Is Vietnam's Decree 13/2023 still the main privacy law?

No. Vietnam's current framework is based on Law No. 91/2025/QH15 on Personal Data Protection, effective from 1 January 2026, together with implementing regulations including Decree 356/2025/ND-CP. Decree 356 states that Decree 13/2023 ceases to have effect from 1 January 2026.

Does Vietnam require consent for all personal-data processing?

No. Consent is an important legal basis, but the current law recognises circumstances in which personal data may be processed under other legal provisions. Organisations should identify the appropriate legal basis for each processing activity.

Does silence count as consent?

Organisations should not treat silence or inaction as a reliable substitute for legally valid consent. Where consent is required, the consent mechanism should meet the applicable statutory requirements and be demonstrable.

What is the current Vietnam privacy law?

The primary legislation is Law No. 91/2025/QH15 on Personal Data Protection, which came into force on 1 January 2026.

What is Decree 356/2025/ND-CP?

Decree 356/2025/ND-CP is the Government decree detailing certain provisions and implementation measures under Vietnam's Personal Data Protection Law. It also took effect on 1 January 2026.

Does Vietnam regulate cross-border personal-data transfers?

Yes. The current framework regulates cross-border transfers and related processing activities. Organisations using foreign cloud services, SaaS platforms, international vendors or overseas data-processing infrastructure should assess whether the relevant activities trigger statutory requirements.

Does Vietnam require a personal data impact assessment?

Impact-assessment requirements apply to specified processing activities. Organisations should determine whether their processing falls within the applicable categories and maintain the required documentation.

What is the breach notification deadline in Vietnam?

For qualifying personal-data violations covered by the statutory breach-notification requirement, the law provides a 72-hour notification period after discovery, subject to the conditions set out in the law.

Can ConsentX help with Vietnam privacy compliance?

ConsentX can help operationalise website privacy controls through cookie and tracker discovery, consent management, prior-script blocking, consent records, regional rules and data-subject request workflows. It should be used as part of a broader legal, organisational and technical compliance programme.

Vietnam

PDP Law

Personal Data Protection Law (Law No. 91/2025/QH15)

In short

Vietnam's Personal Data Protection Law (Law No. 91/2025/QH15) is the country's current comprehensive personal data protection framework. The law was adopted on 26 June 2025 and came into force on 1 January 2026, replacing the previous framework centred on Decree 13/2023/ND-CP. Decree 356/2025/ND-CP, also effective from 1 January 2026, provides detailed implementation rules.

The law regulates how organisations collect, process, use, store, transfer and protect personal data. It applies to Vietnamese organisations and individuals, foreign organisations and individuals in Vietnam, and certain foreign parties involved in processing personal data of Vietnamese citizens and qualifying persons of Vietnamese origin.

For businesses operating websites, applications, digital services, e-commerce platforms or marketing technologies in Vietnam, compliance requires more than simply displaying a privacy notice. Organisations need appropriate lawful grounds for processing, transparent information practices, appropriate security controls, evidence of consent where consent is relied upon, data-subject rights processes, and controls for cross-border processing.

Vietnam's current personal data protection framework is based on:

Law No. 91/2025/QH15 on Personal Data Protection
Decree No. 356/2025/ND-CP, which details implementation of the law
Additional regulations and sector-specific requirements where applicable

The law recognises consent as an important legal basis for processing, but consent is not the only possible basis for processing personal data. Organisations should identify the applicable legal basis and meet the corresponding statutory requirements before processing data.

Where consent is required or relied upon, organisations should ensure that consent is appropriately obtained and can be demonstrated. Decree 356/2025/ND-CP provides for reproducible forms of consent, including written and electronic methods.

Vietnam Personal Data Protection Law at a glance

Requirement	Vietnam
Primary law	Law No. 91/2025/QH15
Implementation decree	Decree No. 356/2025/ND-CP
Effective date	1 January 2026
Previous framework	Decree 13/2023/ND-CP
Regulated data	Basic and sensitive personal data
Consent	One lawful basis; not universal
International transfers	Regulated
Impact assessments	Required in specified circumstances
Breach notification	72 hours for qualifying violations
Maximum specified administrative fine	Up to 5% of previous-year revenue for specified cross-border violations; up to VND 3 billion for other specified violations
Primary implementation authority	Ministry of Public Security

Region

Vietnam

Status

In force since 1 January 2026

Group

Asia & Africa

Who must comply with Vietnam's Personal Data Protection Law?

