What is Vietnam's Personal Data Protection Law 2025 and when does it apply?
The Law on Personal Data Protection No. 91/2025/QH15 was passed by the 15th National Assembly on 26 June 2025, at its 9th session, and took effect on 1 January 2026 (Article 38). It is Vietnam's first statute dedicated to personal data; before it, most obligations sat in Decree 13/2023/ND-CP.
On 31 December 2025 the Government issued Decree 356/2025/ND-CP detailing the Law, also effective 1 January 2026 and replacing Decree 13/2023/ND-CP. The Decree has 5 chapters and 42 articles, with an appendix of dossier forms (including Forms 08, 09 and 10 referred to below).
The Law covers Vietnamese agencies, organisations and individuals, foreign organisations in Vietnam, and foreign organisations directly involved in or related to processing the personal data of Vietnamese citizens (Article 1 of the Law, Article 2 of Decree 356). A SaaS platform hosted abroad but serving Vietnamese users is within scope.
For engineering teams, the notable part is that the Law has a dedicated article on big data, artificial intelligence and cloud computing (Article 30), and Decree 356 has separate articles for big data (Article 9), AI (Article 10) and cloud (Article 12). The requirements reach beyond the privacy policy and into system architecture.
Is Decree 13 still in effect? The transition from Decree 13/2023
No. Under Article 42(2) of Decree 356/2025/ND-CP, Decree 13/2023/ND-CP ceased to be effective on 1 January 2026. Article 39 of Law 91/2025/QH15, however, contains two transitional rules that spare businesses from starting over.
- Existing consent: processing already under way with data subject consent or agreement obtained under Decree 13 before the Law took effect may continue without re-obtaining consent or re-agreeing (Article 39(1)).
- Filed impact dossiers: processing impact dossiers and overseas transfer dossiers under Decree 13 that the specialised authority received before 1 January 2026 remain valid and need not be redone; any later update follows the new Law (Article 39(2)).
- Dossiers not filed or not received before 1 January 2026 are prepared under the Law and Decree 356, using Form 09 (cross-border transfer) and Form 10 (processing).
Practical changes compared with Decree 13
- Data subject request deadlines: Decree 13 used a single 72-hour benchmark; Decree 356 sets different deadlines per request type, with an initial response within 2 working days (Article 5).
- New lists of basic personal data (Article 3) and sensitive personal data (Article 4).
- Specific qualifications for data protection personnel (Article 13) and duties of the data protection unit (Article 14).
- Maximum fines are set in the Law itself (Article 8); see the final section.
Valid consent: designing the screen and keeping evidence
Under Article 9 of the Law, consent is valid only if voluntary and if the data subject clearly knows the type of data, the purpose, the controller, and their own rights and obligations. Consent must be given per purpose, cannot be made conditional on agreeing to other purposes, and silence or non-response does not count as consent.
Article 6 of Decree 356 lists valid methods: in writing, a recorded call, an SMS syntax, email, or a website, platform or app with a technical consent mechanism, plus other verifiable formats. The method must prove who consented, when, and to what. The controller must store consent and bears the burden of proof in disputes; it may not set consent as the default or use instructions that blur the line between agreeing and declining.
- Each purpose (service delivery, marketing, analytics, AI model training) is a separate choice, not one bundled checkbox.
- No pre-ticked boxes; "Agree" and "Decline" carry equal visual weight.
- Store a consent record with user identifier, timestamp, notice version, selected purposes and collection channel.
- For sensitive data, the screen must state that the data to be processed is sensitive personal data (Article 6(4) of Decree 356).
- Provide a withdrawal flow: under Article 5(2) of Decree 356, respond within 2 working days and complete within 15 days (20 days where processors or third parties must also stop).
Sensitive data and children's data
Article 4(1) of Decree 356 lists sensitive personal data, including several categories that SaaS and AI systems often touch: health status; biometric data; location identified through location services; login credentials for electronic identity accounts and images of ID cards; bank account details and transaction history; and, notably, data tracking behaviour and activity on telecom services, social networks, online media and other online services. When processing sensitive data, organisations must set access-restriction rules, processing procedures and security measures (Article 4(2)).
The product consequence: user behaviour logs (clickstream, usage history) may fall into the sensitive category. When sensitive data is transferred, Article 7 of Decree 356 requires physical security for storage and transmission devices, encryption, anonymisation and other safeguards.
For children, Article 24 of the Law has the legal representative exercise the data subject's rights on the child's behalf; processing a child's data to publish or disclose private life or personal secrets of a child aged 7 or older requires consent from both the child and the legal representative. Processing must stop when the person who consented withdraws consent, unless the law provides otherwise.
