On June 26, 2025, Vietnam's National Assembly passed the Law on Personal Data Protection No. 91/2025/QH15 (the "PDPL"), effective January 1, 2026. The PDPL replaces Decree No. 13/2023/ND-CP on Personal Data Protection ("PDPD") and establishes a more comprehensive statutory framework, introducing new concepts, exemptions, and obligations while retaining key compliance requirements such as data processing principles, cross-border data transfer regulations, and the need for Data Processing Impact Assessments (DPIAs) and Overseas Transfer Impact Assessments (OTIAs).

Scope of Application

The PDPL applies to domestic entities, organisations, and individuals, as well as foreign entities in Vietnam or those directly engaged in processing personal data of Vietnamese citizens or individuals of Vietnamese origin without a determined nationality residing in Vietnam and holding an identity card. Compared to the PDPD, the PDPL has narrowed its scope with respect to foreign actors — the PDPD applied to foreign entities involved in personal data processing in Vietnam regardless of the nationality of the data subject, whereas the PDPL ties extraterritorial application more specifically to data relating to Vietnamese citizens.

Expanded Definition of Personal Data

Under the PDPL, personal data now includes any information — digital or otherwise — that identifies an individual, expanding beyond the PDPD's focus on electronic formats. Anonymised data is explicitly excluded, encouraging organisations to use anonymisation as a means of reducing compliance obligations.

Categories of Personal Data

The PDPL classifies personal data into two categories — basic personal data and sensitive personal data — as under the PDPD. However, the PDPL does not provide a detailed list; instead, it sets out general definitions and authorises the Government to issue specific lists through implementing regulations.

New Prohibited Acts

In addition to the prohibitions under the PDPD, the PDPL introduces new prohibited acts, including:

Significant Penalties

The PDPL introduces substantial administrative penalties:

These caps apply to organisations. Individual violators face a maximum fine of 50% of the applicable organisational amount.

Processing Without Consent

The PDPL introduces new permissible cases for processing personal data without consent, including: to safeguard life, health, dignity, or legitimate interests of the data subject or others; to respond to emergencies or national security threats; to fulfil state duties; to fulfil contractual obligations; and in other cases specified by sector-specific law. Organisations processing data without consent must implement monitoring measures, including internal procedures, risk assessments, audits, and complaint mechanisms.

Data Breach Reporting

The 72-hour notification period now runs from the time a breach is detected (rather than from when it occurred, as under Decree 13), providing organisations a more practical timeframe to assess and confirm incidents before reporting. Data controllers, combined controller-processors, and third parties must notify the Ministry of Public Security. Processors must also inform controllers promptly.

Data Protection Officers

Organisations must appoint internal data protection staff or a dedicated department, or engage external service providers — providing greater flexibility than under Decree 13, which expected in-house appointments.

DPIA and OTIA Updates

Both DPIAs and OTIAs must be updated every six months where changes occur, or immediately upon major organisational changes (restructuring, bankruptcy, changes in data protection service provider, or introduction of new data-related services). Exemptions from the OTIA requirement include state agencies, organisations storing employee data on cloud computing services, and individuals transferring their own data.

Transition Rules

Small enterprises and start-ups are exempt from DPIAs, OTIAs, and DPO appointment obligations for five years, unless they provide personal data processing services, directly process sensitive personal data, or process data of a large number of data subjects. Household businesses and micro-enterprises benefit from similar exemptions.

Sector-Specific Obligations

The PDPL introduces specific data protection rules across a range of sectors, including: employment (recruiters must limit data use to hiring purposes and delete unsuccessful applicants' data); health and insurance (consent required for data sharing; strict rules for health apps and reinsurance); finance and banking (consent required for credit scoring; breach notification mandatory); advertising (providers must obtain consent, offer opt-outs, and may not fully outsource data services); and social media (platforms must provide "Do Not Track" options and refrain from wiretapping or recording without consent). Additionally, organisations using big data, AI, blockchain, or cloud computing must implement risk-based data protection measures, and tracking of location and biometric data requires explicit consent.