Personal data protection: the new legal framework and the obligations of enterprises.

1. Enterprises need to know their data, their role and their exemptions

Vietnam has moved personal data protection from decree-level rules to a dedicated law. This is more than a change of form: a law can set very high fines, allows fines calculated as a share of revenue, and lays the foundation for sector-specific rules on employee data, financial customer data and advertising data.

An enterprise should answer three questions first: is the data it processes basic or sensitive, what legal role does it hold in each data flow, and does it qualify for an exemption from certain obligations?

2. The scope of sensitive data has widened significantly

2.1. Basic personal data covers ordinary identifying information

Basic personal data comprises full name and other names used; date of birth; date of death or of disappearance; sex; place of birth, place of birth registration, place of permanent residence, place of temporary residence and current place of residence; native place; contact address; nationality; personal image; telephone number; personal identification number; vehicle registration number; passport number; driving licence number; marital status; information on family relationships, comprising parents, children and spouse; data reflecting activities and the history of activities in cyberspace; and digital account.

Compared with Decree No. 13/2023, this list drops the identity card number, tax code, social insurance number and health insurance card number, because they are now part of the personal identification number. It adds information on marital relationships.

2.2. Behavioural and transaction data is now sensitive

Sensitive personal data comprises political and religious views; health status and private life recorded in medical records, other than information on blood group; racial and ethnic origin; genetic characteristics; distinctive physical and biological attributes; biometric data; sexual life and sexual orientation; data on criminal offences and on legal proceedings; customer information held by credit institutions, foreign bank branches and providers of payment intermediary services, comprising identification information, accounts, deposits, deposited assets, transactions and guarantor organisations; data on the location of an individual determined through positioning services; and other data that the law classifies as particular in nature and as requiring necessary protection measures.

The change with the greatest impact on e-commerce and digital advertising. Decree No. 356 extends sensitive data to data on unlawful conduct, data in the securities and insurance sectors, login information and transaction history, and data tracking behaviour and the use of telecommunications, social network and online services.

As a result, browsing behaviour data used for targeted advertising must now meet the standard for sensitive data, with stricter requirements on consent and on the impact assessment dossier.

Conversely, anonymised data is no longer personal data. This gives enterprises a legal basis to narrow their compliance obligations by technical means.

3. Most enterprises are both controller and processor

In practice, most Vietnamese enterprises are a Personal Data Controller and Processor, because they set the purposes and run the systems themselves. Classifying the enterprise as a Controller only is a common mistake in preparing dossiers and leads to a wrong assessment of its obligations.

4. Consent must meet strict conditions and be evidenced

4.1. Consent is valid only if it meets all the conditions

• Consent must be voluntary. The data subject must clearly know the type of data, the purposes of processing, who may access and process the data, and their own rights and obligations.
• Consent must be clear, specific and verifiable, for example in writing, by voice, by ticking a box, by a message in a set format, or by choosing a technical setting.
• Consent must be in a format that can be printed and reproduced in writing, even when given electronically.
• Silence or a failure to respond does not constitute consent.
• Consent must be obtained separately for each purpose. One tick box covering several purposes is invalid.
• An enterprise may not make consent the default, or present consent and refusal in a way that confuses them.
• An enterprise may not refuse a service just because the data subject refuses processing of data the service does not need.

A new obligation under Decree No. 356/2025. An enterprise must keep evidence of consent so that both the time and the content of the consent can be verified. This is a specific technical requirement, not a general principle, and most systems now in use do not yet meet it.

A data subject may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

4.2. Some processing does not require consent

An enterprise may process personal data without consent in the following cases: to protect the life, health, honour, dignity, and lawful rights and interests of the data subject or of another person in an emergency situation; to serve the prevention of and response to threats to national security, social order and safety, riot, terrorism, crime and breaches of the law; to serve the operations of State agencies in accordance with specialised legislation; to perform obligations under a contract between the data subject and the relevant agency, organisation or individual; and other cases provided for by law.

