Vietnam Personal Data Protection Compliance Checklist for FDI Companies

Vietnam's Law on Personal Data Protection No. 91/2025/QH15 (passed by the 15th National Assembly on 26 June 2025, effective 1 January 2026) creates an entirely new compliance framework for every organization processing personal data in Vietnam — and FDI companies are among the most affected: they hold domestic HR and customer data while staying connected to overseas parent systems. This Vietnam personal data protection compliance checklist sets out 14 concrete action items to audit and complete your compliance posture, from data inventories and consent remediation to impact assessment dossiers and the 72-hour breach notification rule. This is a practical action checklist; for a detailed analysis of the underlying legal obligations, see our companion guide on FDI companies' obligations under the Personal Data Protection Law 91/2025.

Contents

• 1. Who should use this checklist and how
• 2. Detailed checklist
• A. Scope and data classification
• B. Consent and data subject rights
• C. Mandatory compliance dossiers
• D. People, technology and retention
• E. Monitoring and incident response
• 3. Common mistakes when self-applying this checklist
• 4. After completing the checklist
• 5. Frequently asked questions
• 6. Language versions
• 7. References

1. Who should use this checklist and how

This checklist is for the management, in-house counsel, HR, IT and compliance teams of foreign-invested enterprises operating in Vietnam — including subsidiaries of multinational groups, joint ventures, branches and representative offices processing personal data of Vietnamese individuals. Use it when: (i) conducting a first compliance review after the Law took effect on 1 January 2026; (ii) preparing for a regulatory inspection; (iii) planning a change falling within the three cases that trigger immediate dossier updates under Article 22.2 (reorganization/termination/dissolution/bankruptcy; changes to the personal data protection service provider's information; new or changed data-related business lines registered in the dossier) — routine ERP migrations or vendor switches only create a duty to update in the 06-month periodic review when dossier contents change.

How to mark: ☐ not done · ☑ done with evidence · ⚠ done but needs legal review. The governing principle: every item requires evidence (documents, dossiers, system logs). In an inspection, the company must prove compliance; the burden does not sit with the regulator.

2. Detailed checklist

A. Scope and data classification

Item 1: Inventory all personal data collected, processed and stored ☐

• Action: Build a data inventory listing every category of personal data the company holds: HR data (recruitment files, contracts, payroll, social insurance, attendance), customer data (CRM, orders, contracts), supplier data, website/app data (cookies, logs), CCTV footage. For each category record: source of collection, processing purpose, storage location (which server, which country), who has access, and retention period.
• Why it matters: You cannot comply with what you do not know. Every obligation under the Law — from consent (Article 9) to impact assessments (Article 21) to access controls — starts from knowing what data you process. An incomplete inventory is the root cause of most downstream violations, and it is the first document inspectors ask for.
• How to do it: Interview each department (HR, Sales, Marketing, IT, Admin) and reconcile against systems (ERP, HRM, CRM, email, file servers). For multinational groups, include data accessed remotely by the parent or regional headquarters through group systems.
• Watch out: Do not miss "invisible" data: website access logs, CCTV data, employees' personal spreadsheets, emails containing customer information. These are the most common blind spots.

Item 2: Classify basic vs. sensitive personal data under Articles 3–4 of Decree 356/2025/ND-CP ☐

• Action: Map each data field in the inventory against the two Government-issued catalogues: basic personal data (Article 3 of Decree 356/2025/ND-CP: name, date of birth, gender, address, nationality, image, phone number, personal identification number, passport number, marital status, family information, digital accounts, etc.) and sensitive personal data (Article 4: racial/ethnic origin, political/religious views, private life, health status, biometric and genetic data, sex life, criminal records, geolocation, login credentials, ID card images, bank account information and transaction history, online behavioral data, etc.).
• Why it matters: Misclassification means applying the wrong protection level — a violation in itself. Sensitive data faces materially stricter controls: organizations must establish access-restriction rules, processing procedures and dedicated security measures (Article 4.2 of Decree 356/2025/ND-CP). Many FDI companies do not realize that delivery staff GPS data, fingerprint attendance records or customer transaction histories are all sensitive data.
• How to do it: Flag "sensitive" on the inventory for every field falling within the 13 groups of Article 4 of Decree 356/2025/ND-CP; where in doubt, default to the higher protection tier and note the reasoning for legal review.
• Watch out: ID card images and biometric data (fingerprints, facial recognition) are the two sensitive categories FDI companies collect most and protect least — particularly CCCD photos sitting in HR inboxes and chat apps.

