What documentation does Vietnam require for consent?

Consent must be freely given, specific, informed, and unambiguous, and expressed in a format that can be printed or reproduced in writing, which is a demanding documentation standard.

Asia-Pacific

Cookie consent in Việt Nam

Q: Does Vietnam require impact assessments?

Yes. The decree requires filing impact assessment dossiers with the Ministry of Public Security for many processing activities and for cross border transfers of personal data.

Consent and privacy law in Việt Nam

Vietnam's Personal Data Protection Decree, No. 13/2023, took effect in July 2023 and is the country's first comprehensive data protection instrument, overseen by the Ministry of Public Security. It is consent-heavy, requiring consent that is freely given, specific, informed, and unambiguous, and it must be expressed in a format that can be printed or reproduced in writing, which is a demanding documentation standard. A notable obligation is filing an impact assessment dossier with the Ministry of Public Security for many processing and cross border transfer activities. Notices in Vietnamese are expected. A full Personal Data Protection Law is expected to follow and strengthen the framework further.

Authority

Ministry of Public Security (Department A05)

Status

Personal Data Protection Decree No. 13/2023/ND-CP in force since July 2023

Primary law

PDP Law

Languages

Tiếng Việt

Who must comply

Vietnamese agencies, organisations and individuals, foreign agencies, organisations and individuals in Vietnam, and foreign parties involved in processing personal data of Vietnamese citizens and certain Vietnamese-origin individuals residing in Vietnam.

Penalties

Administrative sanctions under the decree, with a dedicated data protection law expected

Key obligations

Identify a lawful basis before processing and meet its statutory requirements
Provide transparent privacy notices covering purposes, recipients, transfers and rights
Obtain and demonstrate consent through a reproducible mechanism where consent applies
Operate data-subject rights processes for access, correction, withdrawal and deletion
Prepare impact assessment dossiers for specified processing and cross-border activities
Apply institutional, technical and human security safeguards
Notify qualifying personal-data violations within 72 hours of discovery

Local guidance

Apply Decree No. 13/2023 on personal data protection
Record consent in a reproducible written format
File impact assessment dossiers where required
Provide notices in Vietnamese

How ConsentX helps

Cookie and tracker discovery scans
Prior-script blocking before the applicable permission
Auditable consent records and evidence
Consent withdrawal and privacy request workflows
Region rule engine tuned for Vietnam

Get started free

yoursite.com

Việt Nam

We value your privacy

We ask for your consent before any non-essential cookie, with the rules that apply in your region.

Allow allReject non-essentialManage preferences

Consent recorded

sha256 · chain ok

This page is a plain-English summary for general information and is not legal advice. Confirm your obligations with qualified local counsel.

Get Việt Nam ready with ConsentX

Geo-aware banners, prior-script blocking, DSAR and tamper-evident evidence.

Get started free Book a demo

How to comply with Việt Nam using ConsentX

1
Scan your website
Run a free scan to find every cookie and tracker on your site, so you know exactly what needs consent under Việt Nam.
2
Show a geo-aware consent banner
Add the ConsentX banner. It detects each visitor region and shows the consent experience that Việt Nam requires, automatically.
3
Block trackers until consent
Keep non-essential cookies and trackers blocked until the visitor agrees, so nothing fires before consent.
4
Record tamper-evident proof
Every choice is stored as a tamper-evident consent receipt you can produce in a Việt Nam audit.
5
Handle data requests on time
Use the built-in DSAR workflow with SLA timers to answer access, deletion and opt-out requests within the legal deadline.