Personal Data Law

On 26 June 2025 the of Vietnam passed the Personal Data Protection Law, the first law on this subject in Vietnam (the “Law”).  The Law will come into force on 1 January 2026. The Law introduces several new concepts, exemptions, and obligations.  Some salient features of the Law include: 

- The term “personal data” will include basic personal data and sensitive personal data as further defined by the guiding legislation to be issued by the government. 

- As a general rule, the collection, processing, storage and transfer of personal data is subject to the consent of the owner, with very few exceptions specified by the Law. 

- For certain cases specified by the law, the data controller or processor are required to conduct the data processing impact assessment (DPIA) and transfer impact assessment (TIA) remain unchanged. However, there are new exemptions for the TIA, including for the processing and storing in the cloud of employee data, and when the data subject is the person sending its own data outside of Vietnam. 

- The Law provides for administrative fines which will depend on the type of violation. For example, the fine for sale and purchase of personal data will be 10 times the revenue from the sale or VND 3 billion, whichever is higher.