Vietnam’s Personal Data Protection Law & Draft Decree: Compliance and Challenges
Two years on, the absence of effective and clearly articulated sanctions for non-compliance has resulted in low levels of adherence to PDP obligations among businesses operating in Vietnam.
A significant milestone was reached on 26 June 2025, when the National Assembly ratified the Law No.91/2025/QH15 on Personal Data Protection (“PDPL”), which is set to take effect on 1 January 2026. In the coming months, the Ministry of Public Security is expected to publish a draft decree detailing the implementation of the PDPL (“Draft Decree”).
These developments mark Vietnam’s transition into a decisive phase in the evolution of its PDP regulatory landscape. Businesses, ranging from domestic enterprises to foreign organizations operating within Vietnam, are now facing unprecedented compliance challenges, as non-compliance may give rise to administrative and financial penalties under the new regime.
This commentary outlines key issues, including:
- Issue 1- Consent is Lawful Basis of Processing
- Issue 2 - Ensuring Data Subject Rights and Protection
- Issue 3 - Qualification and Obligations of the Data Protection Officer (DPO)
- Issue 4 - Data Processing and Cross-Border Transfer Documentation
📄 Please download the full document below to discover more.
Contact us
