Vietnam's Regulatory Landscape at a Glance
Vietnam's framework was built first through Decree 13/2023 and subsequently placed on a statutory footing by a Personal Data Protection Law, with the Ministry of Public Security as the supervising authority. The Cybersecurity Law and its implementing decree add data localisation and local presence requirements for certain services, and sectoral licensing applies alongside.
The requirements applicable to an organisation depend on its activities, sector, processing operations, and regulatory status.
- Jurisdiction
- Vietnam
- Framework that established the regime
- Decree 13/2023/ND-CP on Personal Data Protection, effective 1 July 2023
- Primary legislation
- A Personal Data Protection Law has been enacted; confirm its commencement and transitional provisions
Key Regulations in Vietnam
Decree 13/2023 on Personal Data Protection
Decree 13/2023/ND-CP took effect on 1 July 2023 and established Vietnam's first comprehensive personal data protection regime. It applies to agencies, organisations, and individuals processing personal data in Vietnam, to Vietnamese entities operating abroad, and to foreign organisations processing the personal data of Vietnamese citizens.
It distinguishes basic personal data from sensitive personal data, defines controller, processor, controlling-and-processing party, and third party roles, and is consent-centric with consent required to be express, clear, and capable of being evidenced.
Depending on applicability, organisations may need to address:
- Express consent, separately obtained for sensitive personal data.
- Notice to data subjects before processing begins.
- A personal data processing impact assessment dossier.
- A cross-border transfer impact assessment dossier where data leaves Vietnam.
- Designation of a department and personnel responsible for personal data protection.
- Security measures and breach notification.
- Specific rules on sensitive data, children's data, and marketing.
- Records available for inspection by the authorities.
Confirm the extent to which Decree 13 remains operative following enactment of the Personal Data Protection Law, and which provisions have been superseded.
The Personal Data Protection Law
Vietnam has enacted a Personal Data Protection Law to replace the decree-based regime with primary legislation, raising the framework's legal status, consolidating obligations, and introducing a penalty structure set in statute rather than through administrative sanctions decrees.
Because the transition from Decree 13 to the Law involves commencement dates, transitional provisions, and implementing decrees, the operative position should be established from official sources rather than from any secondary summary.
Areas to verify in the current law may include:
- Which provisions are in force and from what date.
- Whether and how Decree 13 continues to apply.
- The applicable penalty structure and maximum amounts.
- Changes to the impact assessment and filing requirements.
- Any new requirements for data protection officers or organisational structures.
- Rules on data brokerage and the sale of personal data.
This is the single most verification-sensitive item on this page. Treat the statutory detail as requiring confirmation before it is relied upon.
Impact Assessment Dossiers
Vietnam's most operationally distinctive requirement is procedural. Controllers and processors must prepare a personal data processing impact assessment dossier, and where personal data of Vietnamese citizens is transferred abroad, a separate cross-border transfer impact assessment dossier.
Under Decree 13, these dossiers had to be kept available at all times and submitted to the Ministry of Public Security within sixty days of commencing processing or transfer, with updates filed when particulars changed.
Organisations preparing dossiers may need to consider:
- The prescribed content, including purposes, data types, recipients, and retention.
- The deadline for filing after processing or transfer begins.
- Obligations to update the dossier when circumstances change.
- Who within the organisation signs and is accountable for the dossier.
- That the dossier is subject to inspection and assessment by the authorities.
Filing deadlines and dossier content should be confirmed against the current law, as they are among the provisions most likely to have changed in the transition.
Cross-Border Transfers
Transferring the personal data of Vietnamese citizens outside Vietnam is permitted but regulated through the dossier mechanism rather than an adequacy list or prescribed contractual clauses. The transferring party remains responsible and must be able to demonstrate the assessment it carried out.
The authorities may inspect transfers, request amendments to arrangements, and in defined circumstances require a transfer to stop.
Organisations transferring data out of Vietnam may need to consider:
- Preparation and filing of the cross-border transfer dossier.
- Documentation of the recipient, purposes, and safeguards.
- Data subject consent to the transfer where consent is the basis.
- The authority's power to require a transfer to cease.
- Interaction with data localisation duties under the Cybersecurity Law.
Vietnam's approach is filing-based rather than mechanism-based, so compliance turns on documentation lodged with the authorities.