An exemption from consent is not an exemption from compliance. Even in the cases above, an enterprise must still have internal processes and rules on data processing, a supervision mechanism, periodic risk assessment and a way to receive complaints and reports.

5. Response times to data subjects now vary by type of request

Data subjects' core rights comprise the right to be informed; the right to give and to withhold consent; the right to access, view and correct data; the right to withdraw consent; the right to have data deleted; the right to restrict processing; the right to object to processing; the right to request the provision of data; the right to lodge complaints, report violations and initiate legal proceedings; the right to claim damages; and the right of self protection.

Response times now vary. Decree No. 13/2023 set a single 72-hour limit for all requests; Decree No. 356/2025 sets different limits by type of request:

Set internal deadlines shorter than these, because verifying the requester's identity and reviewing the systems both count towards the statutory limits.

6. Enterprises must prepare and file an impact assessment within 60 days

This obligation is set by Law No. 91/2025 and Decree No. 356/2025/ND-CP.

Compared with Decree No. 13/2023, Decree No. 356 adds a data protection policy and procedures and a detailed data flow diagram to the dossier. The data flow diagram takes the most effort and should be built first, because every other compliance step builds on it.

7. Cross-border transfers require a separate assessment dossier

An enterprise transferring personal data abroad must prepare an impact assessment dossier for transferring personal data abroad. It is separate from the processing impact assessment dossier.

• Contents: the impact assessment report on the transfer abroad, a copy of the transfer contract or agreement, and the recipient's data protection policy.
• The transfer agreement must state the purpose, the types of data, the processing period, each party's responsibilities and the security measures.
• Sensitive data must be encrypted or anonymised during the transfer.
• Filing deadline: 60 days from the start of the transfer. The authority responds within 15 days.

Exemptions from the transfer impact assessment, widened by Decree No. 356, cover press activities, lawfully published data, emergencies, cross-border human resources management within the same group, and documents for international transactions.

The group HR exemption matters greatly to foreign-invested enterprises: sending HR data to the parent company is the most common flow of all and used to need its own dossier.

8. Data breaches must be notified within 72 hours

An enterprise must notify the specialised personal data protection authority within 72 hours of detecting a breach that may affect national security, social order and safety, or data subjects' lawful rights and interests. A notification after 72 hours must give the reasons for the delay.

The notification must describe the breach, the types of data and number of data subjects affected, its seriousness, consequences and damage, the remedial measures taken and planned, the guidance given to data subjects, and the contact details of the responsible unit.

Decree No. 356/2025 adds a duty to notify the data subject directly within 72 hours if the breach involves location or biometric data. Breach records must be kept for at least 5 years.

9. Data protection staff must meet set standards

For the first time, the law sets qualifications for data protection staff. Decree No. 13/2023 had no such standards.

Internal staff: a college degree or higher; at least 2 years' experience in legal affairs, IT, cyber security, data security, risk management or compliance; and training in the law and practice of personal data protection.

Outsourcing is allowed. An enterprise may use a qualified data protection service provider with at least 3 years' experience and capability in technology, legal advice or information security. It may also combine internal staff with outsourced services.

Providing personal data processing and protection services as a business requires a certificate of eligibility. Decree No. 356 says these services include credit scoring, encryption, big data, artificial intelligence and blockchain.

9.1. Small enterprises enjoy a conditional exemption

The exemption is lost in three cases: the enterprise does personal data processing as a business; it processes sensitive personal data; or it processes the data of 100,000 or more data subjects.

Because of the 100,000 threshold and the sensitive data test, many small e-commerce, mobile app and online service businesses do not actually benefit from the exemption, even though they meet the size test. Check this early instead of assuming the exemption applies.

10. Some activities have their own rules

10.1. Employee data is governed at each stage of employment

The law sets three obligations, one for each stage of employment:

• Recruitment: the enterprise may ask only for information needed for recruitment. If a candidate is not hired, it must delete or destroy the candidate's data, unless the parties agree otherwise.
• During employment: the enterprise must get the employee's consent before collecting data by technological means, such as monitoring, biometric time-keeping, location tracking and supervision of work devices.
• On termination: the enterprise must delete or destroy the employee's personal data, unless the law or the parties' agreement provides otherwise.

