Vietnam Personal Data Protection Law Compliance

Vietnam's personal data protection framework

Vietnam's current personal data protection framework is based on Law No. 91/2025/QH15 on Personal Data Protection, Decree No. 356/2025/ND-CP, which details implementation of the law, and additional regulations and sector-specific requirements where applicable.

• Law No. 91/2025/QH15 on Personal Data Protection
• Decree No. 356/2025/ND-CP, which details implementation of the law
• Additional regulations and sector-specific requirements where applicable

The law recognises consent as an important legal basis for processing, but consent is not the only possible basis for processing personal data. Organisations should identify the applicable legal basis and meet the corresponding statutory requirements before processing data.

Where consent is required or relied upon, organisations should ensure that consent is appropriately obtained and can be demonstrated. Decree 356/2025/ND-CP provides for reproducible forms of consent, including written and electronic methods.

What is personal data under Vietnam's law?

Vietnam's Personal Data Protection Law defines personal data broadly as digital data or information in another form that identifies or helps identify a specific individual.

The framework distinguishes between basic personal data and sensitive personal data, and the detailed classification of each is determined by Government regulations.

Organisations should therefore maintain a data inventory that identifies both the type of personal data processed and whether it falls within a specially protected category.

Basic personal data

Basic personal data covers common personal information and background details used in transactions and social relationships and included within categories determined by the Government.

Examples may include information used to identify or communicate with an individual, depending on the applicable classification.

Sensitive personal data

Sensitive personal data is personal data associated with an individual's privacy rights where infringement could directly affect the legitimate rights and interests of relevant parties.

The detailed classification of sensitive personal data is determined by Government regulations.

Legal bases for processing personal data

Consent is not a blanket requirement for every processing activity under Vietnam's current law.

The law defines consent as permission from a personal-data subject for processing their personal data, except where the law provides otherwise.

Accordingly, organisations should determine:

• What personal data is being processed;
• Why the data is being processed;
• Which legal basis permits the processing;
• Whether consent is required;
• What notice must be provided;
• What safeguards apply; and
• Whether an impact assessment or other documentation is required.

This is an important change from describing Vietnam's framework as simply requiring consent for all processing.

Consent requirements

Where consent is the applicable legal basis, businesses should design their consent mechanisms so that they are clear, demonstrable and appropriately documented.

Under the current framework:

• Consent is a permission granted by the data subject for processing;
• The applicable legal requirements determine when consent is required;
• Organisations should be able to demonstrate the basis for processing;
• Consent should be captured through an appropriate and reproducible mechanism where required; and
• Organisations should maintain evidence supporting the processing activity.

Decree 356/2025/ND-CP recognises methods including written consent, recorded calls, SMS, email, websites, platforms, applications and other methods capable of reproduction or verification.

Consent is not a substitute for privacy governance

A consent banner alone does not establish complete compliance.

Businesses should connect consent management with:

• Privacy notices;
• Data inventories;
• Processing records;
• Data-subject rights workflows;
• Retention policies;
• Security controls;
• Vendor management;
• Cross-border transfer controls; and
• Impact assessment documentation where applicable.

Privacy notices and transparency

Organisations should provide individuals with appropriate information about the processing of their personal data.

A practical privacy notice should explain, where relevant:

• What personal data is collected;
• The purpose of processing;
• How the data is used;
• The applicable legal basis;
• Relevant recipients or categories of recipients;
• Data retention considerations;
• International or cross-border transfers;
• Individual rights;
• How individuals can exercise their rights;
• Contact details for privacy-related requests; and
• Other information required by applicable law.

For websites and applications, transparency should extend to cookies, analytics, advertising technologies, tracking technologies and other online identifiers where they involve personal data.

Data subject rights

Vietnam's Personal Data Protection Law provides rights for personal-data subjects and establishes corresponding responsibilities for organisations processing personal data.

Depending on the applicable circumstances, organisations should be prepared to manage requests relating to:

• Access to personal data;
• Correction or updating of inaccurate data;
• Withdrawal of consent where processing relies on consent;
• Deletion where legally applicable;
• Restriction of processing where applicable;
• Objection or other rights recognised under the law; and
• Other rights provided by the Personal Data Protection Law and implementing regulations.

Organisations should establish an internal workflow for receiving, authenticating, tracking and responding to data-subject requests within the applicable statutory periods.

Children's personal data

Processing personal data relating to children requires additional safeguards under Vietnam's personal data protection framework.