Cybersecurity Law and Data Localisation
The Cybersecurity Law of 2018 and Decree 53/2022 impose data localisation and local presence requirements on certain domestic and foreign service providers, applying on a case-by-case basis following a request from the Ministry of Public Security rather than automatically to all providers.
Where the requirement is triggered, specified categories of data must be stored in Vietnam for a prescribed period and the provider must establish a branch or representative office.
Organisations in scope may need to consider:
- Whether their service falls within the categories that can trigger localisation.
- The categories of data required to be stored in Vietnam.
- The requirement to establish a branch or representative office.
- Data retention periods specified by the decree.
- Obligations to provide information to the authorities on request.
Localisation under the Cybersecurity Law is generally triggered by a specific request, so status should be assessed rather than assumed.
Marketing, Children's Data and Sectoral Rules
Vietnamese law contains specific provisions on using personal data for marketing and advertising, which generally require the data subject's consent and awareness that their data is being used for that purpose. Children's data attracts additional protections, including verification of age and parental consent below the specified age.
Sectoral requirements apply in banking, telecommunications, healthcare, and e-commerce, administered by the relevant ministries.
Sectoral and specific considerations may include:
- Consent and transparency for marketing and advertising uses.
- Age verification and parental consent for children's data.
- Banking and payment sector data requirements.
- Telecommunications and e-commerce licensing obligations.
- Healthcare confidentiality requirements.
Who Needs to Comply With Vietnamese Data Protection Law?
Vietnam's personal data protection requirements may apply to:
Organisations in Vietnam
Agencies, organisations, and individuals processing personal data within Vietnamese territory.
Foreign organisations
Entities outside Vietnam that process the personal data of Vietnamese citizens, which brings them within scope.
Vietnamese entities operating abroad
Vietnamese agencies and organisations processing personal data outside Vietnam.
Controllers and processors
Both roles carry obligations, and Vietnamese law also recognises a combined controlling-and-processing party.
Service providers subject to localisation
Providers of specified services that may be required to store data in Vietnam and establish a local presence.
Employers
Organisations handling employee and candidate data, including health information treated as sensitive personal data.
The precise obligations depend on the organisation's role, processing activities, size, risk profile, and territorial scope.
Understanding Your Obligations Under Vietnamese Law
Consent and Notice
Consent is the central basis for processing and must be given freely and expressly, with the data subject knowing the type of data, the purpose, who will process it, and their rights. Silence or non-response does not constitute consent, and consent must be capable of being evidenced in writing or another verifiable form.
Sensitive personal data requires the data subject to be notified expressly that the data is sensitive.
Impact Assessment Dossiers
Controllers and processors must prepare a processing impact assessment dossier, and a separate dossier for cross-border transfers of Vietnamese citizens' data, keep them available at all times, and file them with the Ministry of Public Security within the prescribed period after processing or transfer begins.
This filing requirement has no close equivalent in most other regimes and is often the first obligation overlooked.
Designated Responsibility
Organisations must designate a department and personnel responsible for personal data protection and provide their details to the authorities. Requirements are lighter for smaller organisations and start-ups in defined circumstances, subject to conditions.
Security and Breach Notification
Technical and organisational measures must be in place to protect personal data. Where a breach of personal data protection regulations occurs, the controller must notify the authority within the prescribed period, which under Decree 13 was seventy-two hours from becoming aware, with reasons required where notification is late.
Confirm the current notification period and format against the law in force.
Processor Arrangements
Processing by another party must be governed by a contract or agreement specifying the scope and purpose, and the processor may process only within what has been agreed. The controller remains responsible for the processing carried out on its behalf.
Retention and Deletion
Personal data must be deleted or returned when the purpose has been achieved, consent is withdrawn, or the data subject requests deletion, subject to exceptions including legal requirements and ongoing proceedings, generally within the period prescribed by the regulations.
Data Subject Rights Under Vietnamese Law
Vietnamese law gives data subjects a number of rights over their personal data. Depending on the circumstances, these may include:
Right to Be Informed
Data subjects must be informed of the processing activities relating to their personal data, except where the law provides otherwise.
Access and Correction
Data subjects may access their personal data to view and request correction of inaccurate or incomplete data.
Withdrawal of Consent
Data subjects may withdraw consent, which does not affect the lawfulness of processing carried out before withdrawal.
Deletion
Data subjects may request deletion of their personal data, subject to the exceptions set out in the regulations.
Restriction and Objection
Data subjects may request restriction of processing and may object to processing, including for marketing and advertising.
