Vietnam’s Personal Data Protection Law 91/2025: Obligations of FDI Enterprises from 1 January 2026

From 1 January 2026, the Vietnam personal data protection law 2025 — Law No. 91/2025/QH15 — takes full effect, replacing a framework that previously sat at decree level. For foreign-invested enterprises (FDI) in Vietnam, this is no longer a matter of having an internal privacy policy for show. It is a complete set of legal obligations: how to obtain valid consent from employees and customers, how to prepare and file impact assessment dossiers with the Ministry of Public Security, and how to report incidents within 72 hours. Breaching the cross-border transfer rules — a routine scenario for FDI businesses syncing data to an overseas parent or using foreign-hosted cloud systems — can attract fines of up to 5% of the preceding year's revenue. This guide maps every obligation FDI enterprises must meet from 1 January 2026, with the key deadlines, the fining framework, and a compliance checklist you can apply immediately.

Table of contents

• 1. What is the Personal Data Protection Law 91/2025? Who is affected?
• 2. The current legal framework for personal data protection
• 3. Eight core obligation groups for FDI enterprises
• 4. Deadlines, costs and sanctions to remember
• 5. Six common risks and mistakes of FDI enterprises
• 6. Compliance checklist for FDI enterprises
• 7. Frequently asked questions (FAQ)
• 8. When an FDI enterprise should work with counsel
• Language versions
• References

1. What is the Personal Data Protection Law 91/2025? Who is affected?

The Law on Personal Data Protection No. 91/2025/QH15 was passed by the 15th National Assembly on 26 June 2025 at its 9th session, signed by National Assembly Chairman Tran Thanh Man, and takes effect on 1 January 2026 (Article 38). It is Vietnam's first dedicated personal data protection statute: 39 articles across 5 chapters covering general provisions; personal data protection (during data processing and in specific activities); the protection workforce and supporting conditions; responsibilities of agencies, organisations and individuals; and implementation provisions.

The first point FDI enterprises must grasp is the scope of regulated entities under Article 1. The law applies to three groups:

• Vietnamese agencies, organisations and individuals;
• Foreign agencies, organisations and individuals in Vietnam — subsidiaries, branches and representative offices of foreign investors in Vietnam fall squarely in this group;
• Foreign agencies, organisations and individuals directly participating in or involved in processing personal data of Vietnamese citizens and persons of Vietnamese origin without determined nationality residing in Vietnam who hold identification certificates.

The third group is the law's extraterritorial reach. Many FDI groups run centralised data models: the HRIS, CRM or data warehouse sits at headquarters abroad, while the Vietnamese subsidiary merely collects. When the overseas parent directly accesses, analyses or stores personal data of Vietnamese employees or customers, it may count as "directly participating" in processing and fall within the law's scope. Compliance, in other words, does not stop at the Vietnamese legal entity — the group's entire cross-border data architecture needs review.

2. The current legal framework for personal data protection

To apply the law correctly from 1 January 2026, FDI enterprises need the full picture — and must stop citing expired instruments:

• Law on Personal Data Protection 91/2025/QH15 — the centrepiece, effective 1 January 2026. Every obligation in this guide derives from it.
• Decree 356/2025/ND-CP (dated 31 December 2025) — the implementing decree, replacing Decree 13/2023/ND-CP (dated 17 April 2023). Decree 13/2023 — the foundation of personal data protection during 2023–2025 — expires on 1 January 2026. Processes and templates built under Decree 13 need updating to the new standard.
• Transitional rules (Article 39) ease the changeover: processing already consented to, or carried out under agreements compliant with Decree 13/2023 before the effective date, continues without fresh consent; processing impact assessment dossiers and cross-border transfer assessment dossiers already received by the specialised authority before the effective date remain usable with no need to re-file. However, updates to those dossiers after the effective date must follow the new law.
• Data Law 2024 (60/2024/QH15, effective 1 July 2025): Article 5(4) of Law 91/2025 provides that once impact assessments are done under this law, the corresponding risk assessments under data legislation are not required — no duplicate assessments.
• Implementation plan under Prime Minister Decision 2623/QD-TTg dated 29 November 2025 — businesses should track it for ministerial guidance timelines.
• Regulator: the Government exercises unified state management; the Ministry of Public Security (MPS) is the focal point (Article 36); the specialised personal data protection authority under the MPS (Article 33) receives assessment dossiers and violation notifications — in practice understood to be the Department of Cybersecurity and Hi-tech Crime Prevention (A05), though the statute does not name the unit; readers should confirm with counsel before filing.

