Vietnam personal data protection law: what firms must plan

Vietnam personal data protection law is now settled, and firms have until 1 January next year to prepare. The National Assembly passed Law 91/2025/QH15 on 26 June 2025. It sets one national statute for personal data, with fines far higher than before. This guide explains what is known today and what a firm should plan first.

Sources: VOV, 26 June 2025, National Assembly passes Law on Personal Data Protection (vov.vn); Tilleke & Gibbins, 26 June 2025, Vietnam issues personal data protection law (tilleke.com).

What the law is and when it starts

The National Assembly voted on the morning of 26 June 2025. In all, 433 of 435 deputies voted yes. The law takes effect on 1 January next year, so firms have about five months left.

Until now, the main rules sat in a government decree, Decree 13/2023/ND-CP, which took effect on 1 July 2023. A decree ranks below a law. The new statute gives personal data protection a firmer legal base and stronger penalties.

One point is still open. Law firms note that the link between the new law and Decree 13 is not fully clear. Decree 13 is expected to stay in force until the Government issues a new decree with detailed guidance. Watch for that decree, because it will carry many of the practical details.

Sources: VOV, 26 June 2025 (vov.vn); Tilleke & Gibbins, 26 June 2025 (tilleke.com); DLA Piper, 2023, Vietnam Decree 13 and the new regulations on personal data protection (dlapiper.com).

Consent and the duties firms already know

The approach built on consent stays. Under Decree 13, consent must be clear, voluntary and affirmative. The person must know what data is used, why, who will process it, and what their rights are. Silence or a vague notice does not meet that test.

The new law adds some cases where processing can go ahead without consent. It also says that consent given under Decree 13 stays valid. That is good news for firms with a clean consent record, since they do not need to start again.

The law also keeps the split between basic and sensitive personal data. The Government will publish lists of what falls in each group. Until the lists appear, firms that handle health, finance, location or similar data should treat it with extra care.

Sources: Tilleke & Gibbins, 26 June 2025 (tilleke.com); DLA Piper, 2023 (dlapiper.com).

Impact assessments and cross-border transfers

Under Decree 13, a firm must prepare a written impact assessment when processing starts. It sends the original to the Ministry of Public Security's cybersecurity department within 60 days. Firms that send data abroad file a separate transfer assessment on the same timeline.

Law firms report that these assessment duties carry over. Assessments already filed stay valid, but they may need updating to match the new text. The law also adds exemptions for transfers abroad. They cover cloud processing and storage of employee data, and cases where a person sends their own data overseas.

A practical step: list every vendor or system that sends personal data outside Vietnam. Match each one to a filed assessment, and note the ones that are missing.

Sources: DLA Piper, 2023 (dlapiper.com); Tilleke & Gibbins, 26 June 2025 (tilleke.com).

Fines are the big change

The law raises the cost of getting it wrong. Reported limits are:

Buying or selling personal data: up to ten times the illegal proceeds, or VND 3 billion if that is higher.
Cross-border transfer violations: up to 5% of the prior year's revenue, or VND 3 billion if that is higher.
Other violations: up to VND 3 billion.

Individuals face half the fine that applies to organizations. Serious cases can also lead to criminal action and to compensation for damage. Exact fine rules will come from a later government decree on penalties, so treat these as ceilings and not as a final schedule.

Sources: VOV, 26 June 2025 (vov.vn); Tilleke & Gibbins, 26 June 2025 (tilleke.com).

Relief for small firms, with limits

Household businesses and micro-enterprises are exempt from impact assessment dossiers and from naming staff or a unit for data protection. Small enterprises and start-ups may choose not to comply with those duties for five years from the effective date.

There is a catch. Law firm summaries say neither the exemption nor the grace period applies when a firm handles a large amount of personal data, offers data processing services, or directly processes sensitive data. A small firm in payments, recruitment or customer analytics may therefore lose the relief.

Sources: VOV, 26 June 2025 (vov.vn); Tilleke & Gibbins, 26 June 2025 (tilleke.com).

A plan for the next five months

Firms can act now without waiting for every decree. Start with a short, ordered list:

Map your data. Record what personal data you hold, where it sits, and who can see it.
Review consent forms and notices against the Decree 13 standard.
Check your filed assessments and refresh any that are out of date.
List all transfers abroad, including cloud tools and group companies.
Name a person or team to own data protection, and write a breach response plan. Decree 13 uses a 72-hour window to alert the authority, so test that your team can meet it.
Decide early whether you qualify for the small firm relief, using the limits above.

Then follow the Government's guiding decree. When it appears, compare it with this list and close any gap.

Sources: DLA Piper, 2023 (dlapiper.com); Tilleke & Gibbins, 26 June 2025 (tilleke.com).