The law applies to:

Vietnamese agencies, organisations and individuals;
Foreign agencies, organisations and individuals in Vietnam; and
Foreign agencies, organisations and individuals directly participating in or otherwise involved in processing personal data of Vietnamese citizens and certain Vietnamese-origin individuals residing in Vietnam.

This means organisations outside Vietnam may still need to assess their obligations where their activities involve personal data falling within the law's scope.

Businesses should therefore assess their processing activities rather than relying solely on their physical location.

Penalties for non-compliance

Vietnam's Personal Data Protection Law establishes significant administrative penalty ceilings for specified violations.

For certain cross-border personal-data violations, the maximum administrative fine can reach 5% of the previous year's revenue. For other specified administrative violations, the maximum fine is VND 3 billion. The statutory framework provides that the maximum fine for an individual committing the same violation is generally one-half of the organisational maximum.

Businesses should assess potential exposure based on the specific violation, applicable implementing regulations and the facts of the processing activity.

Key principles of personal data protection

Vietnam's law establishes several core principles for processing personal data.

Organisations should ensure that personal data is:

Processed within a specific and lawful purpose;
Collected and processed only within an appropriate scope;
Accurate and capable of being corrected or updated when necessary;
Retained for an appropriate period based on the processing purpose, unless another law provides otherwise;
Protected through appropriate institutional, technical and human measures; and
Protected against unlawful access, use, disclosure, alteration, loss and other forms of infringement.

These principles mean privacy compliance should be integrated into an organisation's broader data governance and security programme.

What is personal data under Vietnam's law?

Vietnam's Personal Data Protection Law defines personal data broadly as digital data or information in another form that identifies or helps identify a specific individual.

The framework distinguishes between:

Basic personal data

Basic personal data covers common personal information and background details used in transactions and social relationships and included within categories determined by the Government.

Examples may include information used to identify or communicate with an individual, depending on the applicable classification.

Sensitive personal data

Sensitive personal data is personal data associated with an individual's privacy rights where infringement could directly affect the legitimate rights and interests of relevant parties.

The detailed classification of sensitive personal data is determined by Government regulations.

Organisations should therefore maintain a data inventory that identifies both the type of personal data processed and whether it falls within a specially protected category.

Legal bases for processing personal data

Consent is not a blanket requirement for every processing activity under Vietnam's current law.

The law defines consent as permission from a personal-data subject for processing their personal data, except where the law provides otherwise.

Accordingly, organisations should determine:

What personal data is being processed;
Why the data is being processed;
Which legal basis permits the processing;
Whether consent is required;
What notice must be provided;
What safeguards apply; and
Whether an impact assessment or other documentation is required.

This is an important change from describing Vietnam's framework as simply requiring consent for all processing.

Consent requirements

Where consent is the applicable legal basis, businesses should design their consent mechanisms so that they are clear, demonstrable and appropriately documented.

Under the current framework:

Consent is a permission granted by the data subject for processing;
The applicable legal requirements determine when consent is required;
Organisations should be able to demonstrate the basis for processing;
Consent should be captured through an appropriate and reproducible mechanism where required; and
Organisations should maintain evidence supporting the processing activity.

Decree 356/2025/ND-CP recognises methods including written consent, recorded calls, SMS, email, websites, platforms, applications and other methods capable of reproduction or verification.

Consent should not be treated as a substitute for privacy governance

A consent banner alone does not establish complete compliance.

Businesses should connect consent management with:

Privacy notices;
Data inventories;
Processing records;
Data-subject rights workflows;
Retention policies;
Security controls;
Vendor management;
Cross-border transfer controls; and
Impact assessment documentation where applicable.

Privacy notices and transparency

Organisations should provide individuals with appropriate information about the processing of their personal data.

A practical privacy notice should explain, where relevant:

What personal data is collected;
The purpose of processing;
How the data is used;
The applicable legal basis;
Relevant recipients or categories of recipients;
Data retention considerations;
International or cross-border transfers;
Individual rights;
How individuals can exercise their rights;
Contact details for privacy-related requests; and
Other information required by applicable law.

For websites and applications, transparency should extend to cookies, analytics, advertising technologies, tracking technologies and other online identifiers where they involve personal data.

Data subject rights

Vietnam's Personal Data Protection Law provides rights for personal-data subjects and establishes corresponding responsibilities for organisations processing personal data.