One systemic note: the Cybersecurity Law 2025 (116/2025/QH15), in force from 1 July 2026, also touches data-related matters. When building an overall compliance programme, review both statutes together rather than in silos.

3. Eight core obligation groups for FDI enterprises

3.1. Identify your legal role in each data flow

The law defines three roles (Articles 2 and 37), each carrying a distinct bundle of duties:

• Personal data controller: decides the purposes and means of processing — e.g., an FDI company deciding to collect candidate files for recruitment or setting customer-data retention policies.
• Personal data processor: processes at the controller's request under a contract — e.g., a payroll vendor, an outsourced CRM operator.
• Controller-cum-processor: both decides purposes and means and processes directly — the most common role for FDI enterprises handling their own employee and customer data.

Role classification matters because liability tracks the role. The controller must spell out each party's responsibilities, rights and obligations in relevant agreements and contracts; decide processing purposes and means in documents and agreements with data subjects; implement appropriate managerial and technical safeguards; bear liability to data subjects for damage caused by processing; select suitable processors; and safeguard data subject rights (Article 37(1)). The processor may only receive data after a processing agreement or contract is in place, must process strictly per that agreement, and is liable to the controller for damage its processing causes (Article 37(2)).

Many FDI enterprises sign service contracts with domestic or foreign vendors containing no data protection clauses at all — or vague ones. From 1 January 2026, contracts with every data processor (payroll, IT outsourcing, marketing agencies, logistics providers, an overseas parent receiving reporting data) need review and supplementation: purposes, scope, safeguards, incident liability, and the duty to cooperate with competent state authorities.

3.2. Obtain valid consent — to a far higher standard than before

Consent is the most common processing basis, and Article 9 sets a demanding standard that many current business forms do not meet:

1. Voluntary and informed: the subject must clearly know the data types processed, the purposes, who the controller (or controller-cum-processor) is, and their own rights and obligations — before consenting.
2. Clear, specific, printable form — including electronic or otherwise verifiable formats. Implied consent inferred from mere use of a service, without preservable evidence, will be hard to defend in a dispute.
3. Separate consent for each purpose; consent to other purposes may not be made a condition. Fix now: single tick-boxes bundling "I agree to the Terms of Use, the Privacy Policy and to receive advertising" — that model no longer stands.
4. Silence or non-response is not consent. "Deemed consent if you do not opt out within X days" is unlawful for purposes requiring consent.
5. Consent lasts until the subject changes it or as otherwise prescribed — and subjects may withdraw consent or request processing restriction in writing (including electronic form). On receipt, the controller must act on the request and instruct processors to do the same within the statutory timeframe (Article 10). Withdrawal is not retroactive.

The law also lists processing without consent (Article 19): protecting life or health in emergencies; addressing emergencies, national-security threats, riot or crime prevention; serving state authorities' operations; performing the subject's agreement with relevant organisations or individuals; and other cases prescribed by law. Businesses invoking these bases must run an internal monitoring mechanism (processing procedures, periodic risk reviews, a channel for feedback). Under Article 19(1)(a), the law expressly places the burden of proof on the enterprise only for the emergency protection-of-life-and-health basis; the other bases carry no such express statutory duty — but in practice the authorities routinely ask the enterprise to produce the basis and documents showing its processing is lawful. Businesses should keep supporting records and seek counsel when relying on a specific basis.

3.3. Honour data subject rights

Article 4 grants every individual a bundle of rights the business — as controller — must facilitate without obstruction:

• To be informed about processing of their data;
• To consent or refuse, and to withdraw consent;
• To view and correct data, or request correction;
• To request provision, erasure, or restriction of processing; to object;
• To complain, denounce, sue, and claim damages;
• To ask competent authorities or relevant parties to apply protective measures.