Businesses that provide services to children or knowingly process children's personal data should assess:

• Age-related requirements;
• Consent requirements;
• Parent or legal representative involvement where required;
• Appropriate privacy notices;
• Data minimisation;
• Security safeguards; and
• Retention and deletion requirements.

Child-focused services should incorporate these requirements into product design rather than treating them as an afterthought.

Processing sensitive personal data

Sensitive personal data receives enhanced protection under Vietnam's framework.

Businesses processing sensitive personal data should identify the relevant category and assess whether additional obligations apply to:

• Legal basis;
• Transparency;
• Security;
• Governance;
• Impact assessments;
• Access controls;
• Retention;
• Data transfers; and
• Incident management.

A privacy programme should maintain a clear inventory showing where sensitive personal data is collected, processed, stored or transferred.

Personal data processing impact assessments

Vietnam's current framework includes impact-assessment requirements for specified processing activities.

Organisations should assess whether their processing requires a personal data processing impact assessment dossier and ensure that required documentation is maintained and submitted in accordance with applicable rules.

An effective assessment should consider:

• Categories of personal data;
• Processing purposes;
• Processing methods;
• Risks to data subjects;
• Security safeguards;
• Retention;
• Data-sharing arrangements;
• Processors and third parties;
• Cross-border processing; and
• Measures used to reduce identified risks.

Cross-border data transfers

Cross-border processing is an important compliance area under Vietnam's current law.

Decree 356/2025/ND-CP defines cross-border transfer activities broadly, including circumstances involving the movement or processing of personal data collected or stored in Vietnam through overseas infrastructure, foreign cloud services or overseas recipients.

Businesses using:

• International cloud providers;
• Global CRM systems;
• Overseas analytics platforms;
• International advertising platforms;
• Foreign SaaS applications;
• Global customer-support tools; or
• Offshore data-processing vendors

should assess whether their activities constitute regulated cross-border processing.

Depending on the circumstances, an organisation may need to prepare or maintain a cross-border personal data transfer impact assessment dossier or comply with another applicable statutory mechanism.

Data security requirements

Organisations processing personal data should implement appropriate organisational, technical and human safeguards.

Security measures may include:

• Access controls;
• Authentication;
• Encryption where appropriate;
• Network and application security;
• Logging and monitoring;
• Vulnerability management;
• Backup and recovery;
• Employee training;
• Vendor security controls;
• Incident response procedures; and
• Data minimisation and retention controls.

Security should be proportionate to the nature and risks associated with the data being processed.

Personal data breach notification

Vietnam's current Personal Data Protection Law establishes a 72-hour notification requirement for qualifying personal-data violations after the relevant organisation discovers the violation.

The requirement applies to qualifying violations that may harm matters such as national defence or security, social order and safety, life or health, honour and dignity, or property, subject to the statutory conditions.

Organisations should therefore maintain an incident-response process capable of:

• Detecting a potential breach;
• Assessing the incident;
• Determining whether the statutory threshold is met;
• Escalating the incident internally;
• Preparing required notifications;
• Documenting the response; and
• Taking remediation measures.

A privacy incident-management process should be connected to the organisation's broader cybersecurity incident-response programme.

Controllers and processors

Businesses should clearly define their roles when processing personal data.

Depending on the activity, an organisation may act as:

• A personal-data controller;
• A personal-data processor;
• A party performing both controlling and processing functions; or
• Another regulated participant in the processing chain.

Contracts with processors and vendors should clearly establish:

• Processing purposes;
• Categories of data;
• Security obligations;
• Confidentiality;
• Sub-processing;
• Data retention;
• Deletion or return of data;
• Incident notification;
• Data-subject request support; and
• Cross-border processing responsibilities.

Data retention and deletion

Vietnam's framework requires personal data to be stored for an appropriate period corresponding to the purpose of processing, unless another law provides otherwise.

Organisations should therefore maintain documented retention schedules covering:

• Customer information;
• Employee data;
• Marketing databases;
• Account information;
• Consent records;
• Cookie and tracking data;
• Support records;
• Data-subject requests;
• Security logs; and
• Vendor-held personal data.

Retention should not continue indefinitely simply because data is technically inexpensive to store.

Cookies and online tracking

Businesses operating websites in Vietnam should assess their cookies and tracking technologies as part of their personal-data compliance programme.

