- Full title: Law on Personal Data Protection, No. 91/2025/QH15
- Passed by: the 15th National Assembly at its 9th session, 26 June 2025
- In force from: 1 January 2026
- Structure: 5 chapters, 39 articles
- Implementing rules: Decree 356/2025/ND-CP (detailed rules) and Decree 330/2026/ND-CP (penalties)
- Official Vietnamese text: Government e-portal · Official Gazette PDF
What changed in 2026: Law 91/2025 raised Vietnam’s personal data rules from a decree (Decree 13/2023/ND-CP) to a statute. It adds fixed fine caps, sector rules (employment, health, finance, advertising, social networks, AI and cloud) and a five-year relief for small businesses and start-ups.
Chapter I: General provisions (Articles 1–8)
Article 1. Scope and who the Law applies to
The Law governs personal data, its protection, and the rights, obligations and responsibilities of the agencies, organisations and individuals involved. It applies to:
- Vietnamese agencies, organisations and individuals;
- foreign agencies, organisations and individuals in Vietnam;
- foreign agencies, organisations and individuals that directly take part in, or are involved in, processing the personal data of Vietnamese citizens and of people of Vietnamese origin living in Vietnam whose nationality is undetermined and who hold an identity certificate.
The third group gives the Law extraterritorial reach: an offshore company that processes Vietnamese citizens’ data is covered even without a presence in Vietnam.
Article 2. Key definitions
- Personal data: digital data or information in another form that identifies, or helps identify, a specific person. It is either basic or sensitive, each defined by a list issued by the Government (see Decree 356/2025/ND-CP). Data that has been de-identified is no longer personal data.
- Processing: any operation on personal data, including collection, analysis, aggregation, encryption, decryption, editing, deletion, destruction, de-identification, provision, publication and transfer.
- Controller: decides the purposes and means of processing.
- Processor: processes personal data on behalf of a controller under a contract.
- Controller-processor: both decides the purposes and means and processes the data itself. The Law treats this as a separate role; there is no direct GDPR equivalent.
- Third party: anyone other than the data subject, controller, controller-processor or processor who takes part in processing as permitted by law.
- Impact assessment: analysis of the risks of processing, so that measures can be taken to reduce them.
See also: what is personal data and controller vs processor.
Article 3. Principles
Processing must be lawful and limited to a specific, clear purpose and scope. Data must be accurate and kept only as long as the purpose requires. Organisations must combine institutional, technical and human measures and actively prevent and deal with violations.
Article 4. Data subject rights and obligations
Data subjects have the right to:
- be informed about the processing of their data;
- give or refuse consent, and withdraw it;
- view and correct their data, or ask for it to be corrected;
- ask for their data to be provided, deleted or its processing restricted, and object to processing;
- complain, denounce, sue and claim damages;
- ask the authorities or the parties involved to take measures to protect their data.
Data subjects must also protect their own data, respect other people’s data and give accurate data. They may not use their rights to obstruct controllers’ legal obligations. Controllers must act on requests within the time limits set by the Government. Decree 356/2025/ND-CP sets these limits. See data subject rights.
Article 5. How the Law fits with other laws
Existing laws with specific data protection rules continue to apply if they do not conflict with the Law’s principles. An impact assessment carried out under this Law replaces the risk assessment and cross-border impact assessment otherwise required by the data legislation (Clause 4).
Article 7. Prohibited acts
These include: processing personal data against the State or against national security, public order or other people’s lawful rights; obstructing data protection; processing data unlawfully; buying or selling personal data unless a law provides otherwise; and appropriating, or intentionally leaking or losing, personal data.
Article 8. Penalties
Violations may lead to administrative penalties or criminal liability, plus compensation for damage. The Law sets the maximum administrative fines:
| Violation | Maximum fine for an organisation |
|---|---|
| Buying or selling personal data | 10 times the proceeds of the violation |
| Cross-border transfer violations | 5% of the organisation’s revenue in the preceding year |
| All other personal data violations | VND 3 billion |
If there are no proceeds or revenue, or the result is lower than VND 3 billion, the VND 3 billion cap applies. An individual who commits the same violation faces at most half the organisation’s fine. Detailed fines are in Decree 330/2026/ND-CP.