On receiving a rights request, controllers (and controllers-cum-processors) must act promptly within the statutory timeframe — the specific periods are detailed by the Government. Operationally, FDI enterprises need a designated intake point and a data subject request (DSR) workflow with clear internal deadlines, instead of today's ad hoc handling over email. Erasure must use secure methods preventing unauthorised recovery; where erasure is genuinely impossible, the subject must be informed (Article 14).

3.4. Prepare and file the data processing impact assessment dossier

This is the most procedurally significant new duty (Article 21):

• Who: personal data controllers and controllers-cum-processors — i.e., most FDI enterprises processing employee, customer and partner data. Processors prepare and keep dossiers per their agreement with the controller.
• To whom, when: prepare and retain the dossier, and send one original to the specialised personal data protection authority within 60 days of the first day of personal data processing.
• Frequency: once for the organisation's entire operating life, updated on changes under Article 22.
• Exemption: competent state authorities.

The critical point: for an operating business, the "first day of processing" is typically in the past. FDI enterprises already operating in Vietnam should treat this duty as arising immediately when the law takes effect for ongoing processing — "we started before the law" is no excuse. Combined with the transitional rule (Article 39), businesses that already filed under Decree 13/2023 and had dossiers received by the specialised authority need not re-file; those that never filed must move now.

3.5. Tightly control cross-border personal data transfers

For multinational groups, this is the most painful duty (Article 20). The law identifies three cross-border transfer cases:

1. Moving data stored in Vietnam to storage systems outside Vietnam's territory;
2. Transferring data by Vietnamese organisations or individuals to organisations or individuals abroad;
3. Using platforms outside Vietnam's territory to process data collected in Vietnam — including the foreign-hosted SaaS, HRIS and CRM systems FDI businesses use daily.

Transferors must prepare a cross-border transfer impact assessment dossier and file one original with the specialised authority within 60 days of the first transfer. The assessment is done once and updated under Article 22.

Four groups are exempt from the transfer assessment (Article 20(6)): competent state authorities; storing employees' personal data on cloud computing services; subjects transferring their own data; and other cases prescribed by the Government. The cloud exemption for employee data is a vital safety valve for FDI enterprises on global HRIS clouds — but note two limits: it exempts only the assessment dossier, not other protection duties; and detailed conditions sit with the Government, so do not stretch the exemption by self-interpretation before checking the guidance.

Separately, the specialised authority may conduct periodic inspections (no more than once a year) or ad hoc inspections on detecting violations or a data leak/loss incident — and may order transfers suspended where transferred data is found to serve activities that could harm national defence or security. That is a direct administrative power over a business's data flows — an operational risk to manage in advance, not after an order lands.

3.6. Report violations within 72 hours and coordinate incident response

Article 23 sets an incident-response duty on a tight clock:

• On discovering a personal data protection violation that may harm national defence, national security, social order, or infringe the life, health, honour, dignity or property of data subjects, controllers, controllers-cum-processors and third parties must notify the specialised authority within 72 hours of discovery.
• A processor discovering a violation must promptly notify the controller (or controller-cum-processor).
• The controller must draw up a written record of the violation, coordinate with the specialised authority, while all involved parties contain the violation and remediate consequences.

"72 hours from discovery" is demanding. It requires a standing incident response plan: who decides "discovery" has occurred, who drafts the notification, what channel reaches the authority. Note the threshold: the duty attaches at the described harm level, not for every minor incident — but self-assessing "below threshold" always risks being characterised as concealment. The safe practice: log and assess every incident, report when the threshold appears engaged.

3.7. Designate a data protection function or personnel

Article 33(2) requires agencies and organisations to designate a sufficiently competent department or personnel for personal data protection, or hire a personal data protection service provider. Vietnamese law does not use the term "DPO" as the GDPR does, but in substance this is the requirement to have an accountable point of responsibility inside the organisation.

FDI enterprises have two routes: designate internal staff (often legal or IT — but they must be "sufficiently competent", with detailed criteria set by the Government) or outsource. Conditions and duties of the internal function and of service providers are detailed by the Government (Article 33(3)). Track the guidance to identify the competence standard for your designee.

