Vietnam's Personal Data Protection Legal Framework From 2026 Onward

ANALYSIS OF VIETNAM'S PERSONAL DATA PROTECTION LEGAL FRAMEWORK FROM 2026 ONWARDS

I. EXECUTIVE SUMMARY

Vietnam has formally entered a new era of personal data governance with the enactment of the Law on Personal Data Protection No. 91/2025/QH15 ("PDPL") and Decree No. 356/2025/ND-CP ("Decree 356"), both effective from 1 January 2026.

The new legal framework represents a significant departure from the previous regulatory regime established under Decree No. 13/2023/ND-CP. Personal data protection is no longer treated as a standalone legal compliance exercise, but has evolved into a core element of corporate governance, enterprise risk management and digital business strategy.

Organizations operating in Vietnam will need to fundamentally reassess their existing compliance frameworks. Data protection obligations now extend far beyond drafting privacy policies and obtaining consent. Businesses are expected to establish comprehensive governance mechanisms covering the entire data lifecycle, including data collection, processing, storage, transfer, retention and deletion.

Based on our review, several publicly available reference materials continue to rely on draft regulations that were circulated before Decree 356 was officially promulgated. Accordingly, businesses should revisit and update their existing policies, procedures and governance structures based on the officially enacted legislation.

This letter outlines the key legal developments and highlights the principal compliance risks and practical considerations relevant to organizations operating in Vietnam.

II. REGULATORY LANDSCAPE: FROM DECREE 13 TO A COMPREHENSIVE GOVERNANCE FRAMEWORK

The current legal framework consists primarily of:

·        Law No. 91/2025/QH15 on Personal Data Protection; and

·        Decree No. 356/2025/ND-CP detailing the implementation of the Law and replacing Decree No. 13/2023/ND-CP.

The significance of this transition should not be underestimated.

Under Decree 13, many obligations were principles-based and left substantial room for interpretation. The new framework, however, introduces a far more operational and prescriptive approach.

Organizations are now expected to implement structured governance systems covering:

·        data inventory and data classification;

·        internal accountability structures;

·        data retention management;

·        third-party data processing arrangements;

·        cross-border data transfer controls;

·        impact assessment obligations;

·        incident response mechanisms; and

·        technology governance in emerging digital environments.

In practical terms, data protection should no longer be viewed as a legal or IT project. It has become an enterprise-wide governance responsibility.

III. CROSS-BORDER DATA TRANSFERS REPRESENT THE MOST SIGNIFICANT REGULATORY RISK

Among all compliance obligations introduced under the new framework, cross-border data transfers deserve immediate attention.

There is a common misconception that administrative penalties of up to 5% of annual revenue apply broadly to all serious violations. This interpretation is inaccurate.

Under the Law, the maximum penalty of up to 5% of the organization's preceding year's revenue specifically applies to violations involving cross-border transfers of personal data.

Different penalty thresholds apply to other categories of violations.

For example:

·        unlawful sale of personal data may trigger penalties of up to ten times the illegal gains derived from the violation; and

·        other violations may be subject to monetary penalties of up to VND 3 billion for organizations.

From a practical standpoint, organizations should immediately identify whether any of the following activities are being conducted:

·        transferring employee data to overseas HR systems;

·        sharing customer information with regional headquarters;

·        utilizing cloud infrastructure hosted outside Vietnam;

·        engaging offshore service providers; or

·        consolidating data into global systems.

Particular caution should be exercised by multinational groups.

A common misconception is that transfers between a Vietnamese subsidiary and a foreign parent company constitute internal transfers exempt from regulatory requirements. This is not the case.

A Vietnamese legal entity and its foreign parent company are separate legal persons. Consequently, such transfers will generally constitute cross-border data transfers and remain subject to applicable compliance obligations.

Organizations should separately assess employee-related data flows and customer-related data flows, as different legal considerations may apply.

IV. DATA CLASSIFICATION IS THE FOUNDATION OF THE ENTIRE COMPLIANCE PROGRAMME

Proper data classification is no longer a theoretical exercise.

It is the foundation upon which all subsequent compliance obligations are built.

