Vietnam Personal Data Protection Law Guide (2026)

Since 1 January 2026 Vietnam has regulated personal data through a full statute, the Law on Personal Data Protection No. 91/2025/QH15, with Decree No. 356/2025/ND-CP replacing Decree No. 13/2023/ND-CP, and since 19 August 2026 the fines have had a sanctions decree behind them. Many compliance programmes still describe the 2023 decree, so their breach clocks, impact assessment filings and transfer dossiers are out of date. This guide covers what is in force now: scope, the core duties, the 72-hour breach notice, the processing and cross-border transfer impact assessment dossiers filed with the Ministry of Public Security, penalties, what the law means for AI agents and machine credentials, and a compliance plan. It is for security, privacy and engineering leads whose systems process data of people in Vietnam or of Vietnamese citizens. For the wider transfer picture, see the International Data Transfers Map.

Key takeaways

A law, not a decree, since 1 January 2026: Law No. 91/2025/QH15 was passed by the National Assembly on 26 June 2025 and took effect on 1 January 2026, the same day Decree 356/2025/ND-CP replaced Decree 13/2023/ND-CP.
72 hours from discovery: Article 23 of the law requires notice to the specialised personal data protection agency within 72 hours of discovering a violation that may harm national security, public order or people's life, health, dignity or property; the clock now runs from discovery rather than occurrence.
Two dossiers within 60 days: a processing impact assessment and, for transfers abroad, a cross-border transfer impact assessment, each filed within 60 days of starting, reviewed within 15 days and updated every six months or within 10 days of listed changes.
Revenue-based fines: up to 5% of prior-year revenue for cross-border transfer violations, up to 10 times the income from selling personal data, and up to VND 3 billion for other violations by organisations.
The Ministry of Public Security runs it: its Department of Cybersecurity and High-Tech Crime Prevention (A05) receives breach notices and dossiers, reviews filings and inspects.

Scope: who and what is covered

The law applies to Vietnamese agencies, organisations and individuals, to foreign organisations and individuals in Vietnam, and to foreign organisations and individuals directly involved in processing personal data of Vietnamese citizens and of people of Vietnamese origin without determined nationality who live in Vietnam and hold an identity certificate. Offshore platforms serving Vietnamese users are therefore in scope. Anonymised data is no longer personal data under the law's definitions.

Element	Position under Law 91/2025 and Decree 356	Note for security teams
Basic personal data	Defined by list in Decree 356; online activity history, tax code, social insurance and health insurance numbers moved out of the basic list	Check where each moved to before classifying
Sensitive personal data	Decree 356 list now includes e-identity account usernames and passwords, images of citizen ID cards, bank account, card and transaction history, health status and behavioural tracking data from online services	Credential stores and identity verification images are sensitive data
Controller, processor, controller-processor	Three roles, with the combined role carrying both sets of duties	Dossier forms distinguish the roles
Third party	Recipients under transfer agreements	Written agreement required (Decree 356)
Regulator	Ministry of Public Security, through A05 as the specialised agency, with a National Portal on Personal Data Protection	Filings and notices go through the portal or to A05

Key obligations

Consent and other bases

Consent remains the main basis. Decree 356 requires it to be explicit and verifiable, with records of when and what was agreed, and prohibits default consent and wording that blurs agreement and refusal. Consent can be given by recorded calls, email, websites and apps with technical consent mechanisms. The law adds exemptions, such as performing contracts and protecting rights against infringement, but its legitimate interest ground is far narrower than the GDPR's. Consent obtained under Decree 13 remains valid for processing that continues.

Data subject requests

Request	Respond within	Complete within	One extension
Withdraw consent, restrict or object	2 working days	15 days	Up to 15 days
Access, correct or provide data	10 days	15 days	Up to 10 days
Delete data	20 days	30 days	Up to 20 days

These timelines, as summarised by EY from Decree 356, replace the 72-hour handling rule many teams carried over from Decree 13.

Security and the data protection function

Controllers must apply protection measures from the start of processing and designate a qualified department and personnel, or engage an external data protection service provider. Decree 356 Article 13 requires a written appointment and an in-house data protection officer with a college degree or higher, at least two years' relevant experience (law, IT, cybersecurity, data security, risk, compliance or HR) and data protection training. External individual providers need three years' experience (Article 15), and provider firms at least three qualified staff (Article 16). Transfers of sensitive data need physical security plus encryption, anonymisation or equivalent safeguards, and internal sharing must be limited to what the purpose needs.

