From 1 January 2026, the Law on Personal Data Protection (Law No. 91/2025/QH15) and Decree No. 356/2025/ND-CP are in force, replacing Decree No. 13/2023/ND-CP. Almost every business processes the personal data of customers, employees or partners, so almost every business is affected: how it asks for consent, how it prepares and files impact assessment dossiers, how it transfers data to cloud services abroad, and its duty to notify incidents within 72 hours. Maximum fines are now set out in the Law itself. This handbook summarises the core obligations, explains the points businesses often get wrong, gives a quick comparison with the GDPR and proposes a 5-step roadmap to start complying in a practical way.
- From 1 January 2026, the Law on Personal Data Protection (Law No. 91/2025/QH15) and Decree No. 356/2025/ND-CP are in force; Decree No. 13/2023/ND-CP is replaced.
- The data controller must prepare an impact assessment dossier and send it to the specialised authority within 60 days. Transferring data abroad requires a separate dossier.
- Consent must be clear and given for each purpose. Silence or no response does not count as consent.
- Violations that may cause harm must be notified to the specialised authority no later than 72 hours after discovery.
- Maximum fines for organisations: 10 times the revenue obtained (buying or selling data), 5% of the previous year’s revenue (violations on cross-border transfers), VND 3 billion (other violations).
1. Which legal instruments make up the current personal data protection framework?
Law No. 91/2025/QH15 and Decree No. 356/2025/ND-CP
- Law on Personal Data Protection (Law No. 91/2025/QH15): passed by the National Assembly on 26 June 2025, in force from 1 January 2026.
- Decree No. 356/2025/ND-CP of 31 December 2025 details the Law. It is in force from 1 January 2026 and replaces Decree No. 13/2023/ND-CP.
- Specialised authority: the Department of Cybersecurity and High-Tech Crime Prevention (A05), Ministry of Public Security.
- Related instruments: Civil Code 2015 (Article 38), Law on Cybersecurity 2018, Law on Electronic Transactions 2023.
Analysis: Moving the rules from a decree up to a law gives them greater legal force. Maximum fines are set in the Law itself, and obligations such as impact assessments, breach notification and appointing data protection personnel are now set at the level of a law.
Under the transitional provisions, processing that already had consent under Decree 13 may continue without asking for consent again. Impact assessment dossiers already filed can still be used, but any update must follow the new requirements. Businesses should review their dossiers, forms and any references to Decree 13 in their policies and contracts.
2. How do basic and sensitive personal data differ?
Classification of personal data
Law No. 91/2025/QH15 distinguishes basic personal data (commonly used in transactions and social relations) from sensitive personal data (data whose infringement directly affects an individual’s lawful rights and interests). The detailed lists are set by Decree No. 356/2025/ND-CP.
| Criterion | Basic data | Sensitive data |
|---|---|---|
| Examples | Full name, date of birth, personal identification number, address, phone number, email | Health, biometrics (fingerprints, face), personal location, financial and banking information, political views, religion, criminal record |
| Departments that often hold it | Sales, customer service, marketing | HR (health records, biometric timekeeping), finance, apps with location tracking |
| Governance consequence | General principles and protection measures apply | Needs enhanced protection; may mean a small business loses its exemption |
Analysis: Many businesses think they “do not process sensitive data” because they are not in healthcare or banking. In practice, facial recognition time clocks, employee health check records or apps that track drivers’ locations can all fall into this group. Wrong classification leads to missing protection measures and an incomplete impact assessment dossier.
3. What role does your business play in data processing?
Your role determines which obligations apply:
- Data controller: decides the purpose and means of processing; bears primary responsibility for obtaining consent, honouring data subjects’ rights and preparing the impact assessment dossier.
- Data processor: processes data on behalf of the data controller under a contract, within the agreed scope.
- Data controller-processor: both decides the purpose and means and processes the data directly.
Analysis: A business usually has several roles. A retailer is the data controller for its members’ data, while the call centre or email marketing platform it hires is a data processor. When outsourcing, sign data protection clauses covering the scope of processing, security, incident reporting, and deletion or return of data when the contract ends.
4. The core obligations businesses must meet
Consent of the data subject
Article 9, Law No. 91/2025/QH15
Consent must be voluntary and based on clear knowledge of the type of data, the purpose of processing, the data controller and the data subject’s rights and obligations. It must be clear and specific for each purpose. Silence or no response does not count as consent. Decree No. 356/2025/ND-CP requires consent to be verifiable, with no default consent and no misleading presentation.
Analysis: A pre-ticked “I agree” box, one button that combines service delivery and advertising, or treating continued use of a website as consent are all risky. The Law allows processing without consent in some cases, but these are exceptions that must be checked case by case. The business must also be able to prove who consented, when, and to which version of the notice.
- Separate consent options by purpose and remove pre-ticked boxes.
- Keep a consent log: identity, time, policy version.
- Make withdrawing consent as easy as giving it.
