A foreign e-commerce platform selling to Vietnamese buyers is a personal data controller of those buyers under Personal Data Protection Law No. 91/2025/QH15 — with full impact assessment, protection and incident notification duties. But one frequently misunderstood point must be stated correctly: current Vietnamese law does not by default require the platform to store buyer data in Vietnam; the localisation duty arises only upon a competent authority’s decision under the separate mechanism of cybersecurity law.
Must a foreign platform store buyer data in Vietnam?
No, under the default regime. Personal Data Protection Law No. 91/2025/QH15 and Decree 356/2025/ND-CP impose no data localisation duty on every personal data processing activity: buyer data may be processed and stored on the platform’s global infrastructure, accompanied by duties for outbound personal data transfer — preparing an outbound transfer impact assessment dossier under Article 20 of Law No. 91/2025/QH15, filing it with the specialised personal data protection authority and updating it upon changes.
The Vietnam storage duty belongs to a different legal layer — cybersecurity law: where a competent authority issues a decision under the mechanism of Cybersecurity Law No. 116/2025/QH15 and Decree 333/2026/ND-CP against an enterprise in the regulated scope with identified violations unremedied after written requests, the enterprise may be required to store data in Vietnam and place a branch or representative office. This is a conditionally triggered mechanism by administrative decision, applying to a defined group of enterprises — not a default business condition for every foreign platform, and any article or advice asserting that “foreign platforms must store data in Vietnam” without this triggering mechanism is inaccurate.
What is the platform liable for when buyer data leaks?
Liability has three tiers. Tier one is the incident response duty: when a personal data breach occurs, the data controller must implement handling measures and notify the incident to the specialised personal data protection authority and to affected data subjects per the procedures and deadlines of Personal Data Protection Law No. 91/2025/QH15 and Decree 356/2025/ND-CP — concealing an incident or late notification is an independent violation. Tier two is civil liability: buyers suffering actual damage from the leak — losing money, being scammed using the leaked data — may claim damages under civil law.
Tier three is administrative sanctions under Decree 330/2026/ND-CP — where the personal data protection segment carries its own fine-level convention at Article 7 of the decree — combined with the sanction ceilings of Law No. 91/2025/QH15 itself at Article 8: unlawful trading of personal data fined up to ten times the illicit gain; unlawful cross-border transfer of personal data up to five percent of the preceding year’s revenue; other personal data protection violations up to three billion dong. For a large platform, the heaviest risk tier is therefore not the fine but remediation orders, suspension of data processing activity and loss of user trust after a publicised incident.
The platform’s baseline duties toward Vietnamese buyer data
Even with no incident, a foreign platform collecting Vietnamese buyers’ data must operate the full duty set of a data controller under Personal Data Protection Law No. 91/2025/QH15: a lawful processing basis and a transparent data protection policy for Vietnamese users; a personal data processing impact assessment dossier under Article 21 and an outbound transfer impact assessment dossier under Article 20 where data moves to systems outside Vietnam; designated personal data protection personnel under Article 33; and performing data subjects’ rights — to know, access, rectify, restrict processing, object and request erasure.
The point operators often underestimate is scope of application: Law No. 91/2025/QH15 also applies to foreign organisations and individuals directly processing, or involved in processing, the personal data of Vietnamese persons — a platform with no Vietnamese entity is not outside this scope. Impact assessment dossier duties are designed as prepare-once and update-upon-change, but that “once” must really exist and be filed with the correct specialised authority; global platforms usually must add a Vietnam annex to their global data compliance programme rather than assume home-country GDPR or PDPA frameworks automatically satisfy Vietnamese law.
Can customers require deletion of their data?
Yes. The right to request erasure of personal data is among the data subject rights under Personal Data Protection Law No. 91/2025/QH15: a buyer may require the platform to erase their personal data, and the data controller must receive, perform the request and respond within the deadlines under Decree 356/2025/ND-CP, except where data must continue to be stored under other legal duties. Practical exceptions include transaction data that must remain in records and documents serving tax and accounting duties, and data needed to resolve ongoing disputes and complaints.
In practice, the erasure right works best through the platform’s account channel — deleting the account and requesting accompanying data erasure — and users should distinguish three different things: deleting the visible account, erasing personal data from processing systems, and the platform’s still having to keep certain minimum transaction records under statutory storage duties. A compliant platform will answer clearly per layer instead of promising an inaccurate “total deletion”. If the platform refuses or fails to respond to a valid request, the buyer may complain to the specialised personal data protection authority — data subject complaints are one of the channels triggering compliance inspection of the data controller.
Frequently asked questions
Must a foreign platform store Vietnamese customers’ data in Vietnam?
Not by default. Personal Data Protection Law No. 91/2025/QH15 and Decree 356/2025/ND-CP impose no Vietnam storage duty on every platform; buyer data may be stored on the platform’s global infrastructure together with the duty to prepare an outbound personal data transfer impact assessment dossier under Article 20 of Law No. 91/2025/QH15. Local storage arises only upon a competent authority’s decision under the mechanism of Cybersecurity Law No. 116/2025/QH15 and Decree 333/2026/ND-CP against a regulated enterprise that violates and fails to remedy — a conditionally triggered mechanism, not a default condition for every foreign platform.
What liability does the platform bear if customer data leaks?
The platform bears three liability tiers. One, the incident response duty: handling and notifying personal data breaches to the specialised authority and affected buyers under Law No. 91/2025/QH15 and Decree 356/2025/ND-CP — concealment or late notice is an independent violation. Two, civil damages for buyers’ actual losses. Three, administrative sanctions under Decree 330/2026/ND-CP and the ceilings at Article 8 of Law No. 91/2025/QH15 — unlawful trading of personal data up to ten times the illicit gain; unlawful cross-border transfer up to five percent of the preceding year’s revenue; other violations up to three billion dong.
Do customers have the right to request data deletion?
Yes. Requesting erasure of personal data is a data subject right under Personal Data Protection Law No. 91/2025/QH15, and the platform must receive, perform and respond to the request within the deadlines under Decree 356/2025/ND-CP. Exceptions are data that must be kept under other legal duties — transaction records for tax and accounting document storage and data needed for ongoing disputes. If the platform refuses or stays silent before a valid request, the customer may complain to the specialised personal data protection authority for a compliance inspection of the platform.
This article has been quality-reviewed by the FLAW AI Legal Council
