Since 1 January 2026, Vietnam’s Personal Data Protection Law No. 91/2025/QH15 has taken effect, replacing Decree 13/2023/ND-CP. For the first time, Vietnam has a comprehensive statute governing the full lifecycle of personal data — from collection and processing to storage, erasure and destruction — and every business handling customer, employee or partner data falls within its scope.
This article systematizes the 10 core obligations businesses must implement immediately under Law 91/2025/QH15, Decree 356/2025/ND-CP (implementing guidance, effective the same day, 1 January 2026) and Decree 330/2026/ND-CP (administrative sanctions, effective 19 August 2026).
1. The new legal framework since 1 January 2026
- Personal Data Protection Law 91/2025/QH15 (passed 26 June 2025, effective 1 January 2026): rights of data subjects, obligations of processing parties, prohibited acts (Article 7: trading in personal data; appropriating, deliberately disclosing or losing data);
- Decree 356/2025/ND-CP (issued 31 December 2025, effective 1 January 2026): detailed guidance, fully replacing Decree 13/2023/ND-CP;
- Decree 330/2026/ND-CP (issued and effective 19 August 2026): administrative sanctions for cybersecurity and personal data protection violations.
Note: any compliance documents, contracts or privacy policies still citing Decree 13/2023/ND-CP as the current basis are outdated and must be updated.
2. Ten obligations businesses must implement now
Obligation 1 — Obtain valid consent and prove it: consent must be clear, voluntary and given for each specific processing purpose. Businesses must retain consent records and bear the burden of proof in disputes or inspections. Pre-ticked consent boxes and confusing consent interfaces are prohibited (Article 6, Decree 356/2025/ND-CP).
Obligation 2 — Notify data subjects: before or at collection, inform subjects of the purposes, data categories, data recipients, their rights and contact channels.
Obligation 3 — Handle data-subject requests on time: respond to requests within 2 working days; execute consent withdrawal, processing restriction or objection requests within 15 days; view, rectification and data-provision requests within 10 days; erasure requests within 20 days (Article 5, Decree 356/2025/ND-CP).
Obligation 4 — Prepare data processing impact assessments: compile, retain and update impact assessment dossiers (Article 21, Law 91/2025/QH15); update every 6 months or immediately upon changes in purposes, processors or third parties.
Obligation 5 — Assess cross-border transfers: every outbound transfer of personal data requires a dedicated impact assessment dossier, filed with the Department of Cybersecurity (A05) within 60 days of the first transfer (Articles 20 and 22, Law 91/2025/QH15).
Obligation 6 — Appoint data protection personnel or hire a service: designate qualified in-house staff (college degree or higher, at least 2 years of experience in legal affairs, IT or cybersecurity) or engage an external data protection service provider (Article 33.2, Law 91/2025/QH15; Article 13, Decree 356/2025/ND-CP).
Obligation 7 — Report breaches within 72 hours: upon a personal data protection violation, notify the Department of Cybersecurity and High-Tech Crime Prevention (A05) under the Ministry of Public Security within 72 hours of the violation, draw up a written record, and notify affected data subjects (Article 23, Law 91/2025/QH15). Late notification beyond 72 hours may draw fines of VND 40–60 million (Article 54, Decree 330/2026/ND-CP).
Obligation 8 — Apply technical safeguards: access control, encryption of sensitive data, system logging; mandatory multi-factor authentication for large-scale data processing.
Obligation 9 — Erase data when purposes expire: delete unsuccessful job applicants’ data; erase employee data upon termination of the labour contract; never retain data beyond the necessary period.
Obligation 10 — Cooperate with inspections: keep complete dossiers ready for inspection by the specialised data protection authority (A05) — scheduled or unannounced upon signs of violation.
3. A lighter track for small businesses
To ease the compliance burden, Article 41 of Decree 356/2025/ND-CP allows small businesses and startups to opt in or out of obligations 4, 5 (dossier parts) and 6 for 5 years (1 January 2026–31 December 2030); household businesses and micro-enterprises are exempt indefinitely. These reliefs do not apply to businesses trading in data processing services, directly processing sensitive data, or processing data of 100,000 or more data subjects.
4. Frequently asked questions
Q: Our company only keeps a customer mailing list for email marketing. Does the Law apply?
A: Yes. Collecting, storing and using customer emails or phone numbers is “personal data processing” and requires valid consent plus a withdrawal mechanism.
Q: May we skip appointing in-house data protection staff?
A: Yes, if you engage a qualified external data protection service provider — the law permits both models (except where the SME relief in section 3 applies).
Q: What are the fines?
A: They vary by violation, e.g. late breach notification beyond 72 hours: VND 40–60 million; workplace cameras without employee notice: VND 50–70 million (Decree 330/2026/ND-CP). Remedial measures such as data deletion or suspension may also apply.
Need a full compliance review of your personal data protection obligations before the authorities inspect? Contact us for advice.
This article was prepared by the FLAW AI Legal Council. The content is pending QA Council review before submission for approval; information is for reference only and does not replace legal advice for your specific case.
