Vietnam's Personal Data Protection Law No. 91/2025/QH15 was passed on 26 June 2025 and took effect on 1 January 2026. It is the country's first standalone statute on personal data, replacing a regime that previously rested on decrees. This article summarises the obligations that hit small and mid-sized companies directly, and what to do before an inspector asks.
Who is covered
The scope is wider than many expect: the law applies to any organisation processing the personal data of people in Vietnam, including foreign organisations with no presence in the country. In practice nearly every business is covered — you only need a customer list with phone numbers, HR records, an attendance camera, or a sign-up form on your website.
Four core obligations
- Consent must be clear and purpose-specific. No pre-ticked boxes, no bundled "I agree to everything" clauses. If you collect data for a purpose, that purpose must be stated.
- Data Processing Impact Assessment (DPIA). Organisations must prepare, retain and submit the dossier, and update it every six months when regulated changes occur.
- Transfer Impact Assessment (TIA) for cross-border transfers — which includes using cloud services whose servers sit outside Vietnam.
- Breach reporting within 72 hours of detection. For biometric data, or breaches at financial service providers, affected individuals must also be notified.
Small companies get a deferral, not an exemption
The law makes a concession for small enterprises and startups: for five years from the effective date, this group may choose to defer preparing the DPIA, updating it periodically, and designating a data protection department or officer. Household businesses and micro-enterprises are exempt unless they process sensitive data or data at scale.
Read the word "defer" carefully. Everything else — valid consent, data subject rights, security measures, the 72-hour breach report — applies from 1 January 2026.
Penalties
This is the part that gets attention. According to the summary by law firm Tilleke & Gibbins, violations relating to cross-border transfers can draw fines of up to 5% of annual revenue, with a floor of VND 3 billion; illegal trading of personal data can be fined up to ten times the revenue gained from the transaction; other violations are capped at VND 3 billion. Tying penalties to revenue is a significant change from the previous fixed-bracket approach.
What to do this quarter
No large project is needed. These four steps take a few weeks and remove most of the exposure:
- Map your data. List what personal data you collect, from where, where it is stored, who can access it, and how long it is kept. Most companies discover data in places nobody thought about: spreadsheets on personal laptops, chat groups, a database copy on a developer's machine.
- Review your collection forms. Website, job applications, surveys — state the purpose clearly, use real consent, drop pre-ticked boxes.
- Tighten access. HR records, payroll and customer lists need role-based permissions and access logging. This is also your evidence that protective measures were in place.
- Write the incident procedure in advance. Who detects, who is told, who decides to notify the authority. Seventy-two hours is short if the incident lands on a Friday evening.
The system angle
Most of the law is an organisational matter, but three parts live in software: permissions by role and by data scope, access logs for sensitive data, and the ability to delete or export one individual's data on request. If your current management system cannot do those three things, proving compliance becomes expensive — which is a fair reason to reassess the system this year.
Sources
- Tilleke & Gibbins — Vietnam's New Personal Data Protection Law: A Closer Look
- Vietnam Briefing — Personal Data Privacy Protection Law
This article summarises public information as of 24 September 2026 and is not legal advice. Consult a lawyer for your specific situation before making compliance decisions.
