🇻🇳Law No. 91/2025/QH15 on Personal Data Protection
Law No. 91/2025/QH15 on Personal Data Protection
The Law applies to Vietnamese bodies and individuals, foreign bodies and individuals in Vietnam, and foreign actors directly involved in or connected with processing personal data of Vietnamese citizens and stateless persons residing in Vietnam who hold Vietnamese identity certificates. Read it with current implementing Decree No. 356/2025/NĐ-CP, which replaced Decree No. 13/2023/NĐ-CP from 1 January 2026.
Core operational duties
Principles, consent and rights: Articles 3-4 require purpose limitation, accuracy, limited storage, safeguards and facilitation of rights. Article 9 requires voluntary and informed consent for each purpose in a reproducible form and rejects silence as consent.
Correction, deletion and restricted processing: Articles 10 and 13-14 govern withdrawal, restriction, correction, deletion, destruction and safe prevention of unlawful recovery.
Transfers and assessments: Article 20 requires a cross-border impact-assessment dossier and submission within 60 days of the first transfer, subject to stated exemptions. Article 21 applies a similar 60-day rule to processing impact assessments. Article 22 requires updates every six months when information changes and immediate updates for specified events.
Incidents: Article 23 requires notice to the specialised agency within 72 hours after discovery where the violation may cause the listed national, public-order or individual harms; processors must promptly notify the controller.
People and vendors: Article 33 requires a qualified internal function or personnel, or an external service. Article 37 requires controller-processor agreements, appropriate safeguards, compliant instructions and vendor selection.
Article 38 gives qualifying small and start-up enterprises a five-year election concerning Articles 21, 22 and 33(2), and exempts qualifying household businesses and micro-enterprises. Decree No. 356/2025 supplies the classification detail, including the 100,000-data-subject large-scale threshold, and preserves the exclusions for data-processing services and sensitive or large-scale processing.