The PDPL uses a closed list: a transfer is lawful only if it fits one of the six cases in Clause 1, Article 17. A deal outside that list, especially one where data is exchanged for money or another benefit, may be treated as selling personal data, which is prohibited (see selling personal data).
For readers used to the GDPR: the GDPR treats a disclosure as one more processing operation that needs a lawful basis. Vietnam instead sets out a specific list of permitted transfer cases, with its own contract requirements, so an intra-group data-sharing agreement drafted for the EU usually needs to be adapted.
How does a transfer differ from supply, disclosure and cross-border transfer?
Businesses often call all of these "data sharing", but the PDPL treats them in separate articles with different duties:
Transfer of personal data compared with similar activities under Law 91/2025
| Activity | Legal basis | Recipient | Main duty |
|---|---|---|---|
| Transfer | Article 17 of Law 91/2025; Article 7 of Decree 356 | Another organisation or individual, or another department | Fit one of the six cases; transfer agreement for Points a, c, d |
| Supply at the data subject's request | Clause 2, Article 15 of Law 91/2025 | The data subject | Not a transfer (Clause 6, Article 7 of Decree 356); complete within 10 days |
| Public disclosure | Article 16 of Law 91/2025 | The public | Only in four cases, within the stated purpose and scope |
| Cross-border transfer | Article 20 of Law 91/2025 | A recipient or system outside Vietnam | Prepare a cross-border transfer impact assessment dossier |
One deal can trigger several articles at once. Sending customer data to a parent company in Singapore is both a transfer (a basis under Article 17 and an agreement) and a cross-border data transfer (a dossier under Article 20).
Six lawful cases for a transfer of personal data in Vietnam
Clause 1, Article 17 of Law 91/2025/QH15 allows a transfer of personal data in the following cases. The last column shows where a transfer agreement is mandatory under Clause 1, Article 7 of Decree 356/2025/ND-CP:
Lawful transfer cases and the transfer agreement requirement
| Point | Case | Transfer agreement required? |
|---|---|---|
| a | With the data subject's consent | Yes |
| b | Sharing between departments of the same organisation, consistent with the established purpose | No, but internal controls are required |
| c | Division, separation, merger, consolidation, reorganisation, conversion or dissolution of an organisation | Yes |
| d | To a processor or third party for processing in accordance with the law | Yes |
| dd | At the request of a competent state authority | Not specified |
| e | The cases that need no consent under Clause 1, Article 19 of Law 91/2025 | Not specified |
Clause 2, Article 17 states that a transfer in these six cases, with or without a fee, is not buying or selling personal data. A paid transfer under Point a or d must also meet the six conditions in Clause 3, Article 7 of Decree 356, explained in selling personal data. For Point e, see processing without consent.
What must a transfer agreement contain?
Clause 1, Article 7 of Decree 356/2025/ND-CP requires the agreement with the recipient to cover seven items. The table adds drafting tips from LexData's contract reviews:
Seven mandatory items of a personal data transfer agreement (Clause 1, Article 7 of Decree 356)
| Point | Mandatory item | Drafting tip |
|---|---|---|
| a | Purpose of the transfer | Name the specific purpose; avoid "and other purposes" |
| b | Categories of data subjects and types of data, consistent with the purpose | List the data fields; flag sensitive data separately |
| c | Processing period; deletion or destruction once the purpose is achieved | State the period and how deletion is evidenced (certificate, logs) |
| d | Legal basis for the transfer | Cite the exact point of Clause 1, Article 17 and the consent record if any |
| dd | Responsibility for protecting the data during transfer and processing | Encryption, access control, the sender's audit rights |
| e | Responsibility for honouring data subject rights | Deadlines for the recipient to act on erasure or withdrawal requests |
| g | Cooperation when a violation is detected | A breach notice period short enough to meet the 72-hour rule |
Where the recipient is a processor, these items usually sit in the data processing agreement. For sensitive personal data, the sender must also apply physical security to storage and transmission devices, and encryption and anonymisation during the transfer (Clause 2, Article 7 of Decree 356).
Is sharing between departments a transfer of personal data in Vietnam?
Yes. Point b, Clause 1, Article 17 treats sharing between departments of the same organisation as a transfer, provided it is consistent with the established processing purpose. No agreement is needed, but Clause 4, Article 7 of Decree 356 requires the organisation to:
- Set up a procedure to control how personal data is shared and used between departments;
- Take measures to prevent staff from sharing personal data with third parties without authorisation.
This duty is often missed. In LexData's reviews, a common error is the marketing team pulling customer data from the customer service team for a new campaign, when the original purpose was only after-sales support. Internal sharing is lawful only if the new use stays within the purpose notified to the data subject. Note also that parent companies, subsidiaries and sister companies are separate legal entities, so sharing between them is not internal sharing.
