Vietnam. Comprehensive data protection. Law
PDPL (Vietnam)Law on Personal Data Protection (Law No. 91/2025/QH15)
In force
§1Summary
- Synopsis
Vietnam's first statute-level personal data law, replacing Decree 13/2023. It is consent-centred, requires filed processing and transfer impact assessments with A05, and allows revenue-based fines.
- Key themes
- Unique features
DPIAs and TIAs must be filed with the police cybersecurity department within 60 days; selling personal data can be fined at ten times the proceeds.
- SaaS relevance
Foreign SaaS processing Vietnamese data, or transferring it abroad, must file assessments with A05.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Authority within 72h of detection for qualifying violations
- DPO
- Yes
- Cross-border transfers
- TIA filed with A05 within 60 days (exemptions apply)
- Maximum penalty
- 5% of prior-year revenue (cross-border violations); 10x proceeds for data sales; otherwise VND 3bn
§3Dates
- Key dates
- Adopted
- In force
- Implementing Decree 356/2025/ND-CP issued 2025-12-31; sanctioning decree pending; 5-year exemptions for qualifying small enterprises
§4Text and authority
- Text
- Authoritative text vanban.chinhphu.vn
- English text english.luatvietnam.vn
- Authority
- Ministry of Public Security – Department of Cybersecurity and High-tech Crime Prevention (A05)
§5Where it applies
- Domestic law of
- Vietnam
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Fines need sanctioning decree before use. [Link: official Vietnamese (Government legal docs portal; PDF datafiles.chinhphu.vn/cpp/files/vbpq/2025/7/91qh.signed.pdf); LuatVietnam English]