Item 3: Determine your legal role in each process: controller, processor, or controller-processor ☐

• Action: For each data flow, determine the company's role under Article 2 of Law 91/2025/QH15: personal data controller (decides purposes and means of processing — Clause 7), personal data processor (processes at the controller's request under a contract — Clause 8), or controller-processor (decides and directly processes — Clause 9). Record the role in the inventory and in each vendor contract.
• Why it matters: Legal responsibilities differ fundamentally under Article 37: controllers must spell out parties' responsibilities in agreements, determine processing purposes in documents/agreements with data subjects, and are liable to data subjects for processing-related damage; processors may only receive data under an agreement/contract, must process strictly per contract, and are liable to the controller. Misidentifying your role means signing the wrong contract type and bearing the wrong liability when an incident occurs.
• How to do it: Draw data-flow diagrams for 3–5 core processes (recruitment, HR management, sales/CRM, marketing, IT outsourcing). For each arrow sending data outside (IT vendors, payroll providers, parent company), record each party's role and cross-check the corresponding contract terms.
• Watch out: Overseas parent companies accessing a Vietnamese subsidiary's data are often treated as "internal to the group, no contract needed" — wrong. Legally these are independent legal entities, and the relationship must be governed in writing.

Item 4: Map every cross-border personal data transfer ☐

• Action: List every instance of personal data leaving Vietnam's territory, measured against the three cases in Article 20.1 of Law 91/2025/QH15: (a) transferring data stored in Vietnam to storage systems located outside Vietnam; (b) transferring data to overseas organizations or individuals; (c) using offshore platforms to process data collected in Vietnam. Typical FDI scenarios: group ERP/HRM/CRM hosted on servers in Singapore, the US or the EU; foreign clouds (AWS, Azure, Google Cloud regions outside Vietnam); remote parent-company access to HR reports; IT outsourcing to foreign vendors.
• Why it matters: Unassessed cross-border transfer carries the Law's heaviest sanction tier: up to 5% of the preceding year's revenue for an organization (Article 8.4). It is also technically easy for authorities to verify (IP addresses, cloud contracts, access logs).
• How to do it: Review cloud/ERP/SaaS contracts (check data regions), ask IT about server locations and the parent's remote access rights, audit foreign admin accounts on company systems. Each confirmed transfer flow leads to Item 9.
• Watch out: One important exemption: storing the personal data of the organization's own employees on cloud services is exempt from the assessment procedure (Article 20.6(b)). But exemption from procedure does not mean exemption from protection — the data must still be secured and the cloud provider must meet equivalent standards.

B. Consent and data subject rights

Item 5: Standardize consent mechanisms under Article 9 ☐

• Action: Audit every data collection form (employment contracts, application forms, customer registration forms, website/app terms) and ensure consent meets Article 9 of Law 91/2025/QH15: (i) voluntary and informed — the subject must know the data types processed, the processing purposes, the controller/controller-processor, and their own rights and obligations (Clause 2); (ii) expressed in a clear, specific manner that can be printed or copied in writing, including electronic or verifiable formats (Clause 3); (iii) observing four principles — separate consent per purpose, no bundling of unrelated purposes as a condition, effective until the subject changes it or as prescribed by law, and crucially: silence or non-response does not constitute consent (Clause 4).
• Why it matters: This is the foundational obligation and the most common violation. Pre-ticked "I agree to all terms" boxes, bundling marketing consent into the main contract, or assuming "no objection means consent" — all are invalid under Article 9.4. In an inspection, the company must prove the subject consented, not the other way around.
• How to do it: Split each purpose into an independent checkbox (e.g., order processing / promotional messages / sharing with partners — three separate boxes, unticked by default). Store consent evidence (scans, timestamped system logs, confirmation emails) in retrievable form.
• Watch out: Consent obtained under Decree 13/2023/ND-CP before the Law's effective date remains valid without re-consent (Article 39.1) — but only within the consented purposes. New purposes require fresh consent. Separately, the Law lists cases where processing does not require the data subject's consent (Article 19 of Law 91/2025/QH15) — cross-check them to avoid over-collecting consent where an exemption applies, or missing consent where none applies.