3.8. Special duties for employee data

Article 25 devotes an entire article to recruitment, management and use of employees — an area where every FDI enterprise processes large volumes of data:

• Recruitment: request only information serving recruitment purposes and compliant with law; use it only for recruitment and other lawfully agreed purposes; obtain the candidate's consent; erase or destroy unsuccessful candidates' data, unless otherwise agreed. Indefinite "talent pools" without agreement are unlawful.
• Management: comply with this law plus labour, employment and data legislation; retain employee data for statutory or agreed periods; erase or destroy data on contract termination, except as agreed or otherwise prescribed by law (e.g., labour dossiers or social insurance records with statutory retention).
• Technology measures in workforce management: CCTV, device-monitoring software, biometric attendance — permitted only if lawful, protective of subject rights, and with the employee's clear knowledge; data collected through unlawful technical measures may not be processed or used.

Closely related is biometric data (fingerprints, faces used for attendance and access control): Article 31 requires physical security for biometric storage and transmission equipment, restricted access, and monitoring systems to prevent and detect intrusions. FDI employers using fingerprint or facial attendance must review the entire collection–storage–access chain for this data class — it attracts heightened protection as sensitive data.

One more often-missed point: audio/video recording in public or workplace areas (Article 32). Businesses may record work areas for security or asset protection without each individual's consent, but must notify people they are being recorded, process only for the stated purpose, and erase or destroy recordings once the necessary retention period ends.

4. Deadlines, costs and sanctions to remember

4.1. Statutory deadlines

4.2. The "soft" regime for small businesses — can FDI enterprises use it?

Article 38(2) and (3) are humane but largely unavailable to typical FDI enterprises:

• Small businesses and startups may choose whether to comply with Articles 21, 22 and 33(2) for five years;
• Household businesses and micro-enterprises are not required to comply with them;
• But neither group is exempt if it: provides data processing services; directly processes sensitive personal data; or processes personal data of a large number of data subjects.

An FDI manufacturer with thousands of workers (biometric attendance data, periodic health-check data — both sensitive) or an FDI trader with tens of thousands of customer records plainly hits the exceptions and must comply in full. Do not assume "small" status by default — assess against actual data types and processing scale.

4.3. The sanction framework: fines, criminal liability, compensation

Article 8 builds three tiers by nature and gravity — including scale-based fines capable of deterring even large groups:

• Trading in personal data: maximum fine of 10 times the revenue gained from the violation (falling back to the general cap where there is no revenue or the revenue-based figure is lower). A direct strike at unlawful data markets — including "buying customer databases" for marketing, still common in practice.
• Breaching cross-border transfer rules: maximum fine of 5% of the preceding year's revenue of the violating organisation. For an FDI enterprise with hundreds of millions of dollars in revenue, that can mean tens of millions — GDPR-style, revenue-based logic.
• Other violations: maximum fine of VND 3 billion.
• These caps apply to organisations; individuals face at most half the organisational amount.
• Beyond administrative fines: criminal prosecution is possible; and compensation for damage caused.

Article 7 lists seven prohibited acts — three groups businesses must internalise: (i) unlawful data processing; (ii) trading in personal data (unless otherwise prescribed by law); (iii) appropriating, intentionally leaking or losing personal data. Every internal process — marketing, sales, HR, IT — must be screened to eliminate these.

4.4. Compliance costs

The law sets no state fee for filing assessment dossiers. Real compliance costs for FDI enterprises sit in: data-flow mapping, standardising forms and contracts, preparing assessment dossiers, building incident-response procedures, training personnel, and possibly engaging a data protection service provider. Legal-service fees depend on each enterprise's data-system scale and complexity — contact FLAT for a matter-specific fee quote via hotline 0988424851.

5. Six common risks and mistakes of FDI enterprises

Mistake 1: Treating silence as consent in existing forms. Many FDI websites and apps still use bundled tick-boxes — "I agree to the Terms of Use, the Privacy Policy and to receive advertising" in one click — or deem continued service use as consent. Under Article 9, consent must be per purpose, unbundled, and silence or non-response is not consent. Consequence: the entire basis for marketing processing may be invalid, and the business cannot prove lawfulness under inspection. Prevention: separate each purpose, use plain language, and keep verifiable consent records.

