Short answer: there is no state-issued standard form for an e-commerce website privacy policy in Vietnam. The mandatory contents comprise 06 items under Clause 1, Article 69 of Decree 52/2013/ND-CP (on e-commerce; still in force, amended by Decree 85/2021) — plus an additional layer from the Personal Data Protection Law 91/2025/QH15 (effective from 01/01/2026).
1. No state-issued standard form
The law does not prescribe a fixed template for e-commerce privacy policies. Website owners draft their own policy but must cover all mandatory contents and make the policy available to users before they provide personal data.
2. The 06 mandatory contents under Clause 1, Article 69 of Decree 52/2013
An e-commerce website privacy policy must clearly state the following six items:
- Purpose of personal data collection: why data is collected (e.g., order processing, customer care).
- Scope of data use: the scope and activities for which the data is used.
- Data retention period: how long the data is stored.
- Persons or organizations that may access the data: who can access it (e.g., delivery partners, payment gateways).
- Address of the entity collecting and managing the data: name, address, and contact details of the responsible entity.
- Means for consumers to access and correct their personal data: how users can view, correct, or delete their data on the website.
3. The additional layer from the Personal Data Protection Law 91/2025
From 01/01/2026, Law 91/2025/QH15 on Personal Data Protection takes effect, and privacy policies should add:
- Informed consent (Article 9): data collection must be based on the data subject voluntary, specific, clear, and informed consent — websites need a consent mechanism meeting this standard.
- Rights of data subjects (Article 11): the policy must fully inform users of their rights over their data.
- Impact assessment (Article 29): data processing organizations must conduct personal data protection impact assessments as required.
In other words, a compliant policy today has two layers: the six foundational contents of Decree 52/2013 plus the additional requirements of Law 91/2025.
4. Note: the policy must be published on the website
The privacy policy must be placed where users can easily find it (typically the website footer) before they provide personal data. A policy that is hidden or only appears after data collection does not meet the publication requirement.
Frequently asked questions
Does a small e-commerce website need a privacy policy?
Yes. Any e-commerce website collecting users personal data must have a privacy policy covering the 06 mandatory contents under Article 69 of Decree 52/2013, regardless of size.
Is Decree 52/2013 still in force?
Yes. Article 69 of Decree 52/2013 (as amended by Decree 85/2021) remains the basis for the six mandatory contents, applied alongside the additional requirements of Law 91/2025 from 01/01/2026.
Should a policy drafted before 2026 be updated?
It should. From 01/01/2026, the requirements on informed consent (Article 9), data subject rights (Article 11), and impact assessment (Article 29) of Law 91/2025 must be reflected in the policy.
Legal references
- Clause 1, Article 69 of Decree 52/2013/ND-CP (in force; amended by Decree 85/2021) — the 06 mandatory contents.
- Articles 9, 11, 29 of the Personal Data Protection Law 91/2025/QH15, effective 01/01/2026 — informed consent, data subject rights, impact assessment.
Need your e-commerce privacy policy reviewed? The FLAT Law Firm team advises on e-commerce and personal data protection compliance, drafting and reviewing privacy policies under current regulations. Contact us at contact us.
The information in this article is for general reference based on the laws in force at the time of writing (14/10/2026) and does not constitute legal advice for any specific case.
Transparency note: This article was drafted by the FLAT Law Firm AI content production system and has passed the AI content review council (AI Legal Council QA). It has not been reviewed by a licensed human lawyer.