Chapter II: Protecting personal data (Articles 9–32)
Article 9. Consent
Consent is valid only if it is voluntary and the data subject knows the type of data and purpose of processing, the controller (or controller-processor), and their own rights and obligations. It must be given clearly and specifically, in a form that can be printed or copied in writing, including electronic or other verifiable formats. Consent must:
- be given for each purpose;
- not be made conditional on agreeing to other purposes beyond what was agreed;
- remain valid until the data subject changes it or the law provides otherwise.
Silence or no response is never consent. See what is consent.
Articles 10–18. Specific processing operations
- Withdrawal and restriction (Art. 10): requested in writing, including electronically, and does not affect processing carried out before the request.
- Collection (Art. 11): consent is needed before collection unless a law provides otherwise.
- Encryption (Art. 12): encrypted personal data is still personal data.
- Deletion and de-identification (Art. 14): data is deleted at the data subject’s request, when the purpose is fulfilled, when the retention period expires, or by order or agreement. De-identified data may not be re-identified unless a law allows it. See de-identification.
- Publication (Art. 16): only for a specific purpose, and only with consent, under a law, under a contract, or in the cases in Point b, Clause 1, Article 19 (emergencies, threats to national security, riots, terrorism, crime and violations of law).
- Transfer to another party (Art. 17): permitted with consent, between departments of the same organisation, on restructuring or merger, from a controller to a processor or third party, at the request of the authorities, or in the Article 19 cases. A transfer in one of these cases is not buying or selling data, even if a fee is charged.
Article 19. Processing without consent
Consent is not required:
- to protect the life, health, honour, dignity or lawful rights of the data subject or others in an urgent situation, or to protect legitimate rights and interests against infringement (the processing party must prove this ground);
- to deal with an emergency, a threat to national security, riots, terrorism, crime and violations of law;
- for the activities and state management work of state agencies;
- to perform the data subject’s agreement with the parties concerned, as provided by law;
- in other cases provided by law.
When relying on these grounds, organisations must set up oversight: written processing rules, protective measures, regular risk and compliance reviews and a way to receive complaints. See processing without consent.
Article 20. Cross-border transfers
A cross-border transfer means any of the following:
- moving personal data stored in Vietnam to a storage system outside Vietnam;
- an organisation in Vietnam sending personal data to an organisation or individual abroad;
- using a platform outside Vietnam to process personal data collected in Vietnam.
The transferor must prepare a cross-border transfer impact assessment dossier and send one original to the A05 Department (Ministry of Public Security) within 60 days of the first transfer. The dossier is prepared once and then kept up to date (Article 22). The authority may carry out routine inspections no more than once a year, or inspect at any time after a violation or data leak, and may order transfers to stop if the data could harm national defence or security.
No dossier is needed for transfers by competent state agencies, for an organisation storing its own employees’ data on a cloud service, for data subjects sending their own data abroad, and in other cases set by the Government. See cross-border data transfer.
Article 21. Data processing impact assessment (DPIA)
Controllers and controller-processors must prepare and keep a DPIA dossier and send one original to the A05 Department within 60 days of first processing. Processors prepare one as agreed with the controller. The assessment is done once for the life of the organisation and then updated. Competent state agencies are exempt. See what is a DPIA.
Article 22. Updating the dossiers
Both dossiers are updated every 6 months if anything has changed, and immediately when the organisation is reorganised, dissolved or goes bankrupt, when the details of its data protection service provider change, or when it starts or changes a business line involving personal data. Updates go through the National Personal Data Protection Portal or directly to the authority.
Article 23. Breach notification
A controller, controller-processor or third party that detects a violation that may harm national defence, security or public order, or the life, health, honour, dignity or property of data subjects, must notify the A05 Department within 72 hours of detection. A processor must notify the controller promptly. The controller must also record the breach in writing and work with the authority to deal with it. See the 72-hour rule.
