Vietnam PDPL
Law No. 91/2025/QH15 on Personal Data Protection
Vietnam's first Personal Data Protection Law was passed by the National Assembly on 26 June 2025 and took effect on 1 January 2026, together with implementing Decree 356/2025/ND-CP. It replaces the earlier decree-based regime (Decree 13/2023/ND-CP, in force from 1 July 2023), bans the purchase and sale of personal data, and requires impact assessments filed with the Ministry of Public Security.
Who it applies to
Vietnamese and foreign organizations and individuals that process personal data in Vietnam, and foreign entities that process the personal data of Vietnamese citizens. Micro-enterprises and household businesses are largely exempt, and small enterprises and startups get a five-year optional period for impact assessments and a data protection officer unless they process sensitive data, process data at large scale or provide processing services.
Identity requirements
- Obtain consent as the main legal basis for processing, with specific, clear consent for sensitive data such as biometric data
- Notify the authorities of personal data breaches within 72 hours of detection, and notify affected individuals for incidents involving biometric data
- Prepare and file processing impact assessments and cross-border transfer impact assessments with A05, updating them when processing changes
- Do not buy or sell personal data
- Obtain consent from both the child and a parent where required for children aged 7 and over
How it impacts identity systems
| Identity area | Impact |
|---|---|
| Identity verification (KYC/proofing) | Biometric eKYC is sensitive-data processing with consent and breach-notification duties. |
| Data residency & cross-border transfer | Transfers abroad, including to foreign identity platforms, need a transfer impact assessment filed with the regulator. |
| Breach notification | A 72-hour notification deadline applies to the authorities. |
| Customer identity & consent (CIAM) | Consent records and child or parent consent must be captured in onboarding flows. |
Penalties
The law sets maximum administrative fines of up to 5 percent of the previous year's revenue for cross-border transfer violations, up to ten times the revenue earned from illegal trading in personal data, and up to 3 billion Vietnamese dong for other violations, with detailed sanctions set by decree.
Status and dates last verified against primary sources on 2026-10-31.
Vietnam PDPL: frequently asked questions
- When did Vietnam's Personal Data Protection Law take effect?
- Law No. 91/2025/QH15 took effect on 1 January 2026, alongside implementing Decree 356/2025/ND-CP.
- Does the PDPL apply to foreign companies?
- Yes. It applies to foreign organizations that directly participate in or are involved in processing the personal data of Vietnamese citizens.