Item 6: Build a process for receiving and handling data subject requests ☐

• Action: Establish intake channels (dedicated email, website form) and an internal procedure for the six groups of data subject rights in Article 4.1: to be informed about processing; to consent, refuse or withdraw consent; to access and rectify data; to request provision, erasure, restriction or to object to processing; to complain, denounce, sue and claim damages; to request protective measures. The procedure must name the receiver, internal handling deadlines, and the mechanism for cascading requests to processors/vendors.
• Why it matters: Article 4.5 requires controllers to act on data subject requests "promptly" and "within the time limit prescribed by law" — with the Government tasked to detail those limits. Without a procedure, withdrawal or erasure requests will be mishandled and deadlines missed. Withdrawal/restriction requests must be in writing (including electronic form) and sent to the controller (Article 10.2).
• How to do it: Issue a 1–2 page SOP: who receives the request → verify the requester's identity (to avoid erasing the wrong person's data) → classify (access/rectification/erasure/withdrawal/objection) → execute across each system → notify the subject of the outcome. Train reception, customer service and HR — they are the usual first points of contact.
• Watch out: Withdrawal of consent has no retroactive effect on prior processing (Article 10.4). And where erasure is impossible for legitimate reasons, the company must inform the subject (Article 14.5) — silence is not an option.

Item 7: Issue and publish a personal data protection policy ☐

• Action: Draft and publish a privacy policy on the website, at the office and in internal labor regulations: data types collected, purpose per type, retention periods, data subject rights and how to exercise them, contact details of the responsible unit, and the complaint mechanism. For marketing, add a clear advertising opt-out: processing data for advertising requires customer consent on the basis of the customer knowing the content, method, form and frequency of product introductions, plus a means to refuse advertising (Article 28.3); when a customer requests to stop, the company must provide the mechanism and stop immediately (Article 28.5).
• Why it matters: A published policy is the first evidence of transparency compliance — inspectors read it first. A missing policy, or a generic template that does not reflect actual processing, is a heavy demerit in any inspection.
• How to do it: Draft the policy from the actual inventory (Item 1), not a generic template. Translate into English (and Chinese if you have Chinese customers/partners) with equivalent content. Link the policy in the website footer and in every data collection form.
• Watch out: The policy must match reality — promising "no sharing with third parties" while still feeding data to a marketing vendor creates self-incriminating evidence.

C. Mandatory compliance dossiers

Item 8: Prepare, store and file the personal data processing impact assessment within 60 days ☐

• Action: The personal data controller (or controller-processor) prepares a personal data processing impact assessment dossier (DPIA — analysis and assessment of risks that may arise during processing, to apply risk-mitigation measures, per Article 2.12), keeps it on file, and sends one original to the specialized personal data protection authority within 60 days from the first day of personal data processing (Article 21.1). Data processors prepare and keep dossiers as agreed with the controller (Article 21.3).
• Why it matters: This is the Law's central filing obligation — the closest thing to a "data operating license". Failure to prepare or timely file is a standalone administrative violation; and when an incident occurs, the absence of a DPIA leaves the company unable to show it assessed risks in advance. Note: companies already processing data before 1 January 2026 count the 60 days from the Law's effective date — that deadline has long passed.
• How to do it: The dossier covers: description of processing activities, data types, risk assessment, mitigation measures adopted and planned. Dossier contents, conditions, order, procedures and templates are detailed in Article 19 of Decree 356/2025/ND-CP (effective from 01/01/2026) — cross-check the corresponding templates in the Decree's appendices before finalizing. File the original with the specialized authority (under the Ministry of Public Security — Article 33.1(a)) and keep the receipt.
• Watch out: The assessment is done once for the organization's entire operating life, but must be updated when things change (Article 21.2; see Item 14). DPIA dossiers already received by the specialized authority before the Law's effective date remain valid without re-filing (Article 39.2).

