The Personal Data Protection Law (Law No. 91/2025/QH15) was passed by the National Assembly on 26/6/2025 and takes effect on 1/1/2026. The Government issued Decree 356/2025/ND-CP on 31/12/2025 to provide detailed regulations, effective the same day, 1/1/2026, replacing Decree 13/2023/ND-CP. This article is a consolidated handbook so that enterprises know what to review.

1. Key points of the Law

  • Rights of data subjects (Article 4): to be informed, to consent or withdraw consent, to access, correct, delete or restrict processing, to object, to complain and to claim compensation.
  • Prohibited acts (Article 7): including buying and selling personal data (except where other laws allow) and deliberately disclosing or losing personal data.
  • Breach notification: when a violation may harm national defense, security, public order, social safety or the rights of individuals, the specialized authority must be notified no later than 72 hours from discovery (Article 23).
  • Personal data protection officer: an organization needs a suitable unit or individual, or must hire a qualified personal data protection service. Small enterprises and start-ups are exempt from this obligation for 5 years from 1/1/2026 according to public legal summaries; the specific conditions must be checked against the original text.
  • Cross-border data transfers: an impact assessment must be carried out before transferring.
  • Finance and banking sector (Article 27): comply with the rules on sensitive data, do not use credit information to score or rank without consent, and notify when information is exposed or lost.
  • Social networks (Article 29): must not require images or videos of identity documents to authenticate accounts.

2. Penalties to know

  • Violating the rules on cross-border transfer of personal data: a maximum fine of 5% of the preceding year's revenue (Article 8).
  • Buying and selling personal data: the fine, according to public legal summaries, is 10 times the unlawful revenue.
  • Other violations in this area: a maximum fine of VND 3 billion, as described by the State Bank of Vietnam.
  • Depending on severity, violators may also face criminal liability and must compensate for damages.

The figures above are compiled from public sources. Specific penalties depend on the conduct and the sanctions instruments in force, so the original texts should be checked.

3. What does Decree 356/2025 add?

The Decree details the 72-hour incident notification procedure (form No. 08), sets deadlines for responding to data subject requests, and adds specific requirements for finance and banking, big-data processing (multi-factor authentication and strict authorization are mandatory), AI systems and the competency requirements for personal data protection staff. For details see the article Decree 356/2025/ND-CP: new rules on data incident notification.

4. Ten things an enterprise can start with

  1. Inventory personal data: what data is collected, about whom, where it is stored and who it is shared with.
  2. Determine the legal basis and consent: each processing purpose needs a clear basis, and evidence of consent must be retained.
  3. Classify sensitive data and apply a higher level of protection.
  4. Appoint a person or unit in charge of personal data protection, or consider hiring a suitable service.
  5. Build a process for meeting data subjects' rights with clear response deadlines.
  6. Prepare a 72-hour incident response process, including notification templates and contact points.
  7. Review contracts with processors and partners who have access to personal data.
  8. Assess cross-border data transfers, including when using a foreign provider's platform.
  9. Apply technical measures: encryption, role-based permissions, multi-factor authentication and access logs.
  10. Train staff and test periodically.

5. Where does technology help?

The 72-hour notification requirement is only feasible when the enterprise knows which documents were affected, who accessed them and when. Data-Centric Security platforms such as the product support file encryption, per-user permissions and audit logging, helping shorten the time needed to establish the scope of an incident. Technology is only one part of compliance and does not replace policy, processes and legal advice. You can start with the free compliance assessment to identify the items to review.

Related real-world cases

Many data incidents originate from an organization's own staff and partners: a security guard viewing medical records with no work reason, a contractor's stolen login credentials.

The above content is compiled from public sources at the time of writing, for reference only and not legal advice. Enterprises should check the original texts and consult legal professionals before applying it, especially for transitional provisions and implementing guidance.

Reference sources

Related articles

Decree 356/2025/ND-CP: new rules on data incident notificationDecree 13/2023 on personal data protection: what enterprises need to knowYakima hospital: 23 security staff viewed the medical records of 419 patients for non-work reasonsAll Case Studies and resources