This includes:

• Analytics cookies;
• Advertising cookies;
• Retargeting technologies;
• Social-media pixels;
• Conversion tracking;
• Session technologies;
• Device identifiers;
• SDKs; and
• Other technologies that collect information capable of identifying or relating to individuals.

Consent requirements depend on the applicable legal basis and circumstances. Organisations should not assume that every cookie requires consent, but they should also avoid deploying personal-data processing without establishing the appropriate legal basis and safeguards.

ConsentX can help businesses operationalise this process by:

• Scanning websites for cookies and trackers;
• Categorising tracking technologies;
• Blocking selected technologies before the applicable permission is obtained;
• Recording consent choices;
• Managing region-specific consent experiences; and
• Maintaining auditable consent evidence.

Direct marketing and advertising

Marketing activities frequently involve personal data and should therefore be incorporated into an organisation's privacy compliance programme.

Businesses should assess:

• The source of marketing data;
• The legal basis for processing;
• Whether consent is required;
• How marketing preferences are recorded;
• Opt-out and withdrawal mechanisms;
• Third-party advertising platforms;
• Data sharing;
• Profiling;
• Retention; and
• International transfers.

Marketing consent should be clearly separated from unrelated terms where consent is required.

Automated processing, profiling and AI

Businesses using AI, automated decision-making, profiling or behavioural analytics should assess whether these activities involve personal data and whether additional requirements apply.

A privacy assessment should consider:

• What data is supplied to the system;
• The purpose of processing;
• Whether sensitive personal data is involved;
• Whether data is transferred to an overseas provider;
• Whether decisions materially affect individuals;
• Whether individuals receive appropriate information;
• Security and access controls;
• Retention;
• Vendor processing; and
• Human oversight where appropriate.

Organisations should document their AI and automated-processing use cases as part of their broader personal-data governance programme.

Small businesses and startups

Vietnam's Personal Data Protection Law contains transitional compliance provisions for certain small enterprises and startups.

Under the law, eligible small enterprises and startups may choose whether to implement certain provisions for a five-year period from the law's effective date, subject to statutory exceptions. The exemption does not generally apply where the business provides personal-data processing services, directly processes sensitive personal data, or processes personal data relating to large numbers of data subjects.

Decree 356/2025/ND-CP provides additional detail concerning the relevant thresholds and exemptions.

Businesses should therefore determine eligibility rather than assuming that all startups or small businesses are automatically exempt from Vietnam's privacy requirements.

Transition from Decree 13/2023

Vietnam's privacy framework changed significantly on 1 January 2026.

The new Personal Data Protection Law expressly provides transitional treatment for certain processing activities that were already being carried out with consent or agreements under Decree 13/2023/ND-CP before the new law took effect. Certain previously submitted impact-assessment dossiers may also continue under the transitional rules.

At the same time, Decree 356/2025/ND-CP states that Decree 13/2023/ND-CP ceases to have effect from 1 January 2026.

Therefore, businesses should update their compliance programmes rather than continuing to rely exclusively on guidance designed for the former Decree 13 regime.

Vietnam Personal Data Protection Law compliance checklist

Use this checklist to review your organisation's Vietnam privacy programme:

• Identify personal data collected and processed
• Classify basic and sensitive personal data
• Map processing purposes
• Identify the applicable legal basis
• Review consent mechanisms where consent is required
• Maintain evidence of consent
• Update privacy notices
• Establish data-subject request procedures
• Implement appropriate security safeguards
• Review data retention periods
• Identify processors and third parties
• Review international and cross-border transfers
• Assess impact-assessment requirements
• Establish breach-response procedures
• Prepare for applicable 72-hour notifications
• Review marketing and advertising technologies
• Scan cookies and website trackers
• Block selected non-essential technologies before the applicable permission
• Regularly review and update privacy controls

Why Vietnam privacy compliance matters for digital businesses

For organisations operating websites, apps and digital platforms in Vietnam, personal-data compliance increasingly requires coordination between privacy, security, legal, marketing and technology teams.

A modern compliance programme should therefore combine a lawful basis, transparency, consent management, data governance, security, rights management, transfer controls and audit evidence.

ConsentX can support the consent-management and website privacy layer while organisations maintain the broader legal and organisational controls required by Vietnam's framework.

The Personal Data Protection Law applies within Vietnam's legal framework and also contains provisions affecting certain foreign organisations and individuals involved in the processing of covered personal data.