Item 9: Prepare the cross-border transfer impact assessment dossier ☐

• Action: For each cross-border transfer identified in Item 4 (except the Article 20.6 exemptions), prepare a cross-border personal data transfer impact assessment dossier and send one original to the specialized personal data protection authority within 60 days from the first transfer (Article 20.2). This assessment is done once for the organization's operating life and updated under Article 22.
• Why it matters: As noted in Item 4, unlawful cross-border transfer carries a cap of 5% of the preceding year's revenue (Article 8.4) — the highest in the Law's sanction ladder. The specialized authority may also conduct periodic inspections (no more than once a year) or ad-hoc inspections upon detecting violations or a data leak/loss incident (Article 20.4), and may order suspension of transfers where data is used in activities that may harm national defense or security (Article 20.5).
• How to do it: The dossier should analyze: what data is transferred, to whom, whether the receiving country offers equivalent protection, and safeguards (encryption, contracts, access controls). Contents, conditions, order, procedures and templates are detailed in Article 20 of Decree 356/2025/ND-CP (effective from 01/01/2026) — cross-check the corresponding templates in the Decree's appendices before filing. Multinational groups should prepare one framework dossier covering all parent-bound flows rather than fragmented per-system filings.
• Watch out: Distinguish the Article 20.6 exemptions carefully: (a) transfers by competent state agencies; (b) storage of the organization's own employees' data on cloud services; (c) transfers by the data subject themselves; (d) other cases prescribed by the Government. An employee emailing work files abroad as part of company operations is not (c) — do not confuse the two.

Item 10: Review and standardize contracts with processors and service providers ☐

• Action: Review all contracts with parties processing data on the company's behalf (IT vendors, payroll/HR outsourcing, marketing agencies, cloud storage, parent companies providing shared services) and add personal data processing clauses satisfying Article 37: controllers must clearly state parties' responsibilities, rights and obligations in relevant agreements/contracts (Clause 1(a)) and select suitable processors (Clause 1(đ)); processors may only receive data under an agreement/contract, must process strictly per contract, and are liable to the controller for damage (Clause 2).
• Why it matters: When a vendor leaks data, the controller remains liable to data subjects for processing-related damage (Article 37.1(g)) — blame cannot be shifted to the vendor. A tight contract is the only tool to allocate risk, compel the vendor to apply safeguards, notify incidents promptly, and indemnify for breaches.
• How to do it: Add a data processing addendum (DPA) to existing contracts: scope of data processed, purposes, minimum security measures, incident notification within 24 hours, data deletion/return on termination, the controller's audit rights, indemnification.
• Watch out: Shared-services agreements with the parent/group are typically generic framework contracts with no data clauses at all — the most common gap at FDI companies.

D. People, technology and retention

Item 11: Appoint a personal data protection unit/personnel or engage a professional service ☐

• Action: Implement Article 33.2: designate an internal unit and personnel with adequate personal data protection competence (DPO), or engage an organization or individual providing personal data protection services. It is recommended — though not legally required — to publish the appointee's name, title and contact details in the privacy policy, as the contact point for data subject requests and for regulators.
• Why it matters: The Law does not permit "everyone is responsible so no one is responsible". When an incident occurs or regulators come knocking, the company needs an accountable contact. For sensitive data, Decree 356/2025/ND-CP further requires access-restriction rules (Article 4.2) — impossible without someone in charge.
• How to do it: Medium and large companies: appoint a DPO (may be a dual-hat from legal/IT, but must be trained and appointed in writing). Small companies: outsource to a qualified consultancy under Article 33.2 — with a service contract defining scope. Publish the DPO's contact details on the website and in the policy.
• Watch out: See our analysis of personal data protection personnel and functions for sizing the right model. Small enterprises/startups may opt out of this obligation for 05 years (Article 38.2), except in the excluded cases — but FDI companies typically exceed the exclusion thresholds (100,000 data subjects or more under Article 41 of Decree 356/2025/ND-CP, or sensitive data).

Item 12: Deploy technical safeguards and set retention periods with secure deletion ☐

• Action: Implement synchronized institutional, technical and personnel measures to protect personal data (Article 3.4): encrypt sensitive data, enforce least-privilege access, require multi-factor authentication for systems holding personal data, maintain access logs, back up data with a recovery plan. In parallel, issue retention schedules per data type under the principle of storage "for a period appropriate to the processing purpose" (Article 3.3), with secure deletion/destruction procedures when purposes end, retention expires, or subjects request erasure (Article 14).
• Why it matters: Breaches of protection principles (off-purpose processing, inaccurate data, over-retention, failure to proactively prevent) draw fines of VND 20–40 million per organization under Article 39 of Decree 330/2026/ND-CP. Deletion must use safe measures preventing unauthorized recovery (Article 14.3) — hitting "delete" in a spreadsheet does not qualify.
• How to do it: IT and legal jointly build a retention matrix: data type — retention period — legal basis (e.g., HR records under labor/tax law; customer data under contractual limitation periods). Set automated alerts for overdue data. Apply heightened technical standards to sensitive data under Article 34, with restricted access per Decree 356/2025/ND-CP.
• Watch out: Two deletion milestones most often missed: (i) unsuccessful candidates' data must be erased/destroyed absent a separate agreement (Article 25.1(c)); (ii) employees' data must be erased/destroyed upon contract termination, except as agreed or otherwise prescribed by law (Article 25.2(c)). Keeping data "just in case" is a violation.

