Vietnam's personal data protection law: the latest update and what businesses should do for 2027

Since January 1, 2026, businesses in Vietnam have operated under a new legal framework for personal data: the Law on Personal Data Protection No. 91/2025/QH15, its implementing Decree 356/2025/ND-CP, and, from August 19, 2026, Decree 330/2026/ND-CP on administrative penalties. 2027 will be the first year in which all 3 layers are fully in force, which makes it a sensible moment to review how a business collects, stores and shares customer data.

One thing needs saying up front: as of October 20, 2026, Click Star has not found any new statute that takes effect specifically in 2027.

This article therefore summarizes what is in force, the milestones worth noting as 2027 begins, and a list of actions to take, based on the text of the instruments and on analyses by law firms and advisory firms. It is general information for businesses and does not replace legal advice for a specific case.

Key points

• The Law on Personal Data Protection was passed by the National Assembly on June 26, 2025 and took effect on January 1, 2026. Decree 356/2025/ND-CP, issued on December 31, 2025, also took effect on January 1, 2026 and replaced Decree 13/2023/ND-CP.
• Decree 330/2026/ND-CP, issued and effective on August 19, 2026, is the first dedicated administrative-penalty decree for this field according to the legal summaries Click Star reviewed.
• The maximum penalties are large: up to 5% of the previous year's revenue for cross-border transfer violations, up to 10 times the revenue gained from selling personal data, and up to VND 3 billion for other violations.
• Reporting a data breach within 72 hours of discovery, responding to a data subject's request within 2 working days and keeping consent logs are daily operating duties, not paperwork.
• Small enterprises and startups have 5 years from January 1, 2026 to decide whether to carry out impact assessments and appoint data protection staff, but this does not apply if the business directly processes sensitive data or provides data processing services.
• The most effective preparation is knowing where personal data sits: a central database with access control and logs makes it possible to meet deletion, correction and consent-withdrawal requests on time.

The framework in force

The Law on Personal Data Protection No. 91/2025/QH15 was passed by the National Assembly on June 26, 2025 and took effect on January 1, 2026, according to VnEconomy and legal information portals. Before it, Vietnam had only Decree 13/2023/ND-CP at sub-law level, and the 2025 Law builds on that foundation.

According to VnEconomy, the law applies to Vietnamese and foreign agencies, organizations and individuals in Vietnam, and to foreign organizations involved in processing the data of Vietnamese citizens.

Decree 356/2025/ND-CP, issued on December 31, 2025, details several articles and implementing measures of the law and replaces Decree 13/2023/ND-CP, according to analyses by EY Vietnam and Luat Viet An.

Points those analyses highlight include an adjusted list of basic and sensitive personal data, stricter consent requirements, clearer deadlines for data subjects' rights and conditions for cross-border transfers.

The third layer is Decree 330/2026/ND-CP on administrative penalties in cybersecurity and personal data protection. According to Bao Lao Cai and Luat Viet An, it was issued on August 19, 2026, took effect the same day and has 4 chapters and 82 articles.

Before it, these sources note, there was no dedicated penalty decree setting out the full list of violations and matching fines.

Because every source Click Star reviewed on this decree is a press or legal-firm summary, each figure below should be checked against the original text in the Official Gazette or the official legal database before it is relied on.

What is new for businesses

Data subject rights come with concrete deadlines. According to Luat Viet An's summary of Decree 356/2025/ND-CP, a business must respond within 2 working days to a request to withdraw consent or to restrict or object to processing.

Carrying out the withdrawal, restriction or objection takes 15 days (20 days if a processor or third party is involved). Viewing, correcting or providing data takes 10 days, and deleting data takes 20 days (30 days with a processor or third party).

Data-security expert Hoang Ha, quoted by VnEconomy, describes this as a move from "recognizing rights" to a mechanism for enforcing them responsibly.

Sensitive data is broader. According to Luat Viet An, the sensitive-data list now also covers data on unlawful acts (not only those prosecuted criminally), spells out banking data (login names, passwords, card details, transaction history) and adds securities and insurance data and behavior-tracking data from telecoms, social networks and online services.

This matters especially for websites and apps that carry behavior-tracking code.

Consent remains central, with conditional exceptions. The law firm Tilleke & Gibbins says the law keeps a consent-centered model while adding cases that do not need consent, such as processing needed to perform a contract with the data subject or to protect legitimate rights and interests.

The "legitimate interest" basis is much narrower than under the European GDPR. For children's data, parental consent is generally needed, and where the data concerns the private life of a child aged 7 or over, both the child and the parent must consent, according to Tilleke.

Selling data is prohibited. According to VnEconomy and Tilleke, the law prohibits buying and selling personal data unless otherwise provided by law, and excludes some transfers from counting as a "sale", such as transfers with consent, internal sharing for the stated purpose, transfers during corporate restructuring or at the request of state authorities.

Breach reporting within 72 hours. According to Tilleke and Luat Viet An (Form No. 08), a business must report a breach within 72 hours of discovering it, rather than of its occurrence as under the old rule. For biometric data, or where the business provides financial services, affected data subjects must also be notified.

Cross-border transfers are tighter. According to Luat Viet An, Article 18 of Decree 356/2025/ND-CP requires a transfer impact assessment (Form No. 09), notice to the Ministry of Public Security and a written agreement binding the overseas recipient to legal responsibility. This directly affects businesses that use servers, cloud software or marketing tools hosted abroad.