Personal data processing impact assessment dossier
Article 21, Law No. 91/2025/QH15; Article 19, Decree No. 356/2025/ND-CP
The data controller (and others in cases provided by law) must prepare and keep a personal data processing impact assessment (DPIA) dossier and send 1 original to the specialised authority within 60 days from the start of processing. The report is prepared on Form No. 10 and filed with Form No. 02a or 02b (online, in person or by post). The dossier must be updated when there are changes, as provided in the Decree.
Analysis: The dossier requires the business to describe the purpose, the types of data, the storage period, protection measures and risks. A generic dossier that does not match reality can become adverse evidence during an inspection or after an incident. Forms under the old instruments are no longer a valid basis for a new dossier.
Transferring personal data abroad
Article 20, Law No. 91/2025/QH15; Articles 17 and 18, Decree No. 356/2025/ND-CP
An organisation that transfers personal data across borders must prepare a cross-border personal data transfer impact assessment dossier and send 1 original to the specialised authority within 60 days from the start of the transfer. The report is prepared on Form No. 09 and filed with Form No. 01a or 01b. Some cases do not need a dossier (including some cases involving employee data used for HR management).
Analysis: This situation is more common than businesses think: storing data on cloud services with servers abroad, using CRM, email marketing or HR software from international providers, or sending reports containing customer or employee data to a parent company. This group of violations carries the highest maximum fine. Make it a priority to list the providers and partners with servers or access from abroad, and check each data flow against the exempt cases.
Honouring data subjects’ rights
Article 4, Law No. 91/2025/QH15; Decree No. 356/2025/ND-CP
Data subjects have the right to: be informed; consent, refuse or withdraw consent; access and correct data; request that data be provided, deleted or restricted, and object to processing; complain, report, sue and claim compensation; and request protection measures. Decree No. 356/2025/ND-CP sets the following deadlines:
| Type of request | Deadline |
|---|---|
| Acknowledging receipt | 2 working days |
| Access, correction, provision of data | 10 days |
| Withdrawal of consent, restriction of or objection to processing | 15 days |
| Deletion of data | 20 days |
Analysis: The difficulty is usually that one person’s data is spread across several systems (CRM, accounting, email, backups). Have a single point of contact, an identity verification process and a deadline tracker.
Breach notification within 72 hours
Article 23, Law No. 91/2025/QH15
When a data controller or data processor discovers a violation of the personal data protection rules that may harm national defence, security, social order or the lawful rights and interests of data subjects, it must notify the specialised authority no later than 72 hours after discovery. Decree No. 356/2025/ND-CP adds rules on notifying the affected data subjects.
Analysis: Within 72 hours, the business must contain the incident, preserve evidence, establish which data is involved and draft the notification. Without roles assigned in advance, most of that time will be spent working out who is responsible.
Short incident response scenario- Record the time of discovery
- Isolate systems and preserve logs
- Assess the data and the number of people affected
- Notify the specialised authority within 72 hours
- Notify affected data subjects where needed
- Remediate and learn lessons
Appointing a data protection department or personnel
Article 33, Law No. 91/2025/QH15; Articles 13 and 41, Decree No. 356/2025/ND-CP
An organisation must appoint a qualified department or personnel, or hire a personal data protection service. The personnel need a college degree or higher, at least 2 years of experience in a relevant field (legal, IT, cybersecurity, risk management, compliance, HR, etc.) and training in personal data protection (Article 13).
Micro businesses and household businesses are exempt from some obligations (preparing the impact assessment dossier, appointing personnel or a department). Small businesses and start-ups may choose for 5 years from 1 January 2026, unless they provide data processing services, process sensitive data or process the data of a large number of data subjects (Article 41).
Analysis: A small business that uses facial recognition timekeeping or has a large customer database may not be exempt. Check carefully before concluding that you “do not have to do it”. If you do not yet have qualified personnel, hiring an outside service is an option the Law allows.
FC Legal reviews your data processing, impact assessment dossiers, partner contracts and internal processes, then proposes priority steps that suit the size of your business.
5. What risks does a business face if it does not comply?
Article 8, Law No. 91/2025/QH15 (maximum fines)
- Buying or selling personal data: up to 10 times the revenue obtained from the violation; if there is no revenue, or the amount calculated is lower, up to VND 3 billion.
- Violating the rules on cross-border data transfers: up to 5% of the organisation’s revenue in the previous year; if there is no revenue, or the amount calculated is lower, up to VND 3 billion.
- Other violations: up to VND 3 billion.
- The maximum for an individual is half that for an organisation.
The fine for each specific act is set by the regulations on administrative penalties.
The 5%-of-revenue cap applies only to violations of the rules on cross-border data transfers, and it is a maximum, not a general fine for every violation. Besides administrative penalties, the business may be sued for damages or lose contracts with partners. Buying, selling or unlawfully publishing another person’s private information online may lead to criminal liability if all elements of the offence are present (for example, Article 288 of the Penal Code).
