On June 26, 2025, Vietnam’s National Assembly passed the Law on Personal Data Protection No. 91/2025/QH15, effective January 1, 2026 (“PDPL”). The PDPL will replace Decree No. 13/2023/ND-CP on Personal Data Protection (PDPD). The PDPL establishes a more comprehensive and detailed framework for data protection, building on and expanding the provisions of PDPD. It introduces new concepts, exemptions, and obligations, while retaining key compliance requirements such as data processing principles, cross-border data transfer regulations, and the need for Data Processing Impact Assessments (DPIAs) and Outbound Transfer Impact Assessments (OTIAs).

In this article, we provide a summary of its key provisions.

Please click the hyperlink below to download the article in PDF format.

DOWNLOAD