Transfers in mergers, acquisitions and restructuring
Point c, Clause 1, Article 17 allows a transfer so that processing can continue after a division, separation, merger, consolidation, reorganisation or dissolution. A transfer agreement covering the seven items is still required. The recipient may only continue processing within the purposes the data subjects agreed to with the transferor; a new purpose needs a new basis.
In a share deal, the legal entity that holds the data does not change, so there is no transfer. If only a customer list or a business line is sold, the deal may fall outside Point c and needs careful review. A reorganised business must also update its impact assessment dossiers immediately (Point a, Clause 2, Article 22 of the PDPL).
Fines for an unlawful transfer of personal data in Vietnam
Article 52 of Decree 330/2026/ND-CP sets these fines for organisations (individuals pay half):
- VND 20 to 30 million: a transfer agreement that does not set out responsibility for data protection, for data subject rights and for cooperation on violations; or no internal sharing controls and no measures against unauthorised sharing by staff (Clause 1).
- VND 30 to 50 million: a paid transfer under Point a or d of Clause 1, Article 17 without clear roles, without limiting the data types, without a retention period or without deleting the data once the purpose is achieved (Clause 2); the items and means used may also be confiscated.
- VND 50 to 80 million: transferring sensitive personal data without physical security, encryption or anonymisation (Clause 3).
Remedial measures include completing the transfer agreement and deleting sensitive data already transferred if it cannot be secured. A transfer outside all the cases in Article 17 for gain is dealt with under Article 53 on buying and selling personal data, with much higher fines. For other penalties, see PDPL penalties.
Checklist for a transfer of personal data in Vietnam
- List every data flow leaving each department and leaving the company.
- Map each flow to a point of Clause 1, Article 17 of Law 91/2025. Stop any flow that does not fit.
- For Points a, c and d, sign a transfer agreement or DPA covering the seven items in Clause 1, Article 7 of Decree 356.
- For internal sharing, adopt a control procedure and purpose-based access rights.
- Encrypt and anonymise sensitive personal data in transit.
- If the recipient is abroad, also prepare the cross-border transfer impact assessment dossier.
- List the categories of recipients and the transfer purposes in the privacy notice.
Insight from lawyer Ho Thi Ha Nhi
"In a review, I ask one simple question: where does this data go, and which point of Article 17 does it rely on? Most of the risk is not with the large vendors that already have contracts, but with informal sharing between group companies or between departments. A short transfer agreement that covers all seven items is far better than nothing."
Frequently asked questions
Is sharing customer data between a parent company and its subsidiary a transfer of personal data?
Yes. A parent and a subsidiary are separate legal entities, so sharing between them is not sharing between departments of the same organisation (Point b, Clause 1, Article 17 of Law 91/2025/QH15). The group needs another basis, usually the data subject's consent (Point a) or a controller-processor relationship (Point d), plus a transfer agreement under Clause 1, Article 7 of Decree 356/2025/ND-CP. If the recipient is abroad, the sender must also prepare a cross-border transfer impact assessment dossier.
Is sending customers a copy of their own data a transfer of personal data?
No. Clause 6, Article 7 of Decree 356/2025/ND-CP provides that supplying personal data under Clause 2, Article 15 of Law 91/2025/QH15, based on a specific request from the data subject, is not a transfer. The request is handled within the deadlines in Clause 3, Article 5 of Decree 356: respond within 2 working days and complete it within 10 days.
Do we need consent to hand customer data to the police or tax authority?
No, if there is a valid request from a competent state authority, because this is the case in Point dd, Clause 1, Article 17 of Law 91/2025/QH15. Ask for an official written request that states the legal basis and the data required, provide only what is requested and keep a record of the disclosure.
Do we have to notify data subjects of each transfer?
Law 91/2025/QH15 does not set a separate duty to notify each transfer, except for paid transfers under Clause 3, Article 7 of Decree 356/2025/ND-CP, which need consent to each transfer. However, consent is only valid if the data subject knows the types of data, the purpose and the controller (Clause 2, Article 9 of Law 91/2025). LexData therefore recommends that the privacy notice lists the categories of recipients and the purposes of transfer from the moment data is collected.
The Vietnamese original of this entry has been reviewed for legal accuracy against the Personal Data Protection Law No. 91/2025/QH15 and current implementing legislation. This English edition is an unofficial translation for reference; the official legal texts are in Vietnamese.
Meet the LexData teamGo further with LexData
PDPL Compliance Consulting for Businesses
Work with our lawyers on the filings and documents, end to end.
Learn about the service