Your CRM is breached, a spreadsheet with 50,000 customers’ details is leaked, an employee accidentally emails sensitive data to the wrong address — when it happens, management’s first question is: who must we notify, and how fast? Under Clause 1, Article 23 of Vietnam’s Personal Data Protection Law 91/2025/QH15, where the incident may harm national defence, security, public order, or the life, health, honour, dignity or property of data subjects, the answer is unambiguous: the Department of Cybersecurity (A05) — within 72 hours of discovery.
1. Notify whom? — Department A05, Ministry of Public Security
Where a violation of personal data protection rules is discovered that may harm national defence, security, public order, or the life, health, honour, dignity or property of data subjects, the personal data controller, or the controller-cum-processor, must notify the specialised personal data protection authority — the Department of Cybersecurity and High-Tech Crime Prevention (A05) under the Ministry of Public Security — within 72 hours of discovering the violation (Clause 1, Article 23, Law 91/2025/QH15).
Other violations outside this 72-hour category still fall under the general notification duty: any discovered violation, data processed for the wrong purpose or contrary to agreement, or failure to guarantee data subjects’ rights — must all be reported to the specialised authority (Clause 3, Article 23).
Mind the roles: the data processor (e.g. an outsourcing vendor or cloud provider) that discovers a violation must promptly notify the data controller — failure to do so may draw fines of VND 10–20 million.
2. How to notify, and what to include?
Channels: online via the National Personal Data Protection Portal (once operational), in person at A05 headquarters, or by post to the Department’s receiving division.
Form: Form No. 08 issued with Decree 356/2025/ND-CP, covering: nature of the violation (time, place, conduct); categories and volume of affected personal data; contact details of the data protection personnel/unit; description of actual or potential harm; remedial measures taken or planned.
Incomplete information within 72 hours? The law permits staged notifications — but the initial notice (for violations under Clause 1, Article 23) must meet the 72-hour deadline and explain why full details are unavailable. Notices filed after 72 hours must include a reasonable explanation for the delay.
3. Two parallel duties not to forget
- Draw up a written record confirming the violation — a mandatory document for investigation;
- Notify affected data subjects: when personal data is leaked, subjects must be informed so they can protect themselves (change passwords, lock cards).
4. Sanctions for late or missing notification
Under Article 54 of Decree 330/2026/ND-CP (effective 19 August 2026): data controllers, controller-cum-processors or third parties that notify later than 72 hours — where the violation causes or may cause harm to national defence, security, public order, or to the life, health, honour, dignity or property of data subjects — face fines of VND 40–60 million. Beyond fines, businesses may be ordered to erase data or face suspension or restriction of data processing.
5. A 72-hour corporate response checklist
- Detect & contain: scope the breach, identify affected data categories; isolate compromised systems;
- Activate the response team: legal, IT/cybersecurity, communications, leadership;
- Assess & record: document timing, conduct and affected data volume;
- Notify A05 (Form 08) within 72 hours of discovery (for violations under Clause 1, Article 23) — even with incomplete information;
- Notify affected data subjects with self-protection guidance;
- Remediate, retain records and cooperate with A05’s investigation.
6. Frequently asked questions
Q: A minor incident — only a few internal employee emails leaked. Must we still report to A05 within 72 hours?
A: Not necessarily. The 72-hour frame (Clause 1, Article 23) applies only to violations that may harm national defence, security, public order, or the life, health, honour, dignity or property of data subjects. Other cases fall under the general notification duty (Clause 3, Article 23) — still reportable to the specialised authority, but without the hard 72-hour clock. Either way, assess and report fully; concealment discovered later is treated more severely.
Q: May we report to the local ward police instead?
A: No. The sole statutory recipient is Department A05 (Ministry of Public Security) — the specialised data protection authority.
Q: When does the 72-hour clock start?
A: From the moment the violation is discovered — the law says “within 72 hours of discovering the violation” (Clause 1, Article 23), not from when it occurred. Hence the need for monitoring and early-detection procedures so the 72-hour clock does not run against you.
Need a 72-hour data incident response playbook for your business? Contact us for advice.
This article was prepared by the FLAW AI Legal Council. The content is pending QA Council review before submission for approval; information is for reference only and does not replace legal advice for your specific case.