Mistake 2: Syncing data to the overseas parent or foreign cloud without a dossier. The costliest mistake: global HRIS, centralised CRM, headquarters data warehouses all count as "cross-border transfers" under Article 20, with fines up to 5% of the preceding year's revenue. Many groups assume "intra-group transfers are fine" — the law provides no intra-group exception. Prevention: map every outbound data flow, prepare and file the cross-border transfer impact assessment within 60 days, and carefully test the exemptions (e.g., employee data on cloud).

Mistake 3: Keeping departed employees' data indefinitely "just in case". Article 25 requires erasure or destruction of employee personal data on contract termination, except as agreed or otherwise prescribed by law (such as statutory retention for labour dossiers or social insurance). Keeping full ex-employee files "for convenient lookup" without basis breaches the purpose-limited retention principle (Article 3). Prevention: adopt a retention-and-erasure policy per record type with specific time limits, and automate deletion on expiry.

Mistake 4: No accountable data protection owner. Many FDI enterprises leave data security vaguely with IT — no designation decision, no defined competence or duties. Article 33(2) requires designating a sufficiently competent department or personnel or hiring a service provider. When an incident hits or inspectors arrive, the absence of a formal owner cripples the 72-hour response and undermines proof of "appropriate managerial and technical measures" under Article 37. Prevention: issue a written designation with duties and competence assurance (training, certification), or contract a qualified provider.

Mistake 5: Buying customer lists or "swapping" databases with partners. Article 7 prohibits trading in personal data (unless otherwise prescribed by law), and Article 8(3) sets the maximum fine at 10 times the revenue from the violation. Buying "prospect lists" or exchanging databases across an ecosystem for marketing — without clear legal basis and subject consent — is actionable. Note Article 17(2): transfers in the cases prescribed by law (with consent, proper intra-organisation sharing, at a competent authority's request) are not deemed trading whether or not money changes hands — the line is legal basis, not payment.

Mistake 6: Concealing a leak or loss for fear of reputational harm. Concealment is a natural reflex, but Article 23 makes it a standalone violation: no 72-hour notification, no written record, no coordination with the specialised authority. Double exposure: liability for the underlying incident plus liability for non-reporting — and when the matter surfaces, reputational damage is worse. Prevention: a standing incident-response procedure with decision-makers, notification templates, and a "report first, assess after" rule when the threshold appears engaged.

6. Compliance checklist for FDI enterprises

• [ ] Data mapping: catalogue all personal data collected — what types, from whom (employees, customers, partners), for what purposes, stored where, accessible by whom, transferred to whom (including parents and vendors).
• [ ] Role classification (controller / processor / controller-cum-processor) per data flow under Article 2, as the basis for allocating duties under Article 37.
• [ ] Standardise consent forms per Article 9: separate purposes, plain language, no bundling, a withdrawal mechanism, verifiable records.
• [ ] Build a data subject request workflow (access, correction, erasure, restriction, objection, withdrawal) with an intake owner and internal deadlines (Articles 4 and 10).
• [ ] Prepare and file the data processing impact assessment dossier with the specialised authority within 60 days (Article 21); set a 6-month update cycle (Article 22).
• [ ] Review every cross-border data flow; prepare and file the cross-border transfer impact assessment within 60 days; carefully test the Article 20(6) exemptions.
• [ ] Designate the data protection department/personnel in writing, or contract a service provider (Article 33(2)).
• [ ] Standardise employee-data governance: recruitment procedures (Article 25(1)), retention periods and post-termination erasure (Article 25(2)), transparency of technology monitoring to employees (Article 25(3)).
• [ ] Establish incident response: detect — assess — notify the specialised authority within 72 hours — record — remediate — coordinate (Article 23).
• [ ] Review processor contracts (payroll, IT, marketing, logistics, overseas parent): add clauses on purposes, scope, safeguards, incident liability and cooperation duties (Article 37).

7. Frequently asked questions (FAQ)

Q: Does the Personal Data Protection Law 91/2025 apply to FDI companies in Vietnam?

