Vietnam’s Personal Data Protection Law & Draft Decree: Compliance and Challenges

The current personal data protection (“PDP”) regime in Vietnam was introduced by Decree No. 13/2023/ND-CP dated 17 April 2023 (“Decree 13”), which laid the initial foundation for the development of a comprehensive legal framework governing the protection of personal data in Vietnam.

Two years on, the absence of effective and clearly articulated sanctions for non-compliance has resulted in low levels of adherence to PDP obligations among businesses operating in Vietnam.

A significant milestone was reached on 26 June 2025, when the National Assembly ratified the Law No.91/2025/QH15 on Personal Data Protection (“PDPL”), which is set to take effect on 1 January 2026. In the coming months, the Ministry of Public Security is expected to publish a draft decree detailing the implementation of the PDPL (“Draft Decree”).

These developments mark Vietnam’s transition into a decisive phase in the evolution of its PDP regulatory landscape. Businesses, ranging from domestic enterprises to foreign organizations operating within Vietnam, are now facing unprecedented compliance challenges, as non-compliance may give rise to administrative and financial penalties under the new regime.

This commentary outlines key issues, including:

  • Issue 1- Consent is Lawful Basis of Processing
  • Issue 2 - Ensuring Data Subject Rights and Protection
  • Issue 3 - Qualification and Obligations of the Data Protection Officer (DPO)
  • Issue 4 - Data Processing and Cross-Border Transfer Documentation

📄 Please download the full document below to discover more. 

Document

Forvis Mazars Legal Vietnam_​Thought catalysts_​Personal Data Protection Law

Contact us