Depending on the applicable circumstances, organisations should be prepared to manage requests relating to:

Access to personal data;
Correction or updating of inaccurate data;
Withdrawal of consent where processing relies on consent;
Deletion where legally applicable;
Restriction of processing where applicable;
Objection or other rights recognised under the law; and
Other rights provided by the Personal Data Protection Law and implementing regulations.

Organisations should establish an internal workflow for receiving, authenticating, tracking and responding to data-subject requests within the applicable statutory periods.

Children's personal data

Processing personal data relating to children requires additional safeguards under Vietnam's personal data protection framework.

Businesses that provide services to children or knowingly process children's personal data should assess:

Age-related requirements;
Consent requirements;
Parent or legal representative involvement where required;
Appropriate privacy notices;
Data minimisation;
Security safeguards; and
Retention and deletion requirements.

Child-focused services should incorporate these requirements into product design rather than treating them as an afterthought.

Sensitive personal data

Sensitive personal data receives enhanced protection under Vietnam's framework.

Businesses processing sensitive personal data should identify the relevant category and assess whether additional obligations apply to:

Legal basis;
Transparency;
Security;
Governance;
Impact assessments;
Access controls;
Retention;
Data transfers; and
Incident management.

A privacy programme should maintain a clear inventory showing where sensitive personal data is collected, processed, stored or transferred.

Personal data processing impact assessments

Vietnam's current framework includes impact-assessment requirements for specified processing activities.

Organisations should assess whether their processing requires a personal data processing impact assessment dossier and ensure that required documentation is maintained and submitted in accordance with applicable rules.

An effective assessment should consider:

Categories of personal data;
Processing purposes;
Processing methods;
Risks to data subjects;
Security safeguards;
Retention;
Data-sharing arrangements;
Processors and third parties;
Cross-border processing; and
Measures used to reduce identified risks.

Cross-border data transfers

Cross-border processing is an important compliance area under Vietnam's current law.

Decree 356/2025/ND-CP defines cross-border transfer activities broadly, including circumstances involving the movement or processing of personal data collected or stored in Vietnam through overseas infrastructure, foreign cloud services or overseas recipients.

Businesses using:

International cloud providers;
Global CRM systems;
Overseas analytics platforms;
International advertising platforms;
Foreign SaaS applications;
Global customer-support tools; or
Offshore data-processing vendors

should assess whether their activities constitute regulated cross-border processing.

Depending on the circumstances, an organisation may need to prepare or maintain a cross-border personal data transfer impact assessment dossier or comply with another applicable statutory mechanism.

Data security requirements

Organisations processing personal data should implement appropriate organisational, technical and human safeguards.

Security measures may include:

Access controls;
Authentication;
Encryption where appropriate;
Network and application security;
Logging and monitoring;
Vulnerability management;
Backup and recovery;
Employee training;
Vendor security controls;
Incident response procedures; and
Data minimisation and retention controls.

Security should be proportionate to the nature and risks associated with the data being processed.

Personal data breach notification

Vietnam's current Personal Data Protection Law establishes a 72-hour notification requirement for qualifying personal-data violations after the relevant organisation discovers the violation.

The requirement applies to qualifying violations that may harm matters such as national defence or security, social order and safety, life or health, honour and dignity, or property, subject to the statutory conditions.

Organisations should therefore maintain an incident-response process capable of:

Detecting a potential breach;
Assessing the incident;
Determining whether the statutory threshold is met;
Escalating the incident internally;
Preparing required notifications;
Documenting the response; and
Taking remediation measures.

A privacy incident-management process should be connected to the organisation's broader cybersecurity incident-response programme.

Controllers and processors

Businesses should clearly define their roles when processing personal data.

Depending on the activity, an organisation may act as:

A personal-data controller;
A personal-data processor;
A party performing both controlling and processing functions; or
Another regulated participant in the processing chain.

Contracts with processors and vendors should clearly establish:

Processing purposes;
Categories of data;
Security obligations;
Confidentiality;
Sub-processing;
Data retention;
Deletion or return of data;
Incident notification;
Data-subject request support; and
Cross-border processing responsibilities.

Data retention and deletion

Vietnam's framework requires personal data to be stored for an appropriate period corresponding to the purpose of processing, unless another law provides otherwise.