E. Monitoring and incident response

Item 13: Build an incident response plan around the 72-hour rule ☐

• Action: Issue a written incident response plan: detection → severity assessment → containment and remediation → notification → minutes → lessons learned. The core is Article 23: upon discovering a personal data protection violation that may harm national defense, security, social order and safety, or infringe the life, health, honor, dignity or property of data subjects, the controller/controller-processor/third party must notify the specialized personal data protection authority no later than 72 hours from discovery; a processor discovering the violation must promptly notify the controller. Minutes confirming the violation must be drawn up, with cooperation extended to the specialized authority (Article 23.2).
• Why it matters: The 72 hours run from discovery, not from when the incident occurred — but without a procedure, the company will spend weeks establishing when "discovery" happened, and every subsequent explanation will be weak. The plan must also cover notifying affected subjects where sectoral rules require it (e.g., disclosure/loss of bank account, financial or credit information must be notified to the subject — Article 27.1(d)).
• How to do it: Form a response team (legal, IT, communications, management) and run tabletop exercises at least annually with ransomware/customer-database-leak scenarios. Pre-draft the authority notification template (notification contents are detailed by the Government — Article 23.5) and the data subject notice template. Contractually require vendors to report incidents to the company within 24 hours.
• Watch out: See our detailed guide on personal data breach response to prepare playbooks per incident type. Do not wait for a real incident to write the plan — that is the costliest mistake.

Item 14: Set a periodic review calendar, update dossiers and track sanctions ☐

• Action: Put data compliance on the corporate governance calendar: (i) update impact assessment dossiers (both domestic processing and cross-border) every 06 months when changes occur, and immediately in the three Article 22.2 cases — reorganization/termination/dissolution/bankruptcy; changes to the personal data protection service provider's information; new or changed data-related business lines registered in the dossier; (ii) re-run this entire checklist at least annually or upon major changes; (iii) monitor new Government/Ministry of Public Security guidance.
• Why it matters: Data compliance is not a one-off project. An outdated DPIA (e.g., still naming a replaced cloud vendor) both breaches the update duty and is worthless as evidence. On sanctions, Decree 330/2026/ND-CP (effective 19 August 2026) has now quantified penalties: a VND 3 billion cap for other violations, 5% of the preceding year's revenue for cross-border violations, 10 times illegal proceeds for buying/selling personal data (Article 8 of Law 91/2025/QH15; Article 7 of Decree 330/2026/ND-CP provides that Section 6, Chapter II fines apply to organizations, with individuals fined at half).
• How to do it: Task the DPO (Item 11) with reminders: dossier updates, risk reassessments, access-right reviews, incident drills. Each dossier update is made on the National Portal on Personal Data Protection or at the specialized authority (Article 22.3), with receipts kept.
• Watch out: Reorganization/merger/dissolution, changes to your personal data protection service provider's information, or new/changed data-related business lines are precisely the three immediate-update triggers under Article 22.2. Routine ERP or vendor switches are handled in the 06-month periodic review. Wire this checklist into the company's change-management approval flow so nothing slips through.

3. Common mistakes when self-applying this checklist

1. Pre-ticked consent boxes bundling multiple purposes into one. A direct breach of Article 9.4 (silence/non-response is not consent; consent must be purpose-specific). Fix: separate unticked boxes per purpose, with timestamped consent logs.

2. Filing the impact assessment once, then "closing the drawer". Changing ERP or switching cloud vendors without updating in the 06-month review cycle, or adding a data-related business line without updating immediately, breaches Article 22. Fix: embed the dossier-update duty in the company's change-approval process; DPO reviews every 06 months.