Articles 24–32. Rules for specific activities
| Article | Activity | Key rules |
|---|---|---|
| 24 | Children and people lacking legal capacity | A legal representative exercises their rights. Publishing or disclosing the private life of a child aged 7 or over requires the consent of both the child and the legal representative. |
| 25 | Recruitment and employment | Ask candidates only for data needed for recruitment; delete it if they are not hired. Delete employee data when the contract ends unless agreed or required otherwise. Employees must be told about monitoring technology. |
| 26 | Health and insurance | Consent is needed. Health-sector organisations may not give personal data to healthcare or health/life insurance providers unless the data subject asks in writing or an Article 19 ground applies. Reinsurance transfers must be stated in the customer contract. |
| 27 | Finance, banking and credit information | No credit scoring or rating without consent. Data subjects must be told if bank, financial or credit account data is leaked or lost. |
| 28 | Advertising services | Consent is required, with a way to opt out. The entire advertising service using personal data may not be subcontracted. Behavioural and targeted advertising may track websites and apps only with consent. |
| 29 | Social networks and online communication services | No requiring photos or videos of identity documents to verify accounts. Users must be able to refuse cookies and choose “do not track”. No reading messages or recording calls without consent. |
| 30 | Big data, AI, blockchain, metaverse, cloud | Processing must be limited to the purpose and built with security. AI processing must be classified by risk level. |
| 31 | Location and biometric data | No location tracking (including RFID) without consent, except at the request of the authorities or where the law provides otherwise. Biometric data needs physical security, restricted access and monitoring. |
| 32 | Recording in public places | Allowed without consent for security purposes and public events, but people must be told they are being recorded, and recordings are kept only as long as necessary. |
See also: employee personal data, children’s personal data, biometric data and CCTV and camera surveillance.
Chapter III: Data protection forces and conditions (Articles 33–35)
Article 33 lists the data protection forces: the specialised authority within the Ministry of Public Security (the A05 Department), the data protection department or staff inside each organisation, data protection service providers, and people mobilised to help. Under Clause 2, every organisation must either designate a qualified data protection department or staff member, or hire a data protection service provider. This is Vietnam’s DPO requirement. The Government sets the qualifications (see Decree 356/2025/ND-CP and what is a DPO).
Articles 34–35 cover technical standards and inspections.
Chapter IV: Responsibilities (Articles 36–37)
- Article 36: the Ministry of Public Security is the lead state authority for personal data protection, except for matters under the Ministry of National Defence. Other ministries and provincial People’s Committees manage their own sectors and areas.
- Article 37: controllers must set out responsibilities in contracts, apply management and technical measures, notify breaches, choose suitable processors, uphold data subject rights, compensate data subjects for damage and cooperate with the Ministry of Public Security. Processors may receive data only under a contract with the controller, must process it only as agreed, and are liable to the controller for damage. A controller-processor has both sets of duties. See data processing agreement.
Chapter V: Implementation (Articles 38–39)
Article 38. Entry into force and relief for small businesses
- The Law is in force from 1 January 2026.
- Small enterprises and start-ups may choose not to apply Article 21 (DPIA), Article 22 (dossier updates) and Clause 2 of Article 33 (designating data protection staff) for 5 years from that date.
- Household businesses and micro-enterprises do not have to apply those provisions at all.
- Neither relief applies to businesses that provide personal data processing services, directly process sensitive personal data, or process the data of a large number of data subjects. Decree 356 sets that threshold at 100,000 or more.
- The relief does not cover the cross-border transfer dossier or any other obligation.
Article 39. Transitional provisions
- Processing that started with consent or an agreement under Decree 13/2023/ND-CP may continue without asking for consent again.
- Processing impact assessment and overseas transfer impact assessment dossiers under Decree 13 that the authority received before 1 January 2026 remain in use, and no new dossier is needed under the Law. Later updates follow the new Law.