Organisations should therefore maintain documented retention schedules covering:

Customer information;
Employee data;
Marketing databases;
Account information;
Consent records;
Cookie and tracking data;
Support records;
Data-subject requests;
Security logs; and
Vendor-held personal data.

Retention should not continue indefinitely simply because data is technically inexpensive to store.

Cookies and online tracking

Businesses operating websites in Vietnam should assess their cookies and tracking technologies as part of their personal-data compliance programme.

This includes:

Analytics cookies;
Advertising cookies;
Retargeting technologies;
Social-media pixels;
Conversion tracking;
Session technologies;
Device identifiers;
SDKs; and
Other technologies that collect information capable of identifying or relating to individuals.

Consent requirements depend on the applicable legal basis and circumstances. Organisations should not assume that every cookie requires consent, but they should also avoid deploying personal-data processing without establishing the appropriate legal basis and safeguards.

ConsentX can help businesses operationalise this process by:

Scanning websites for cookies and trackers;
Categorising tracking technologies;
Blocking selected technologies before the applicable permission is obtained;
Recording consent choices;
Managing region-specific consent experiences; and
Maintaining auditable consent evidence.

Direct marketing and advertising

Marketing activities frequently involve personal data and should therefore be incorporated into an organisation's privacy compliance programme.

Businesses should assess:

The source of marketing data;
The legal basis for processing;
Whether consent is required;
How marketing preferences are recorded;
Opt-out and withdrawal mechanisms;
Third-party advertising platforms;
Data sharing;
Profiling;
Retention; and
International transfers.

Marketing consent should be clearly separated from unrelated terms where consent is required.

Automated processing, profiling and AI

Businesses using AI, automated decision-making, profiling or behavioural analytics should assess whether these activities involve personal data and whether additional requirements apply.

A privacy assessment should consider:

What data is supplied to the system;
The purpose of processing;
Whether sensitive personal data is involved;
Whether data is transferred to an overseas provider;
Whether decisions materially affect individuals;
Whether individuals receive appropriate information;
Security and access controls;
Retention;
Vendor processing; and
Human oversight where appropriate.

Organisations should document their AI and automated-processing use cases as part of their broader personal-data governance programme.

Small businesses and startups

Vietnam's Personal Data Protection Law contains transitional compliance provisions for certain small enterprises and startups.

Under the law, eligible small enterprises and startups may choose whether to implement certain provisions for a five-year period from the law's effective date, subject to statutory exceptions. The exemption does not generally apply where the business provides personal-data processing services, directly processes sensitive personal data, or processes personal data relating to large numbers of data subjects.

Decree 356/2025/ND-CP provides additional detail concerning the relevant thresholds and exemptions.

Businesses should therefore determine eligibility rather than assuming that all startups or small businesses are automatically exempt from Vietnam's privacy requirements.

Transition from Decree 13/2023

Vietnam's privacy framework changed significantly on 1 January 2026.

The new Personal Data Protection Law expressly provides transitional treatment for certain processing activities that were already being carried out with consent or agreements under Decree 13/2023/ND-CP before the new law took effect. Certain previously submitted impact-assessment dossiers may also continue under the transitional rules.

At the same time, Decree 356/2025/ND-CP states that Decree 13/2023/ND-CP ceases to have effect from 1 January 2026.

Therefore, businesses should update their compliance programmes rather than continuing to rely exclusively on guidance designed for the former Decree 13 regime.

Vietnam Personal Data Protection Law — Key Compliance Checklist

Use this checklist to review your organisation's Vietnam privacy programme:

Identify personal data collected and processed
Classify basic and sensitive personal data
Map processing purposes
Identify the applicable legal basis
Review consent mechanisms where consent is required
Maintain evidence of consent
Update privacy notices
Establish data-subject request procedures
Implement appropriate security safeguards
Review data retention periods
Identify processors and third parties
Review international and cross-border transfers
Assess impact-assessment requirements
Establish breach-response procedures
Prepare for applicable 72-hour notifications
Review marketing and advertising technologies
Scan cookies and website trackers
Block selected non-essential technologies before the applicable permission
Regularly review and update privacy controls

Why Vietnam privacy compliance matters for digital businesses

For organisations operating websites, apps and digital platforms in Vietnam, personal-data compliance increasingly requires coordination between privacy, security, legal, marketing and technology teams.

A modern compliance programme should therefore combine:

Legal basis + transparency + consent management + data governance + security + rights management + transfer controls + audit evidence.

