On June 26, 2025, the National Assembly passed the Law on Personal Data Protection No. 91/2025/QH15 (the "PDPL"), which will take effect on January 1, 2026. The PDPL replaces Decree No. 13/2023/ND-CP and introduces a significantly more comprehensive framework for personal data protection in Vietnam. Key highlights are as follows.

Scope of Application

The PDPL applies to domestic entities and individuals, as well as to foreign agencies, organisations, and individuals that are in Vietnam; directly involved in or related to the processing of personal data of Vietnamese citizens; or directly involved in or related to the processing of personal data of individuals of Vietnamese origin who reside in Vietnam, lack identified nationality, but hold an identity card.

Expanded Definition of Personal Data

The PDPL broadens the definition of personal data beyond specific electronic formats to encompass any information — whether digital or in other forms — that can identify an individual, regardless of its format or medium. Anonymised data is explicitly excluded from the definition, providing legal clarity and encouraging the use of anonymisation to reduce compliance obligations.

Categories of Personal Data

The PDPL retains the two-category framework of Decree 13 (basic personal data and sensitive personal data) but does not provide a specific list of data types, instead delegating this to Government-issued lists through implementing regulations.

New Prohibited Acts

In addition to prohibitions carried over from Decree 13, the PDPL introduces the following new prohibited acts:

Administrative Penalties

The PDPL introduces significant penalties for violations:

These caps apply to organisations. Individual violators face a maximum of 50% of the organisational amount.

Data Protection Officers

Organisations must either appoint internal data protection staff or a dedicated department, or engage external service providers — offering greater flexibility than Decree 13.

Cross-Border Data Transfers and DPIA Updates

The PDPL revises the update requirements for OTIAs and DPIAs: periodic updates must be made every six months where changes occur (rather than immediately upon any change, as under Decree 13), with immediate updates required only in specific situations such as restructuring, dissolution, bankruptcy, changes in data protection service providers, or introduction of new data-related business lines.

Data Breach Notification

The 72-hour notification period now runs from the time a breach is detected, rather than from when it occurred — giving organisations a more practical window to assess and confirm incidents before reporting to the Ministry of Public Security. Notification is only mandatory if the breach may affect national security, social order, or the life, health, honour, dignity, or property of the data subject.

Transition Provisions

Small enterprises and start-ups may opt not to comply with DPIA, OTIA, and DPO appointment obligations for a period of five years, unless they provide personal data processing services, directly process sensitive personal data, or process data of a large number of data subjects. Household businesses and micro-enterprises benefit from similar exemptions.

Sector-Specific Highlights

The PDPL introduces or revises data protection rules across multiple sectors. In employment, recruiters must delete unsuccessful applicants' data. In health and insurance, consent is required for data sharing, and strict rules apply to health apps and reinsurance arrangements. In finance and banking, consent is required for credit scoring. In advertising, providers must obtain consent and may not fully outsource data services. Social media platforms must provide "Do Not Track" options and may not wiretap or record communications without consent.