3. Using foreign cloud/ERP for customer data without a cross-border dossier. Many FDI companies assume "group systems are internal" — but Article 20.1(c) treats using offshore platforms to process Vietnam-collected data as a cross-border transfer, with penalties up to 5% of revenue. Fix: map transfer flows (Item 4) and file under Item 9; only employee data stored on cloud is exempt from the procedure (Article 20.6(b)).

4. Retaining candidate files and ex-employee data indefinitely. Breaches Article 25 (erase unsuccessful candidates' data; erase employee data on contract termination, except as agreed or prescribed by law). Fix: set specific retention periods with periodic deletion routines; every exception needs a written agreement with the individual.

5. No incident response plan and no accountable contact. When a leak occurs, the company spends days figuring out who reports to whom, missing the Article 23 72-hour mark. Fix: issue a response plan, designate a DPO/contact (Article 33.2), and drill at least annually.

4. After completing the checklist

When all 14 items reach ☑ with complete evidence, the company is at baseline compliance under Law 91/2025/QH15. Next steps: (i) maintain the periodic review calendar from Item 14; (ii) run data-protection awareness training for all staff at least annually — human error causes most incidents; (iii) conduct a full reassessment upon major system, key-personnel or regulatory-guidance changes.

Legal review is mandatory when: complex cross-border flows are discovered (multiple countries, sensitive data); an actual data leak occurs; regulators request a working session or inspection; or the company operates in regulated sectors (finance-banking, healthcare, insurance, telecom) with additional duties under Articles 26–27 of Law 91/2025/QH15.

FLAT LAW FIRM supports FDI companies with end-to-end Personal Data Protection Law compliance reviews: data inventory and classification, impact assessment dossiers, consent and policy standardization, and 72-hour incident response planning. Contact our hotline at 0988424851.

5. Frequently asked questions

Does the Personal Data Protection Law apply to a foreign parent/group with no legal entity in Vietnam? Yes. Under Article 1.2(c) of Law 91/2025/QH15, the Law covers foreign agencies, organizations and individuals that directly participate in or are involved in processing personal data of Vietnamese citizens, even without a Vietnamese presence. A parent accessing HR or customer data in Vietnam via a group ERP falls within scope.

We obtained consent under Decree 13/2023. Must we re-obtain consent under the new Law? No. Article 39.1 provides that ongoing processing activities consented to (or agreed) under Decree 13/2023/ND-CP before the Law's effective date continue without re-consent. The scope is limited to the consented purposes, however — new purposes require fresh consent.

Are small FDI enterprises or startups exempt from preparing impact assessment dossiers? Only within limits. Article 38.2 lets small enterprises and startups opt out of Articles 21, 22 and 33.2 for 05 years from the Law's effective date. The exemption does not apply where the enterprise provides data processing services, directly processes sensitive data, or processes personal data reaching 100,000 data subjects or more on a cumulative basis (Article 41 of Decree 356/2025/ND-CP) — cases most FDI companies fall into.

Does storing employee data on the group's overseas cloud/ERP trigger the cross-border transfer assessment? No — provided it fits the Article 20.6(b) exemption (an organization storing its own employees' data on cloud services). But using an offshore platform to process customer data collected in Vietnam does trigger the duty to prepare an impact assessment dossier and file it within 60 days (Article 20.2).

What is the maximum penalty for violating the Personal Data Protection Law? Under Article 8 of Law 91/2025/QH15: up to VND 3 billion for other violations; up to 5% of the preceding year's revenue for unlawful cross-border personal data transfers; and up to 10 times the illegal proceeds for buying or selling personal data. These caps apply to organizations; individuals face half (Article 8.6; Article 7 of Decree 330/2026/ND-CP).

6. Language versions

7. References

• Law on Personal Data Protection No. 91/2025/QH15 — passed by the 15th National Assembly, 9th session, on 26 June 2025; effective from 01/01/2026.
• Decree 356/2025/ND-CP dated 31 December 2025 detailing the implementation of the Law on Personal Data Protection (replacing Decree 13/2023/ND-CP), effective from 01/01/2026 — Article 3 (basic data catalogue), Article 4 (sensitive data catalogue).
• Decree 330/2026/ND-CP dated 19 August 2026 on administrative sanctions in cybersecurity and personal data protection — effective from 19/8/2026.
• Decree 13/2023/ND-CP dated 17 April 2023 on personal data protection — superseded upon Decree 356/2025/ND-CP's effectiveness; transitional rules under Article 39 of Law 91/2025/QH15.