Breach notification

Situation	Who to notify and when	Source
Violation that may harm national security, public order, or life, health, dignity or property	Specialised agency (A05) within 72 hours of discovery; a processor notifies its controller promptly	Law Art. 23(1)
Notice content and channel	Nature of the violation, DPO or provider contact, likely consequences, remedial measures; Form No. 08, to A05 or through the National Portal	Decree 356 Art. 28
Sensitive data leak in finance, banking or credit	Agency and affected data subjects within 72 hours of discovery	Decree 356 Art. 8(3)
Location or biometric data incident	Affected data subjects within 72 hours, plus agency report; public notice allowed where individual notice is not feasible in time	Decree 356 Art. 29
Record keeping	Keep incident records for at least five years after remediation (location and biometric incidents)	Decree 356 Art. 29

Late or deliberately delayed notice can itself be sanctioned. Compare clocks across jurisdictions in the Breach Notification Laws by Country Guide.

Impact assessment dossiers

The processing impact assessment (Law Article 21, Decree 356 Article 19, report on Form No. 10) and the cross-border transfer impact assessment (Law Article 20, Decree 356 Article 18, report on Form No. 09) are each filed within 60 days of starting processing or the first transfer. New under Decree 356, the agency reviews the dossier and responds within 15 days; an incomplete dossier must be completed within 30 days or sanctions may follow. Dossiers are updated every six months where new purposes or parties arise, and within 10 days of reorganisation, dissolution, a change of data protection service provider or a change of business lines (Article 20, Forms 03a and 03b). Dossiers accepted before 1 January 2026 stay valid; later updates follow the new rules. See the DPIA Guide.

Cross-border transfers

Article 20(1) of the law treats three situations as a cross-border transfer: moving data stored in Vietnam to storage systems abroad, a Vietnamese party sending data to an organisation or individual abroad, and using platforms outside Vietnam to process data collected in Vietnam. That third limb catches offshore SaaS, cloud regions and hosted AI models used by a Vietnamese entity. Decree 356 Article 17(3) lists cases that need no transfer dossier, including journalism under the press law, data already published as required by law, emergencies protecting life, health or property, management of cross-border employees under labour rules or collective agreements, and listed transaction cases such as payments, transport, hotel bookings and visa applications. Read the exemptions narrowly and record why one applies. Where personal data is also core or important data under the Law on Data, EY reports that the personal data dossiers are the only assessments required. See the Data Sovereignty and Residency Guide.

Timeline and current status

Date	Instrument or event	Status
17 April 2023	Decree 13/2023/ND-CP issued	Replaced from 1 January 2026
26 June 2025	Law on Personal Data Protection No. 91/2025/QH15 passed	In force
31 December 2025	Decree 356/2025/ND-CP signed	In force
1 January 2026	Law and Decree 356 take effect; Decree 13 replaced	Small enterprises and start-ups have five years to opt into dossier duties
16 to 26 March 2026	Public consultation on the sanctions decree	Closed
19 August 2026	Decree 330/2026/ND-CP on administrative sanctions in cybersecurity and personal data protection issued and effective	In force

SME relief: household businesses and micro-enterprises are exempt from the dossier duties, and small enterprises and start-ups may choose not to comply for five years from 1 January 2026. The relief does not cover businesses providing processing services, those processing sensitive data directly, or, per EY's reading of Decree 356, those that have processed data of 100,000 or more data subjects cumulatively.

Enforcement and penalties

Violation	Maximum	Source
Buying or selling personal data	10 times the income from the violation	Law Art. 8(3)
Unlawful cross-border transfer (organisation)	5% of prior-year revenue; VND 3 billion applies where there is no revenue or 5% is lower	Law Art. 8(4)
Other violations (organisation)	VND 3 billion	Law Art. 8(5)
Individuals	Half the organisation maximum	Law Art. 8(6)
Failure to notify a breach	VND 80 million	Decree 330/2026, as summarised by Tilleke & Gibbins
Processing impact assessment failures	VND 100 million	Decree 330/2026, as summarised by Tilleke & Gibbins
Failure to appoint the data protection function	VND 30 million	Decree 330/2026, as summarised by Tilleke & Gibbins

Serious cases can lead to criminal liability. A05 inspects on a routine or unannounced basis with 15 working days' notice, except on data trading platforms, where it may inspect without notice. Fines per item are modest, but they stack, and the revenue-based ceiling for transfers makes the cross-border dossier the highest-stakes filing.