One more point for education software: Article 21(5) of Decree 356 lists "collecting and processing personal data via education apps or software with monitoring features such as attendance, video recording, behaviour scoring and emotion recognition" as a personal data processing service; businesses providing such services must meet the conditions in Article 22 and hold a certificate issued by the Ministry of Public Security (Articles 24–25). Disclosure: EYC builds Early Years Circle, a platform for preschools, so we follow this provision closely; companies in similar fields should ask counsel whether their product falls within it.
Impact assessment dossiers and cross-border transfer dossiers
Controllers must prepare a personal data processing impact assessment dossier and send one original to the specialised personal data protection authority (under the Ministry of Public Security) within 60 days of first processing (Article 21(1) of the Law). Processors prepare dossiers as agreed with the controller.
Cross-border transfer covers three situations (Article 20(1) of the Law, Article 17 of Decree 356), including storage on servers or cloud services of a provider abroad and using a platform outside Vietnam to process data collected in Vietnam. For many AI systems, calling a model API hosted abroad to process Vietnamese users' data is a textbook case to assess under this article. The dossier is also due within 60 days of the first transfer.
Both dossiers have similar components (Articles 18 and 19 of Decree 356): a report on Form 09 or Form 10, a copy of the processing or transfer contract, and internal policies and procedures. The report must include a data-flow diagram, how consent is obtained, the retention and deletion policy, a system diagram and a risk assessment.
Updating the dossiers
Dossiers are updated every 6 months when a new processing purpose arises or controllers, processors or third parties change, and within 10 days upon reorganisation, dissolution, a change of data protection service provider, or a new related business line (Article 22 of the Law, Article 20 of Decree 356). In practice, adding a new LLM provider or a new AI purpose is a reason to review the dossier.
Are small businesses exempt?
Small enterprises and start-ups may choose whether to apply Articles 21, 22 and Article 33(2) of the Law for 5 years from 1 January 2026; household businesses and micro-enterprises need not apply them. The exemption does not apply to those providing personal data processing services, directly processing sensitive data, or, from the point they reach a cumulative 100,000 data subjects processed (Article 38 of the Law, Article 41 of Decree 356). Note that the exemption does not mention Article 20, so cross-border transfer dossiers still need separate review.
Breach notification: the 72-hour mark
When a violation is discovered that may harm national defence, security or public order, or infringe the life, health, honour, dignity or property of data subjects, the controller must notify the specialised authority no later than 72 hours after discovery; processors must promptly inform the controller (Article 23(1) of the Law). The notice uses Form 08 and covers time, conduct, data types and volumes, likely consequences and remedial measures (Article 28 of Decree 356).
Two special cases apply. For location or biometric data, affected data subjects must also be notified within 72 hours, and breach records kept for at least 5 years after remediation (Article 29 of Decree 356). For sensitive data in finance, banking and credit information, both the authority and the data subjects must be notified within 72 hours (Article 8(3) of Decree 356).
Technically, 72 hours is only achievable with access monitoring, logs detailed enough to identify affected data, and a rehearsed response process. See how to design access control and audit logs for AI Agents.
Personal data in AI: training data, prompts and logs
Article 30 of the Law requires personal data in AI, big data and cloud environments to be processed for the stated purpose and limited to what is necessary; systems must integrate appropriate security, authentication, identification and access control; and processing personal data with AI must be classified by risk level.
Article 10 of Decree 356 goes further: organisations may use personal data to research and develop AI systems but must comply with data protection rules; AI inference results that can identify a specific person must be protected as personal data; controllers must notify data subjects of automated processing, explain how the algorithm works and its effect on their rights, and offer an option to opt out; and compliance must be assessed once a year.
Training and fine-tuning data
- Training or fine-tuning a model on customer data is a separate purpose; it needs a legal basis and, if relying on consent, separate consent for that purpose (Article 9 of the Law).
- Prefer de-identification before data enters a training set. De-identified data is no longer personal data (Article 2(1) of the Law) and must not be re-identified (Article 14 of the Law).
Prompts, RAG context and logs
- User prompts and documents retrieved in a RAG system often contain personal data. Filter or mask sensitive fields before they reach the model.
- If the model runs on infrastructure abroad, that flow is a cross-border transfer to include in the Article 20 dossier.
- Conversation and inference logs: set retention periods, restrict access and support deletion on request. Under Article 10(6) of Decree 356, data subjects must be able to edit, anonymise or delete identifying profiles even where the platform keeps behaviour history.
- For AI Agents that call tools on their own, apply least privilege and log each access to personal data; see human-in-the-loop for steps that need human approval.