Complaint and Compensation
Data subjects may complain, denounce, or bring legal proceedings and claim compensation for damage caused by unlawful processing.
Requests must generally be actioned within the period prescribed by the regulations, which is shorter than the one-month standard common elsewhere.
Vietnam's Regulatory Timeline
Vietnam moved from no comprehensive regime to primary legislation in a few years.
- January 2019
Cybersecurity Law in Force
The Cybersecurity Law took effect, introducing the framework for data localisation and local presence requirements.
- August 2022
Decree 53/2022 Issued
The implementing decree set out the categories of data and services subject to localisation and local presence requirements.
- July 2023
Decree 13/2023 in Force
Vietnam's first comprehensive personal data protection regime took effect, introducing consent rules and the impact assessment dossier requirement.
- 2025 onwards
Primary Legislation Enacted
A Personal Data Protection Law was enacted to place the regime on a statutory footing, with commencement and transitional arrangements to be confirmed.
Important: this page describes a framework in transition from decree to statute. The provisions in force, the penalty structure, and the status of Decree 13 should all be confirmed against official sources before being relied upon.
Data Protection Authorities in Vietnam
The Ministry of Public Security supervises personal data protection in Vietnam, principally through its Department of Cybersecurity and High-Tech Crime Prevention, commonly referred to as A05. It receives impact assessment and cross-border transfer dossiers, inspects and assesses them, investigates incidents, and takes enforcement action.
Other authorities are relevant depending on the activity, including the ministry responsible for information and communications for telecommunications and online services, the State Bank of Vietnam for banking, and sector ministries for healthcare and e-commerce.
Supervision sitting with the Ministry of Public Security rather than an independent commission is a distinctive feature of the Vietnamese regime.
Penalties for Non-Compliance
Vietnam's sanction structure is the element most affected by the move from decree to primary legislation. Under the decree-based regime, enforcement ran through administrative sanctions, inspection findings, and powers to require processing or transfers to stop, alongside existing criminal provisions for serious conduct such as unlawful trading in personal information.
The Personal Data Protection Law was enacted in part to set penalties in statute, including turnover-linked maximums for certain categories of violation. Because the applicable figures and their commencement depend on the Law and its implementing decrees, this page does not quote specific amounts. The current penalty structure should be confirmed from official sources before any assessment of exposure.
How RegulatoryBridge Supports Compliance in Vietnam
RegulatoryBridge helps organisations assess Vietnam's regulatory requirements and coordinate their compliance activities with wider international programmes.
PDP Compliance Assessment
Review your processing activities, legal bases, notices, policies, governance arrangements, and operational controls to identify potential gaps.
Governance and Impact Assessment Filing
Review how data protection responsibility is allocated, and the preparation and filing of the impact assessment dossiers Vietnamese law requires to be lodged with the authorities.
Data Subject Rights
Review request-handling processes, response timelines, privacy notices, and related documentation against the requirements applicable to you.
Breach Response and A05 Notification
Evaluate breach assessment procedures, escalation responsibilities, A05 notification readiness, and coordination between privacy, security, and legal teams.
International Data Transfers
Assess transfers of Vietnamese citizens' personal data abroad, the cross-border transfer dossier requirement, and the records that must be available for inspection.
Sectoral Compliance Coordination
Help organise requirements across personal data protection, the Cybersecurity Law, data localisation rules, and sectoral licensing.
Regulatory Monitoring
Monitor relevant developments and review compliance plans when legislation, A05 guidance, or enforcement decisions change.
The scope of support is tailored to the organisation's activities, risk profile, and applicable legal requirements.
Our Approach to Vietnam Compliance
- 01
Identify Applicable Requirements
Assess your organisation's activities, role in processing personal data, industry, and connections to Vietnam.
- 02
Map Regulatory Obligations
Identify applicable provisions, relevant authorities, effective dates, and sector-specific requirements.
- 03
Conduct a Gap Assessment
Review existing policies, notices, consent mechanisms, contracts, security controls, and operational processes.
- 04
Develop a Compliance Roadmap
Prioritise remediation activities and establish owners, milestones, documentation requirements, and implementation plans.
- 05
Maintain Ongoing Readiness
Review regulatory developments, reassess relevant obligations, and update compliance processes when required.
Frequently Asked Questions About Vietnam Compliance
Need Vietnamese data protection support?
We support your impact assessment dossiers, cross-border transfer filings, and Ministry of Public Security interactions - so your global product team doesn't have to.