Requirements for data protection staff. According to Luat Viet An, Article 13 requires the person responsible for data protection to hold at least a college-level qualification, have at least 2 years of experience in a related field (legal, IT, cybersecurity, risk management) and have been trained in personal data protection.

Penalties: the numbers to know

According to Tilleke, cross-border transfer violations can be fined up to 5% of the previous fiscal year's revenue, and if the business had no revenue or the calculated amount is below VND 3 billion, VND 3 billion applies.

Other personal data violations are fined up to VND 3 billion, and illegal sale of data is fined up to 10 times the revenue gained from the violation. These caps are recorded consistently across the several analyses Click Star reviewed.

For common day-to-day conduct, the summaries of Decree 330/2026/ND-CP by Luat Viet An and Bao Lao Cai give the amounts below. They should be checked against the original text, because in places the 2 sources do not match on the ceiling of each group:

• Processing data without consent, pre-ticking consent, lacking transparency or failing to keep consent logs: VND 30 to 50 million.
• Treating silence as consent, or continuing to process after the data subject has asked to stop: VND 50 to 70 million.
• Not preparing or not updating a data processing impact assessment: VND 20 to 30 million.
• Refusing a valid access request from a data subject: VND 10 to 20 million.
• For social networks and online platforms, missing privacy notices or cookie consent: VND 50 to 70 million, and collecting beyond the agreed scope or covertly accessing calls or messages: VND 70 to 150 million.

Beyond fines, the summaries cite remedial measures such as forced destruction or deletion of data beyond recovery, forced return of unlawful gains and, in some cases, a forced public apology to data subjects.

Do small businesses get any exemption

Under the text of the Law on Personal Data Protection, Article 38 gives small enterprises and startups the right to choose whether or not to carry out the impact assessment and appoint a data protection department or staff for 5 years from the law's effective date, that is until around the start of 2031.

Household businesses and micro-enterprises are not required to carry out these duties.

Article 39 of the law also lets processing already based on consent or an agreement under Decree 13/2023/ND-CP continue without asking for consent again, and impact assessment files accepted by the competent authority before the effective date remain usable.

What matters are the exceptions. According to Tilleke and the law's text, the right of choice and the exemption do not apply to entities that provide personal data processing services, directly process sensitive data or process the data of a large number of data subjects.

An analysis by the Vietnam Chamber of Commerce and Industry (VCCI) gives examples such as fintech, e-commerce and digital marketing companies.

In other words, a small e-commerce company that keeps customers' phone numbers, addresses and purchase history still needs to assess carefully whether it qualifies, and the other duties such as consent, data subject rights and breach reporting apply as normal.

What to do as 2027 begins

Click Star's view. For businesses that operate online, the hard part of compliance is usually not reading the law but knowing where customers' personal data actually sits. The list below is in the order Click Star suggests working through it:

1. Build a data map: list every place that holds customer data (website, forms, Zalo, CRM, spreadsheets, advertising tools, third-party vendors), the type of data and the purpose of use.
2. Review consent: remove pre-ticked boxes, state the purpose, make withdrawing consent as easy as giving it, and keep a log (who consented, when, for what purpose, through which channel).
3. Update the privacy policy and the data collection notices at every touchpoint, including the cookie banner and the tracking code on the website.
4. Build a process for answering data subject requests within the deadlines of 2 working days, 10, 15 and 20 days above, with a named owner and a system that can find all of one customer's data.
5. Prepare an incident response plan that can report within 72 hours: who decides, who contacts the authorities, who notifies customers and with what message.
6. Review contracts with vendors and data processors, especially services hosted outside Vietnam, so that a binding agreement and a transfer impact assessment exist where needed.
7. Decide on data protection staff or a department: do it in-house, outsource it or use the 5-year option if it applies, and record the decision.
8. Train sales, customer care and marketing staff, because most risk comes from daily actions such as sending customer files through personal messages or sharing lists with partners.

One date to put in the calendar: the impact assessment and the transfer impact assessment must be updated every 6 months when something changes, according to Tilleke, so businesses that have filed should schedule a review for mid-year and year-end.

Why a central database is the compliance foundation

Most of the duties above come down to one capability: finding, correcting and deleting the right data of the right person, and being able to prove it. If customer data is scattered across many spreadsheets, chat groups and tools, a deletion request due in 20 days or a breach report due in 72 hours is very hard to meet.

A central database with role-based access, access logs and recorded consent turns these duties into actions that can be carried out and checked. Click Star has a separate article on why businesses should use a database in online operations, and this is one practical reason to consider it as early as 2027.

Common mistakes

1. Assuming the law applies only to large companies or technology companies, when any business that collects phone numbers, emails or addresses is processing personal data.
2. Reading the small-business exemption as a full exemption. It relates only to certain duties and has exceptions for sensitive data, data processing services and data scale.
3. Treating consent as a tick box on a form, with no log and no way to withdraw.
4. Using cloud services or marketing tools hosted abroad without reviewing the cross-border transfer duties.
5. Having a policy on paper but no process or owner to meet the legal deadlines.
6. Relying on a single summary, this one included, without checking the original text and consulting a lawyer on high-risk decisions.