Technical checklist for AI and SaaS systems
The table maps requirements in Law 91/2025/QH15 and Decree 356/2025/ND-CP to concrete engineering work. It is a starting point for review, not a substitute for a legal assessment of each system. For the governance foundation, see data governance basics.
| Area | Legal basis | What to do in the system |
|---|---|---|
| Data map | Decree 356 Art. 19 (data-flow diagram) | Inventory personal data fields, tag basic/sensitive, map flows across services, vendors and storage regions |
| Purpose-based consent | Law Art. 9; Decree 356 Art. 6 | Separate per-purpose toggles, none pre-ticked; store versioned, timestamped consent records |
| Data subject rights | Law Art. 4; Decree 356 Art. 5 | API/screens to view, correct, delete and withdraw consent; track 2-working-day response and 10/15/20-day completion deadlines |
| Access to sensitive data | Decree 356 Art. 4(2); Law Art. 30 | Role-based access, least privilege, environment separation; multi-factor authentication for big data processing (Decree 356 Art. 9) |
| Cloud encryption | Decree 356 Art. 12(4) | Encrypt at rest and in transit; key management; data protection clauses in cloud provider contracts |
| Monitoring and logs | Decree 356 Art. 9 | Log access to personal data, alert on anomalies, keep logs sufficient for incident investigation |
| 72-hour incident response | Law Art. 23; Decree 356 Arts. 28, 29 | Runbook, named owner, Form 08 template, channel to notify subjects for location/biometric data |
| Impact assessment dossier | Law Arts. 21, 22; Decree 356 Arts. 19, 20 | Prepare Form 10 within 60 days; update when adding purposes or vendors |
| Cross-border transfer | Law Art. 20; Decree 356 Arts. 17, 18 | List AI APIs, cloud and SaaS tools hosted abroad; prepare Form 09; transfer contracts |
| AI and automated processing | Law Art. 30; Decree 356 Art. 10 | Risk classification; automated-processing notice and opt-out; prompt masking; annual compliance assessment |
| Retention and deletion | Law Art. 14; Decree 356 Art. 9 | Retention policy for data, logs and backups; secure deletion that prevents unauthorised recovery |
| Data protection personnel | Law Art. 33(2); Decree 356 Art. 13 | Appoint qualified person/unit in writing or engage a data protection service provider |
Penalties under the Personal Data Protection Law 2025
Article 8 of the Law sets maximum administrative fines for organisations: up to 10 times the revenue earned from buying or selling personal data; up to 5% of the previous year's revenue for violating cross-border transfer rules; and up to VND 3 billion for other violations. Individuals committing the same violation face a maximum of half the organisational amount. Depending on severity, violations may also lead to criminal liability and compensation for damage.
These are caps in the Law. Specific violations and fine levels are set out in Decree 330/2026/ND-CP of 19 August 2026 on administrative sanctions in cybersecurity and personal data protection (effective on signing). This article does not list per-violation fines; check that decree directly for a specific case.
Frequently asked questions
When did Vietnam's Personal Data Protection Law 2025 take effect?
Law 91/2025/QH15 was passed on 26 June 2025 and took effect on 1 January 2026 (Article 38). Implementing Decree 356/2025/ND-CP took effect on the same day.
Is Decree 13/2023/ND-CP still in effect?
No. Decree 13/2023 ceased to be effective on 1 January 2026 under Article 42(2) of Decree 356. Consent obtained under Decree 13 can still be relied on, and impact dossiers received before that date need not be redone (Article 39 of the Law), but later updates follow the new rules.
Is using the ChatGPT, Claude or Gemini API a cross-border data transfer?
If personal data collected in Vietnam is sent to a platform outside Vietnam for processing, that matches Article 20(1)(c) of the Law and Article 17(1)(c) of Decree 356, so a cross-border transfer impact dossier should be considered. Confirm the actual processing location with the provider and seek legal advice for your case.
What is the breach notification deadline in Vietnam?
No later than 72 hours after discovery, to the specialised personal data protection authority under the Ministry of Public Security (Article 23 of the Law), using Form 08 of Decree 356. For location and biometric data, affected data subjects must also be notified within 72 hours.
Do small businesses need an impact assessment dossier?
Small enterprises and start-ups may choose whether to comply for 5 years from 1 January 2026, unless they provide personal data processing services, directly process sensitive data, or have processed data of 100,000 or more data subjects (Article 38 of the Law, Article 41 of Decree 356).
What is the maximum fine under the Personal Data Protection Law?
For organisations: up to 5% of the previous year's revenue for cross-border transfer violations, 10 times the revenue from data trading, and VND 3 billion for other violations (Article 8 of the Law). Individuals face up to half of the organisational amount.