From 01/01/2026, personal data protection in Vietnam enters a new era: the Law on Personal Data Protection 91/2025/QH15 (passed 26/6/2025) takes effect, fully replacing Decree 13/2023/ND-CP. It comes with new guiding instruments and sanctions. This article summarizes the compliance framework businesses must follow.
1. PDP Law 91/2025: fully replacing Decree 13/2023
The Law on Personal Data Protection 91/2025/QH15 (passed 26/6/2025, effective 01/01/2026) has 5 chapters and 39 articles, elevating personal data protection from decree level to statute level. From 01/01/2026, Decree 13/2023/ND-CP is no longer current authority — all corporate data policies, contracts and internal procedures should be reviewed and updated under Law 91/2025.
2. Decree 356/2025: five core groups of content
Decree 356/2025/ND-CP (issued 31/12/2025, effective 01/01/2026) has 5 chapters and 42 articles, detailing Law 91/2025 across five core groups:
- Impact assessments for personal data processing;
- Cross-border transfers of personal data;
- Data protection officers (DPO);
- Responsibilities of data controllers and processors;
- The specialized personal data protection authority and the National Portal on Personal Data Protection.
3. Breach notification: 72 hours
Upon discovering a personal data protection violation, organizations and individuals must notify within 72 hours of discovery. Businesses need detection — assessment — notification procedures fast enough to meet this deadline, with full records of the incident-handling process.
4. Six new administrative procedures in personal data protection
Decision 778/QD-BCA-A05 (9/2/2026) of the Ministry of Public Security announces six new administrative procedures in personal data protection, handled by the Cybersecurity and Hi-Tech Crime Prevention Department (A05), with a 15-day processing time. Businesses conducting activities subject to these procedures must file complete dossiers on time.
5. New sanctions: Decree 330/2026
Decree 330/2026/ND-CP (effective 19/8/2026) provides administrative penalties for cybersecurity and personal data protection violations. Notable fine levels:
- Buying or selling personal data: fines of up to 10 times the illicit gains;
- Unlawful cross-border transfers of personal data: fines of up to 5% of revenue.
In addition, providing personal data processing services is a conditional business line — service providers must satisfy the prescribed conditions.
6. Implementation plan
Decision 2623/QD-TTg (29/11/2025) issues the Plan for implementing the Law on Personal Data Protection, assigning tasks to ministries, sectors and localities. Businesses should follow the implementation roadmap to prepare for compliance, especially further detailed guidance from the Ministry of Public Security.
Frequently asked questions
Is Decree 13/2023 still in force?
No. Law 91/2025/QH15 (effective 01/01/2026) has fully replaced Decree 13/2023.
What does Decree 356/2025 cover?
5 chapters and 42 articles, focused on five groups: impact assessments; cross-border transfers; DPO; controller/processor responsibilities; the specialized authority and the National Portal.
How quickly must a data breach be notified?
Within 72 hours of discovery.
What is the fine for buying or selling personal data?
Up to 10 times the illicit gains (Decree 330/2026/ND-CP).
How many new administrative procedures are there?
Six procedures under Decision 778/QD-BCA-A05, processed by Department A05 within 15 days.
Sources
- Law on Personal Data Protection 91/2025/QH15 (26/6/2025, effective 01/01/2026) — 5 chapters, 39 articles; replacing Decree 13/2023/ND-CP;
- Decree 356/2025/ND-CP (31/12/2025, effective 01/01/2026) — 5 chapters, 42 articles;
- Decree 330/2026/ND-CP (effective 19/8/2026) — administrative penalties for cybersecurity and personal data protection violations;
- Decision 778/QD-BCA-A05 (9/2/2026) — six new administrative procedures;
- Decision 2623/QD-TTg (29/11/2025) — Plan for implementing the Law on Personal Data Protection.
Conclusion
From 01/01/2026, personal data protection in Vietnam is governed by Law 91/2025/QH15 (fully replacing Decree 13/2023) and Decree 356/2025/ND-CP with five core content groups. Businesses must meet the 72-hour breach notification obligation, complete six new administrative procedures through Department A05, and face heavy sanctions under Decree 330/2026 (up to 10x illicit gains for data trading, up to 5% of revenue for cross-border transfers). A comprehensive review of data policies under the new framework should be done now.
Does your business need a Personal Data Protection Law compliance review? Contact FLAT Law Firm for advice.
For reference only; not legal advice. This content was prepared by AI and will undergo quality review by the AI Legal Council of FLAT Law Firm before any publication consideration; it is not the legal opinion of a licensed human lawyer. Laws and regulations may change; verify the current legal texts before applying them.