Vietnam
Law on Personal Data Protection 2025
Law on Personal Data Protection No. 91/2025/QH15, with Decree 356/2025/ND-CP
Read the lawAs of 21 Oct 2026
Who needs a data protection officer (DPO)
Every organisation designates a capable data-protection unit or staff, or hires a provider. Small enterprises and startups may defer this for 5 years and micro-businesses are exempt, unless they sell data-processing services, process sensitive data, or process data on 100,000 or more people.
As of 21 Oct 2026
When a breach must be reported
A violation that may harm national defence, national security or public order and safety, or a person's life, health, honour, dignity or property: report to the agency no later than 72 hours after discovering it.
As of 21 Oct 2026
Penalties
Administrative fines up to 5% of the previous year's revenue for cross-border transfer violations; 10 times the proceeds for trading in personal data; up to VND 3 billion for other violations.
As of 21 Oct 2026
Sources
- Law No. 91/2025/QH15 (PDF)As of 21 Oct 2026
- Decree 356/2025/ND-CP (PDF)As of 21 Oct 2026