Organizations should establish an enterprise-wide data inventory and classify personal data into distinct categories.

Basic personal data generally includes information capable of identifying an individual but not classified as sensitive data.

Sensitive personal data includes, among others:

·        financial information;

·        health information;

·        biometric data;

·        geolocation data in certain circumstances;

·        children's data;

·        data relating to persons under guardianship.

Organizations should also distinguish between encrypted data and anonymized data.

Encryption is a security measure that protects personal data, but encrypted information remains personal data.

Conversely, data that has been irreversibly anonymized may fall outside the scope of personal data protection laws.

This distinction is particularly important for organizations utilizing analytics, artificial intelligence and business intelligence platforms.

V. ORGANIZATIONS MUST REASSESS THEIR LEGAL ROLES IN DATA PROCESSING ACTIVITIES

Vietnamese law recognizes three separate legal roles:

·        Personal Data Controller;

·        Personal Data Processor; and

·        Personal Data Controller and Processor.

The third category is a unique concept under Vietnamese law and is frequently overlooked by organizations.

In practice, many businesses simultaneously assume multiple roles depending on the underlying business activity.

For example, a company may act as:

·        a Controller in relation to employee data;

·        a Processor in relation to customer projects; and

·        a Controller and Processor in relation to its own service delivery operations.

Organizations should therefore establish a detailed processing responsibility matrix rather than assigning a single role across the entire enterprise.

VI. CONSENT IS NO LONGER THE PRIMARY COMPLIANCE MECHANISM

Historically, many organizations attempted to rely exclusively on consent as the legal basis for processing personal data.

This approach is no longer appropriate.

The Law now recognizes several circumstances where personal data may be processed without obtaining consent.

These include situations involving:

·        protection of legitimate rights and interests;

·        emergency situations;

·        activities carried out by state authorities;

·        performance of agreements or contracts; and

·        other circumstances prescribed by law.

The introduction of legitimate interest concepts signals Vietnam's gradual alignment with global data governance principles.

However, organizations should avoid interpreting these exceptions too broadly.

The absence of a consent requirement does not eliminate accountability obligations.

Organizations remain responsible for demonstrating:

·        the applicable legal basis;

·        the necessity of the processing activity;

·        proportionality;

·        implementation of safeguards; and

·        ongoing risk monitoring.

Furthermore, organizations should note that silence, inactivity, implied acceptance and pre-ticked boxes do not constitute valid consent.

Consent mechanisms must be explicit, verifiable and properly documented.

VII. DATA SUBJECT RIGHTS REQUIRE SIGNIFICANT OPERATIONAL ADJUSTMENTS

The Law significantly strengthens the rights of data subjects.

Organizations must establish internal procedures to facilitate the exercise of these rights, including requests relating to:

·        access to personal data;

·        rectification;

·        withdrawal of consent;

·        restriction of processing;

·        objection to processing;

·        deletion;

·        complaints and legal remedies; and

·        requests for protective measures.

One notable development is the introduction of the right to request organizations to implement protective measures.

This right did not exist under the previous regime and requires separate operational procedures.

Organizations should establish centralized mechanisms for receiving, tracking and responding to all data subject requests.

VIII. THE PREVIOUS 72-HOUR FRAMEWORK HAS BEEN REPLACED

One of the most significant operational changes introduced by Decree 356 is the replacement of the generic 72-hour response framework.

Organizations must now comply with a tiered response mechanism. Within two working days of receiving a request, organizations must acknowledge receipt and provide information regarding the applicable procedures. Subsequently, different completion timelines apply depending on the nature of the request. Organizations should redesign their internal operating procedures accordingly and avoid relying on outdated response timelines established under Decree 13.

IX. DATA PROTECTION PERSONNEL REQUIREMENTS HAVE BECOME MORE PRESCRIPTIVE

Decree 356 introduces detailed requirements regarding personnel responsible for personal data protection.

Organizations should assess whether dedicated resources are required.

Individuals responsible for data protection are expected to possess relevant educational qualifications, practical experience and specialized training.

Organizations may also engage external service providers, subject to qualification requirements.

