The White Paper "Personal Data Protection under Vietnamese Law", compiled by AISA, helps enterprises understand the regulations, identify risks and build a practical compliance roadmap. The document has 14 pages in four parts; a summary follows below. The full version can be downloaded or viewed online with the buttons above; a Vietnamese edition is also available.
Part I · Why act now
If just one of the signs below applies, the enterprise already processes personal data and falls under Law 91/2025/QH15:
- You have employees or job applicants (HR files, payroll, insurance, ID cards).
- You have individual customers (names, phone numbers, emails, delivery addresses).
- You use CCTV or biometric time clocks (fingerprints and faces are sensitive data).
- You use cloud, email, software or AI, especially with servers located abroad.
- You send data to partners such as accounting, banks, insurers, logistics and agents.
The document sets out three things leaders need to know: personal data is everywhere (encrypted data is still personal data); this is an operational problem, not just a matter for the legal team; and the enterprise must hold evidence, because in a dispute the enterprise is the party that has to prove its case. A data incident affects four areas: customers and employees, operations, finances and business opportunities.
On cost, according to the IBM Cost of a Data Breach Report 2025, a breach at an enterprise with a high level of uncontrolled AI use (shadow AI) costs on average about VND 17.5 billion more (≈ USD 670,000). The White Paper also illustrates three everyday situations that can create legal obligations: sending payroll to a partner, uploading customer records to an AI tool, and clocking in with a fingerprint or face.
Part II · Obligations to understand
- By sector and size: the law applies to every organization. The exemption covers only three obligations on records and staffing, not a full exemption.
- A three-layer legal framework: foundation obligations (Law 91/2025/QH15, Decree 356/2025/ND-CP); activity-based requirements (the Data Law, the Cybersecurity Law, the Artificial Intelligence Law and implementing decrees); and sanctions (Decree 330/2026/ND-CP).
- Roles: controller, processor, controller-processor, third party. Obligations follow roles, so the right role must be determined first.
- Cross-border data transfers: three cases, including using a platform abroad to process data collected in Vietnam.
- Basis for processing and individuals' rights: obtain consent for each purpose and keep a consent log; every request from a data subject must be answered within 02 working days, and then carried out within the deadline for each type of request.
- Records, staffing and suppliers: the impact assessment (DPIA) file, the cross-border transfer file, personnel or a unit for data protection, data-transfer contracts and cloud-service contracts.
Sanctions for non-compliance
The usual maximum fine is VND 3 billion; violating the rules on transferring data abroad can be fined up to 5% of the preceding year's revenue; buying and selling personal data is fined 10 times the proceeds obtained. The White Paper includes a table of fines by act (for example, processing without consent: VND 30–50 million; notifying the specialized authority more than 72 hours late: VND 40–60 million). The maximum fine is not the fine that will be imposed, and operational consequences often arrive before the fine.
Part III · Implementation and DCS
AI is not banned. What is needed is to know which data goes in, where it is processed and how the output is used. The document sets out five control points: approved tools, input data, vendors and subcontractors, output, and retention and deletion.
Data protection rests on three pillars: process, people and technology; without one pillar, the other two lose effectiveness. Decree 356/2025 requires measures against internal staff sharing data without authorization. This is a point where process and people need an added layer of control right on the data file, which Data-Centric Security such as DCS supports.
Part IV · Where to start
The White Paper proposes a 90-day foundation roadmap: days 1–30 Identify (inventory data, map data flows, determine roles and bases), days 31–60 Establish (DPIA, transfer file, supplier contracts, consent and rights processes), days 61–90 Verify (testing, a 72-hour incident drill, training). The roadmap is a recommendation for organizing the work and does not replace or extend legal deadlines.