The rule on unsuccessful candidates directly affects the practice of keeping CVs for future hiring. An enterprise that wants to keep them needs a separate agreement with the candidate stating how long it will keep them.

10.2. Advertising services that use personal data may not be subcontracted

An enterprise may not delegate or subcontract advertising services that use personal data to a third party, must tell customers clearly how often they will receive advertising, and must let customers opt out.

Since behavioural data is now sensitive, programmatic advertising chains with several tiers of intermediaries are the model most affected by the new rules.

10.3. Social networks may not require ID images to verify accounts

Social networks and online services may not require users to upload images or videos of all or part of their identity documents to verify an account, and may not record or eavesdrop without consent. Platforms must publish a data protection policy, offer do-not-track and cookie refusal options, and let users access, correct and delete their data.

10.4. People recorded in public places must be notified

People recorded on audio or video in public places must be notified, with exceptions where consent is not needed, such as security and order, press activities and public events. An enterprise with cameras in customer and work areas should review both its signs and how long it keeps the footage.

10.5. Data of children aged 7 or older needs parental consent

Disclosing the data of a child aged 7 or older requires the consent of the child's parents or guardian.

11. Some fines can be calculated on revenue

11.1. The Law sets three different caps

Law No. 91/2025 sets three different caps. Cite this primary source accurately:

On revenue-based fines. The 5% of previous-year revenue cap applies only to unlawful transfers of data abroad. It is not a general fine level for every personal data breach.

11.2. Decree No. 330/2026/ND-CP sets the specific fines

Decree No. 330/2026/ND-CP took effect on 19 August 2026 and covers both cyber security and personal data protection. Unlike the labour sanctioning decrees, its fines apply to organisations, and an individual is fined half the amount for an organisation. The limitation period for sanctions is 1 year.

Beyond fines, an enterprise may face additional sanctions: withdrawal of a licence for 1 to 24 months, suspension of operations for 1 to 24 months, confiscation of exhibits and means, and expulsion of foreign nationals. Remedies include compulsory deletion of unlawfully collected data and surrender of unlawful proceeds.

Employee data breaches have their own, high fines, which signals that this area will be watched. Enterprises tend to focus on customer data and overlook internal data, yet biometric time-keeping and employee monitoring software are where breaches most easily occur.

11.3. There is no separate criminal offence yet

The current Penal Code has no separate offence for personal data. Draft amendments propose offences of infringing personal data, unlawfully buying and selling it, and obstructing data protection activities, but these are still drafts and have not been adopted.

12. Data localisation comes from cyber security law

The requirement to store data in Vietnam comes from cyber security law, not the Law on Personal Data Protection. Two changes should be noted:

• The Law on Cyber Security No. 116/2025/QH15 took effect on 1 July 2026. It merges and replaces the Law on Network Information Security 2015 and the Law on Cyber Security 2018.
• Decree No. 333/2026/ND-CP took effect on 19 August 2026 and replaces Decree No. 53/2022/ND-CP.

The domestic storage obligation applies to domestic enterprises and to foreign enterprises supplying services on telecommunications networks, on the Internet and value added services in cyberspace in Vietnam, in respect of the personal information data of service users in Vietnam, data generated by users, and data on users' relationships. Under the mechanism currently in force, this obligation arises upon a written request from the Ministry of Public Security, and does not apply automatically to every enterprise.

13. Earlier consents and dossiers remain valid

The law sets two transitional rules that favour enterprises:

• Processing based on valid consent obtained under Decree No. 13/2023 before 1 January 2026 may continue, and consent need not be obtained again.
• Impact assessment dossiers prepared or filed under Decree No. 13/2023 remain valid. If a dossier is updated after 1 January 2026, the new rules apply.

An enterprise that has complied with Decree No. 13/2023 therefore does not have to start again from the beginning, but does need to review its position in order to add the new obligations, in particular the retention of evidence of consent, the standards applicable to the personnel responsible, and the reclassification of data against the widened list of sensitive categories.