ConsentX can support the consent-management and website privacy layer while organisations maintain the broader legal and organisational controls required by Vietnam's framework.

The Personal Data Protection Law applies within Vietnam's legal framework and also contains provisions affecting certain foreign organisations and individuals involved in the processing of covered personal data.

Other privacy regulations

Businesses operating internationally may also need to assess:

GDPR — European Union
UK GDPR — United Kingdom
CCPA/CPRA — California
LGPD — Brazil
PIPEDA — Canada
DPDP Act — India
PDPA — Singapore
PDPA — Thailand
POPIA — South Africa
FADP — Switzerland
Law 25 — Quebec, Canada
LFPDPPP — Mexico
PDPL — Argentina
Law 21.719 — Chile
Law 1581 — Colombia
Law 29733 — Peru
Law 18.331 — Uruguay

Applicable requirements depend on the organisation, processing activity, individuals involved and jurisdiction.

How ConsentX helps with Vietnam privacy compliance

ConsentX helps organisations operationalise key elements of their personal-data compliance programme.

1. Discover cookies and trackers

Scan your website to identify cookies, scripts, pixels and tracking technologies that may process personal data.

2. Control pre-consent processing

Use prior-script blocking to prevent selected non-essential technologies from executing before the applicable permission is obtained.

3. Capture consent

Deploy configurable consent experiences and capture user choices through an auditable consent-management system.

4. Maintain consent evidence

Create consent records that can help demonstrate:

What the user agreed to;
When consent was provided;
Which purpose applied;
Which version of the consent notice was presented; and
What choice the user made.

5. Manage withdrawal and privacy requests

Provide workflows for managing consent withdrawal and data-subject requests.

6. Apply regional rules

Use region-based configuration to provide different consent and privacy experiences depending on applicable legal requirements.

7. Support privacy governance

Connect website consent management with broader privacy processes, including data discovery, records, rights requests and compliance evidence.

Get PDP Law ready with ConsentX

ConsentX can support the consent-management and website privacy layer while organisations maintain the broader legal and organisational controls required by Vietnam's framework.

Get started free Book a demo

How to comply with Vietnam's Personal Data Protection Law using ConsentX

1
Scan your website
Run a ConsentX privacy scan to identify cookies, trackers, scripts and third-party technologies operating on your website.
2
Map your processing activities
Identify what personal data is collected, why it is collected, where it is stored and which vendors receive it.
3
Identify the applicable legal basis
Determine whether processing relies on consent or another legal basis available under Vietnam's law.
4
Configure your consent experience
Where consent is required, implement a clear consent mechanism that records the user's decision and provides the relevant information.
5
Block selected technologies before consent
Configure prior-script blocking so selected cookies and trackers do not execute before the applicable permission is obtained.
6
Record consent evidence
Maintain structured consent records that can be used as evidence of the user's choice.
7
Manage withdrawals and rights requests
Provide users with practical mechanisms for withdrawing consent and exercising applicable data-subject rights.
8
Review international transfers
Identify overseas vendors, cloud services, analytics providers and other recipients involved in processing Vietnamese personal data.
9
Review impact-assessment requirements
Determine whether your processing or cross-border activities require an impact assessment dossier under the current law and implementing decree.
10
Monitor and update
Privacy compliance is ongoing. Regularly rescan your website, review vendors, update privacy notices and adjust consent configurations when processing activities change.

Frequently asked questions

Country under this regulation

Việt Nam

Other regulations

GDPR UK GDPR CCPA / CPRA VCDPA Colorado CPA CTDPA UCPA TDPSA Oregon OCPA Montana MCDPA Florida FDBR LGPD PIPEDA DPDPA PDPA POPIA FADP Law 25 LFPDPPP PDPL Law 21.719 Law 1581 Law 29733 Law 18.331

Legal disclaimer

This page provides a plain-English overview of Vietnam's Personal Data Protection Law (Law No. 91/2025/QH15) and Decree 356/2025/ND-CP for general informational purposes. It is not legal advice.

Obligations can vary depending on the organisation, the processing activity, the individuals involved and the jurisdiction. Organisations should verify current requirements against the law, its implementing regulations and any sector-specific rules, and obtain qualified Vietnamese legal advice where necessary.

ConsentX

PDP Law

Vietnam Personal Data Protection Law at a glance