This development demonstrates that regulators increasingly expect organizations to institutionalize data governance rather than relying on ad hoc compliance efforts.

X. IMPACT ASSESSMENTS ARE NOW A CENTRAL COMPLIANCE REQUIREMENT

Organizations should establish procedures to prepare and maintain:

·        Data Protection Impact Assessments (DPIA); and

·        Cross-border Transfer Impact Assessments (CTIA).

These documents should not be viewed as one-time filings. Rather, they should form part of an ongoing compliance management system and be updated whenever material changes occur. Certain exemptions may apply to cross-border transfers conducted exclusively for human resources management purposes. However, these exemptions are narrowly interpreted. Customer data transfers will generally remain subject to full compliance obligations.

Organizations should avoid assuming that all intra-group transfers automatically qualify for exemptions.

XI. CLOUD COMPUTING, ARTIFICIAL INTELLIGENCE AND EMERGING TECHNOLOGIES REQUIRE ENHANCED GOVERNANCE

Organizations increasingly rely on cloud-based solutions, artificial intelligence and advanced analytics. These technologies are now expressly regulated.

Organizations should review all technology vendors and assess:

·        data hosting arrangements;

·        encryption standards;

·        access management controls;

·        incident response capabilities;

·        contractual protections; and

·        periodic compliance assessments.

Vendor due diligence should become a standard component of procurement processes. Organizations deploying artificial intelligence systems should also conduct privacy impact assessments prior to implementation.

XII. EMPLOYEE DATA RETENTION REQUIRES IMMEDIATE ATTENTION

The Law expressly requires organizations to delete or destroy employee data upon termination of employment unless retention is otherwise required by law or agreed between the parties. Organizations should establish a formal Data Retention Schedule. Employee data should be categorized into three groups.

First, information that no longer serves any legitimate purpose should be deleted within a reasonable period following termination.

Second, payroll, tax and social insurance records should be retained in accordance with applicable laws.

Third, certain data may continue to be retained pursuant to contractual arrangements.

The same principle applies to unsuccessful job applicants. Organizations should not retain applicant information indefinitely without a valid legal basis or separate consent.

XIII. RECOMMENDED PRIORITY ACTION PLAN

We recommend that organizations prioritize the following actions over the next three to six months:

1.    Conduct a comprehensive data mapping exercise.

2.    Develop an enterprise-wide data governance framework.

3.    Update or adopt a Data Protection Policy.

4.    Develop a Data Retention Schedule.

5.    Review all cross-border data transfer activities.

6.    Execute Data Transfer Agreements with relevant counterparties.

7.    Establish procedures for managing data subject requests.

8.    Prepare and maintain DPIA and CTIA documentation.

9.    Review contracts with technology vendors and cloud service providers.

10. Establish a data breach management and incident response framework.

11. Implement periodic compliance monitoring mechanisms.

12. Conduct regular employee awareness and training programmes.

XIV. CONCLUSION

The greatest challenge facing organizations in 2026 and beyond will not be understanding the legal framework itself, but operationalizing compliance obligations into an effective governance model. Personal data protection should no longer be regarded as a standalone legal initiative or an information technology issue. It has become a permanent component of corporate governance, enterprise risk management and digital transformation strategies.

Organizations that proactively implement robust governance mechanisms at an early stage will be significantly better positioned to manage regulatory risks, strengthen stakeholder confidence and support sustainable growth in Vietnam's increasingly regulated digital economy. This memorandum is intended to provide a high-level overview of key legal developments and practical considerations under Vietnam's personal data protection framework. It should be read together with the official legal texts and supplemented by a business-specific compliance assessment based on the organization's operational model, data flows and risk profile.

General notes:

• The above is summarised from the current legislations and practices for internal reference only.

• This document cannot be relied upon by any other parties nor included in any submissions, reports, documents or letters required by the relevant regulatory bodies without our prior written consent and/or subject to our approval on the appropriate form and contents; and

• Please kindly noted that SP&A is not a legal firm, our comments provided under this document may include reviewing regulatory documents to be identified as general management consultancy, therefore, should not be considered, nor intended to be, a legal advice.