A: Yes. Article 1 applies the law to Vietnamese agencies, organisations and individuals; foreign agencies, organisations and individuals in Vietnam; and foreign agencies, organisations and individuals directly participating in or involved in processing personal data of Vietnamese citizens. A foreign investor's subsidiary in Vietnam is directly regulated. Notably, an overseas parent that directly accesses or processes Vietnamese citizens' personal data (e.g., through a centralised HRIS or CRM) may also fall within scope under the extraterritorial effect. Next step: review the whole group's data architecture, not just the Vietnamese entity.

Q: Must consent obtained before 1 January 2026 be obtained again?

A: No. Article 39 lets processing already consented to, or carried out under agreements compliant with Decree 13/2023/ND-CP before the effective date, continue without fresh consent. But the Article 9 consent standard is higher and more detailed (per-purpose consent, no bundling, silence is not consent). Next step: review legacy forms, prioritising new collection touchpoints and live marketing campaigns.

Q: Does storing HR data on a foreign-based cloud require a cross-border transfer impact assessment dossier?

A: Article 20(6)(b) exempts from the transfer assessment the case of an organisation storing its employees' personal data on cloud computing services. Read the scope correctly: only the assessment dossier is exempted, not other protection duties; and detailed conditions are set by the Government. Next step: check the guidance (Decree 356/2025/ND-CP), avoid expansive self-interpretation, and record the legal assessment in an internal memo.

Q: What is the fine for failing to prepare and file the impact assessment dossier?

A: The law sets no per-violation fine; Article 8 caps administrative fines at VND 3 billion for other personal data protection violations (half for individuals). Cross-border transfer violations are capped at 5% of the preceding year's revenue; trading in personal data at 10 times the violation revenue. Specific fines per violation depend on the Government's detailed sanctioning regulation. Next step: complete the dossier within the 60-day window to eliminate this risk entirely rather than betting on the fine level.

Q: Are small businesses and startups exempt from any obligations?

A: Conditionally. Article 38 lets small businesses and startups opt in or out of Articles 21, 22 and 33(2) for five years; household businesses and micro-enterprises are not required to comply. Neither is exempt when providing data processing services, directly processing sensitive personal data, or processing data of a large number of subjects. Most FDI enterprises — with large workforces and customer bases, typically handling sensitive data (biometrics, health) — will not qualify.

Q: What must a business do, and how quickly, upon discovering a data leak or loss?

A: Under Article 23, where a violation may harm national defence, national security, social order, or infringe the life, health, honour, dignity or property of data subjects, the business must notify the specialised personal data protection authority within 72 hours of discovery, draw up a written record, contain the violation, remediate consequences and cooperate with the authority. A processor discovering an incident must promptly notify the controller. Next step: build the incident-response procedure and assign responsibility before an incident occurs.

8. When an FDI enterprise should work with counsel

Not every compliance task needs a lawyer, but at certain moments counsel makes the difference between box-ticking and genuine compliance:

• Preparing the first impact assessment dossiers for processing and cross-border transfers: scoping, data-flow description and risk evaluation carry long-term legal weight — errors here follow the business through every later update.
• Where the group runs routine cross-border flows to an overseas parent or global systems: restructuring flows, intra-group data transfer agreements, and a well-grounded exemption analysis.
• When a leak or loss occurs: 72 hours is too short for simultaneous technical response and legal calibration; counsel helps assess the reporting threshold, draft notifications and engage the specialised authority.
• When the specialised authority inspects or seeks explanations: every explanatory submission can become evidence later — it needs litigation-minded preparation.

FLAT LAW FIRM advises FDI enterprises on personal data protection compliance: data-flow reviews, impact assessment dossiers, contract and form standardisation, and incident-response procedures. Contact our hotline 0988424851 for matter-specific advice.

Language versions

References

• Law on Personal Data Protection No. 91/2025/QH15 (passed 26/6/2025, effective 01/01/2026).
• Decree No. 356/2025/ND-CP dated 31/12/2025 guiding the Law on Personal Data Protection (replacing Decree 13/2023/ND-CP).
• Decree No. 13/2023/ND-CP dated 17/4/2023 on personal data protection (expired 01/01/2026).
• Data Law No. 60/2024/QH15 (effective 01/7/2025).
• Decision No. 2623/QD-TTg dated 29/11/2025 of the Prime Minister issuing the implementation plan for the Law on Personal Data Protection.