What it means for AI agents and non-human identities

Credentials are sensitive data: Decree 356 lists e-identity account usernames and passwords as sensitive personal data. A secrets store, identity provider or agent memory that holds user credentials needs sensitive-data controls, and a leak of it is a high-harm breach. See the Secrets Management Guide.
Offshore models are transfers: an agent in a Vietnamese entity that sends user data to a model hosted abroad falls within Article 20(1)'s offshore platform limb, so it belongs in the cross-border dossier and its six-monthly updates.
Machine access as a breach path: over-privileged service accounts and long-lived API keys on customer databases turn a single leaked secret into a 72-hour notice. Give each a named owner, least privilege and rotation. See the Service Account Security Guide.
Behavioural data: agents that track usage across online services handle what Decree 356 now treats as sensitive behavioural tracking data, which should be assessed in the processing dossier. See the AI Impact Assessment Template.

Compliance steps

Retire Decree 13 references: update policies, notices and runbooks to cite Law 91/2025 and Decree 356.
Reclassify data: apply the Decree 356 basic and sensitive lists, with credentials, ID images and financial history moved to sensitive.
Appoint the function: designate the department and DPO in writing against the Article 13 criteria, or contract a qualifying provider.
Prepare or refresh dossiers: file processing and cross-border dossiers on Forms 10 and 09 within 60 days of start, track the 15-day review, and calendar six-monthly and 10-day updates.
Map transfers by the three Article 20(1) limbs: include offshore storage, recipients and platforms, and record any Article 17(3) exemption relied on.
Rebuild the breach runbook: 72 hours from discovery, Form 08 content, subject notice for finance, location and biometric data, five-year records. Test it in a tabletop with legal and the Vietnamese entity. See the Incident Response Plan Template.
Fix consent capture: remove defaults, log time and content of consent, and route withdrawals to the 2-working-day queue.
Prepare for inspection: keep dossiers, agreements, consent logs and incident records ready to hand over at 15 working days' notice.

Framework mapping

Vietnamese duty	NIST CSF 2.0	NIST SP 800-53 Rev. 5	ISO/IEC 27001:2022 Annex A
Lawful processing, consent	GV.OC-03	PT-2, PT-3	A.5.31, A.5.34
Data classification and inventory	ID.AM-07	PM-5	A.5.9, A.5.12
Protection measures, sensitive data	PR.DS-01, PR.DS-02, PR.AA-05	AC-6, IA-5, AU-2	A.8.5, A.8.15, A.8.24
Impact assessment dossiers	GV.OC-03	RA-8	A.5.34
Breach notice	RS.CO-02	IR-6, IR-8	A.5.24, A.5.26
Processors, providers, transfers	GV.OC-03	SA-9	A.5.19, A.5.20

Measuring it

Dossier currency: percentage of processing and transfer dossiers updated within six months or 10 days of a trigger.
Breach clock: hours from discovery to Form 08 submission in exercises, target under 72.
Request timeliness: share of withdrawals answered within 2 working days and deletions completed within 30 days.
Transfer coverage: share of offshore storage, recipients and platforms, including AI model endpoints, listed in the cross-border dossier.
Credential hygiene: percentage of service accounts and API keys on personal data stores with an owner and rotation.

Common failure patterns

Running a Decree 13 programme: policies and notices still cite a decree that was replaced on 1 January 2026.
Counting from occurrence or from confirmation: the 72 hours run from discovery, so a slow internal triage eats the window.
Forgetting the offshore platform limb: treating a foreign SaaS or hosted model as outside transfer rules because data is "only processed" there.
File and forget: no six-monthly or 10-day dossier updates after reorganisations or a change of provider.
Misreading SME relief: assuming small-company status exempts a firm that processes sensitive data or offers processing services.
Credentials outside the sensitive tier: treating stored usernames and passwords as ordinary operational data.

Practitioner checklist

Replace every Decree 13 reference with Law 91/2025 and Decree 356.
Reclassify data against the Decree 356 basic and sensitive lists.
Appoint the DPO or department in writing, or contract a qualifying provider.
File processing and cross-border dossiers within 60 days and track A05 review.
Calendar six-monthly and 10-day dossier updates.
Map transfers across all three Article 20(1) limbs, including AI model endpoints.
Run a 72-hour breach exercise using the Form 08 content.
Remove default consent and keep verifiable consent records.
Assign owners, least privilege and rotation to machine credentials on personal data.

Standards and references

Related NHI Mgmt Group resources: International Data Transfers Map · China PIPL Guide · Indonesia PDP Law Guide · Global Privacy Regulatory Map. This guide summarises Vietnam's Law on Personal Data Protection No. 91/2025/QH15, Decree No. 356/2025/ND-CP and Decree No. 330/2026/ND-CP as at October 2026 and is not legal advice.

Vietnam Personal Data Protection Guide: Current Law, Duties and Cross-Border Transfers