Key takeaways
- Decree 13/2023/ND-CP is no longer in force as of January 1, 2026.
- The current framework is the Personal Data Protection Law No. 91/2025/QH15 and Decree 356/2025/ND-CP.
- Processing and cross-border transfer impact assessments must be filed with the Ministry of Public Security within 60 days and updated every 6 months.
- Fines reach 5% of prior-year revenue for cross-border transfer violations, 10x the proceeds for data trading, and VND 3 billion for other violations.
Legal timeline
| Date | Event |
|---|---|
| Apr 17, 2023 | Decree 13/2023/ND-CP issued |
| Jul 1, 2023 | Decree 13/2023 takes effect |
| Jun 26, 2025 | National Assembly passes Law 91/2025/QH15 |
| Dec 31, 2025 | Government issues Decree 356/2025/ND-CP |
| Jan 1, 2026 | Law 91 and Decree 356 take effect; Decree 13 ceases to be effective |
Who must comply?
- Vietnamese agencies, organizations and individuals processing personal data
- Foreign agencies, organizations and individuals in Vietnam
- Foreign organizations and individuals directly involved in or related to processing Vietnamese citizens' personal data, including SaaS and apps serving Vietnamese users
For IT outsourcing firms, data processed on behalf of overseas clients still needs to be inventoried, because Vietnamese employees, partners and end users may be in the dataset.
Basic vs sensitive personal data
| Type | Examples | Notes |
|---|---|---|
| Basic personal data | Name, date of birth, phone, address, email | Needs a lawful basis, purpose notice and consent management |
| Sensitive personal data | Health, biometric, location, financial, credit, children's data | Stricter safeguards; some sectors must report incidents within 72 hours under Decree 356 |
The detailed lists of basic and sensitive data are set out in Decree 356/2025/ND-CP. Check the official text when classifying data.
Key business obligations
Consent and notice
Consent must be clear, voluntary, revocable and tied to specific purposes. Disclose data types, purposes, retention and recipients.
Data subject rights
Run a process for access, correction, deletion, consent withdrawal and objection requests.
Processing impact assessment
Prepare using Form 02a/02b and file with the Ministry of Public Security's specialized agency within 60 days of starting processing (Decree 356, Art. 19).
Cross-border transfers
Prepare a transfer impact assessment using Form 01a/01b and file it within 60 days of the first transfer (Art. 18). This covers cloud and SaaS hosted overseas.
Keep dossiers current
Update every 6 months from the first filing, and within 10 days of a reportable change (Art. 20).
Data protection personnel
Appoint in writing someone with at least a college degree, 2 years' experience and training, or engage a qualified service provider (Arts. 13, 15, 16).
Incident notification
Build detection and notification workflows. Decree 356 sets 72-hour deadlines for sensitive data in finance, banking and credit information (Art. 8) and for location and biometric data (Art. 29).
Processor contracts
Review contracts with cloud, SaaS and processing partners to allocate responsibilities and safeguards.
Penalties under Law 91/2025/QH15
| Violation | Maximum fine for organizations |
|---|---|
| Trading personal data | 10x the proceeds of the violation, or VND 3 billion if there are no proceeds or 10x the proceeds is lower |
| Cross-border transfer violations | 5% of the previous year's revenue |
| Other violations | VND 3 billion |
Serious cases can lead to criminal liability.
Quick comparison with GDPR
| Aspect | Law 91/2025 (Vietnam) | GDPR (EU) |
|---|---|---|
| Impact assessment | Must be prepared and filed with MPS within 60 days | DPIA kept internally for high-risk processing |
| Cross-border transfers | Transfer impact assessment dossier | Adequacy, SCCs, BCRs |
| Data protection personnel | Specific education, experience and training criteria | DPO mandatory in certain cases |
| Maximum fine | 5% of prior-year revenue (cross-border) | 4% of global turnover or EUR 20 million |
| Supervisory authority | Specialized agency under the Ministry of Public Security | National DPAs in each EU member state |
The Law and international compliance frameworks
If you are implementing any of the frameworks below, most technical and organizational controls can be reused as evidence for Law 91/2025 obligations.
Annex A controls on access, incident management, encryption and supplier management map directly to personal data safeguards.
The Privacy Trust Service Criteria cover consent, data subject rights, incident notification and retention.
Technical Safeguards (access control, audit logs, encryption) support protection of health data, a sensitive category.
Consent, DPIAs, data subject rights and processing agreements can be reused, but Vietnam's dossier forms must still be prepared and filed.
Encryption, access and audit log controls for card data support obligations for sensitive financial data.
Transparency and fairness requirements support governance of personal data processed by AI systems.
Compliance checklist for SaaS, ITO, FinTech and HealthTech
Frequently Asked Questions
Is Decree 13/2023 still in effect?
No. Decree 13/2023/ND-CP ceased to be effective on January 1, 2026. It was replaced by the Personal Data Protection Law No. 91/2025/QH15 (passed June 26, 2025) and Decree 356/2025/ND-CP (issued December 31, 2025), which details the Law. Both took effect on January 1, 2026.
Who does Vietnam's Personal Data Protection Law apply to?
Vietnamese agencies, organizations and individuals; foreign agencies, organizations and individuals in Vietnam; and foreign organizations and individuals directly involved in or related to processing personal data of Vietnamese citizens. SaaS, IT outsourcing, FinTech and HealthTech companies handling Vietnamese customer or employee data are in scope.
What are the penalties under Vietnam's Personal Data Protection Law?
Under Article 8 of Law 91/2025/QH15: illegal trading of personal data is fined up to 10 times the revenue earned from the violation; violations of cross-border transfer rules are fined up to 5% of the previous year's revenue; other violations carry fines of up to VND 3 billion for organizations. Serious cases may lead to criminal liability.
When must impact assessment dossiers be filed?
Under Decree 356/2025/ND-CP, the personal data processing impact assessment (Article 19) and the cross-border transfer impact assessment (Article 18) must be sent to the specialized agency under the Ministry of Public Security within 60 days of starting the processing or transfer. Dossiers are updated every 6 months, and within 10 days of a reportable change (Article 20).
Do companies need a data protection officer?
Decree 356 requires designated data protection personnel to hold at least a college degree, have at least 2 years of relevant experience, have completed personal data protection training, and be appointed in writing (Article 13). Companies may instead engage a qualified data protection service provider under Articles 15 and 16.
How does Vietnam's law differ from GDPR?
Both rely on consent, data subject rights and impact assessments. Key differences: Vietnam requires impact assessment dossiers to be filed with the Ministry of Public Security's specialized agency within 60 days (GDPR DPIAs are kept internally), has its own cross-border transfer regime, and caps fines on Vietnamese revenue rather than global turnover.