6. Quick comparison: Vietnamese law and the GDPR
Businesses with partners or a parent company in the EU are often familiar with the GDPR (Regulation (EU) 2016/679). GDPR compliance is an advantage, but it does not replace compliance with Vietnamese law.
| Criterion | Vietnam | EU (GDPR) |
|---|---|---|
| Impact assessment | Prepare a dossier and send the original to the specialised authority within 60 days | Prepared when processing is likely to result in a high risk; consult the supervisory authority when a high risk has not been mitigated |
| Transfers abroad | Prepare a cross-border transfer impact assessment dossier and send it within 60 days (unless exempt) | Based on adequacy decisions, standard contractual clauses, binding corporate rules, etc. |
| Breach notification | No later than 72 hours after discovery, to the specialised authority | Within 72 hours after becoming aware, to the supervisory authority (unless unlikely to result in a risk) |
| Maximum fines | 10 times the revenue obtained; 5% of the previous year’s revenue (cross-border); VND 3 billion (other violations) | EUR 20 million or 4% of total worldwide annual turnover of the previous year, whichever is higher |
Analysis: The biggest difference is the administrative procedure. Under the GDPR, an impact assessment is mainly an internal document. In Vietnam, the dossier must be sent to the specialised authority within the statutory deadline. A business that already complies with the GDPR can reuse its data map and existing policies, but it still needs to prepare dossiers on the forms of Decree No. 356/2025/ND-CP.
7. Where should your business start?
A 5-step roadmap- Map your data: systems, types of data, purposes, storage locations
- Complete your policies, consent mechanism and contracts with providers
- Prepare and file the Form No. 10 dossier (and Form No. 09, if applicable)
- Encryption, access control, multi-factor authentication, access logs
- Appoint a person in charge, train staff, run incident drills
Self-check table
If you answer “not yet” to two or more questions, your business should make an assessment of its current state a priority:
- Do you have a complete list of the systems that store personal data?
- Do your forms separate consent by purpose, and can you keep evidence of it?
- Have you prepared and filed your impact assessment dossier under Decree No. 356/2025/ND-CP?
- Are you using services with servers abroad without having assessed the data transfer?
- Have you appointed a person in charge, and do you have a 72-hour incident notification scenario?
To go deeper into each part, see FC Legal’s articles on impact assessment dossiers, transferring data abroad and protecting employee data.
8. Frequently asked questions
Is Decree No. 13/2023/ND-CP still in force?
No. From 1 January 2026, Decree No. 13/2023/ND-CP is replaced by Decree No. 356/2025/ND-CP, at the same time as Law No. 91/2025/QH15 comes into force. Consent and impact assessment dossiers obtained under Decree 13 can still be used under the transitional provisions, but any update must follow the new rules.
Do small businesses need to prepare an impact assessment dossier?
Micro businesses are exempt. Small businesses and start-ups may choose for 5 years from 1 January 2026 (Article 41, Decree No. 356/2025/ND-CP). The exemption does not apply if the business provides data processing services, processes sensitive data or processes the data of a large number of data subjects.
Does using an international cloud service count as transferring data abroad?
It may, if personal data is stored on or accessed from servers abroad. The business needs to identify the specific data flows and check them against the exempt cases. If not exempt, it must prepare a cross-border transfer impact assessment dossier and send it to the specialised authority within 60 days.
Which violations does the 5%-of-revenue fine apply to?
Under Article 8 of Law No. 91/2025/QH15, the maximum of 5% of the previous year’s revenue applies only to organisations that violate the rules on cross-border data transfers. Buying or selling data carries a maximum of 10 times the revenue obtained; other violations, a maximum of VND 3 billion.
Do we have to recruit a dedicated data protection officer?
You do not have to recruit someone new. The business can appoint an existing department or staff member who meets the conditions in Article 13 of Decree No. 356/2025/ND-CP, or hire an organisation or individual that provides personal data protection services.
9. Legal basis and references
- Law on Personal Data Protection No. 91/2025/QH15 of 26 June 2025.
- Decree No. 356/2025/ND-CP of 31 December 2025 detailing the Law on Personal Data Protection.
- Decree No. 13/2023/ND-CP of 17 April 2023 (no longer in force from 1 January 2026).
- Civil Code 2015 (Article 38); Penal Code 2015, amended in 2017 (Article 288).
- Law on Cybersecurity No. 24/2018/QH14; Law on Electronic Transactions No. 20/2023/QH15.
- Regulation (EU) 2016/679 (GDPR), Articles 33, 35, 36, 44–49, 83.
- Sources consulted: thuvienphapluat.vn, luatvietnam.vn, eur-lex.europa.eu.
Review your personal data compliance with an FC Legal lawyer
Find out what data your business processes, where it is, which risks to prioritise and which dossiers you must prepare.
- Data map and compliance gap assessment
- Drafting the impact assessment dossier (DPIA) and the cross-border transfer dossier
- Standardising policies, vendor contracts and the incident response process
Please do not send confidential documents or personal data through the form.
This article is for reference. It reflects the rules in force at the time of publication. For legal advice on a specific case, please contact an FC Legal lawyer.
Prepared by the FC Legal legal team and reviewed by FC Legal’s Managing Lawyer. Updated 4 October 2026.
