Personal data privacy compliance in Vietnam.
Ensure your business adheres to Vietnam’s stringent personal data protection regulations with Acclime experts and avoid severe penalties for non-compliance.
Safeguard your business with comprehensive data privacy compliance.
Localised expertise
Tailored solutions
Risk mitigation
Vietnam’s Decree 13/2023/ND-CP on Personal Data Protection, effective from 1 July 2023, establishes comprehensive requirements for personal data processing. Organisations must obtain prior consent from individuals and adhere to established principles and reporting obligations.
However, with the enactment of the Personal Data Protection Law (PDPL), which will take effect from 1 January 2026, Decree 13 will be replaced by a more robust and enforceable legal framework. The PDPL expands on Decree 13’s foundations and introduces stricter compliance requirements, broader scope, and heavier penalties for violations.
While both Decree 13 and the PDPL share similarities with the EU’s GDPR, compliance with GDPR does not automatically ensure compliance with Vietnam’s regulations. The PDPL mandates localised processes, sector-specific obligations, and impact assessments that align with Vietnam’s legal context, including fulfilling reporting obligations with local authorities.
Organisations without data privacy measures must establish proper policies, mechanisms, and fulfil reporting requirements. Those already following the EU’s GDPR or other foreign data privacy regimes must review and align their practices with Vietnam’s evolving requirements and complete all necessary compliance steps under the PDPL.
Personal data privacy compliance services
Comprehensive solutions for data protection.
Reporting support
Assistance with preparing and submitting mandatory reports — including the Data Processing Impact Assessment (DPIA) and the Overseas Data Transfer Impact Assessment (TIA) — to Vietnamese authorities within the required timeframes.
Personal data privacy advisory
Expert guidance on Vietnamese PDP laws and customised recommendations for your organisation’s specific needs.
Standard policy and template package
Comprehensive set of ready-to-use policies and templates that meet Decree 13 requirements.
Contract template and documentation review
Assessment of existing contracts and documents to ensure compliance with Vietnamese data protection standards.
For new businesses and those without data privacy measures, we provide clear strategic guidance, establish comprehensive mechanisms including policies and templates, and assist with reporting.
For organisations adopting GDPR or other foreign data privacy regimes, we leverage existing practices, advise on necessary adjustments to ensure compliance with localised regulations, and assist with required reporting.
FAQ
Common questions.
Fundamentals
Currently, Vietnam’s Decree 13/2023/ND-CP (Decree 13) applies to all businesses and organisations, whether domestic or foreign, that process personal data of individuals in Vietnam. From 1 January 2026, the Personal Data Protection Law 2025 (PDPL) will take effect, replacing Decree 13 and introducing broader and stricter obligations.
Compliance covers the full lifecycle of personal data processing, not only collection but also storage, use, transfer, and deletion. Its provisions directly impact the handling of personal data of both internal parties (such as employees, contractors, and management) and external parties (such as customers, suppliers, and online visitors).
It is important to clarify that the scope of compliance is not limited to businesses. It extends to all types of entities, such as representative offices, branches of foreign traders, ticketing offices, project management offices, and even foreign government trade representatives in Vietnam, as well as Vietnamese government agencies. Moreover, individuals involved in data control and processing activities are also subject to compliance requirements. Consequently, any penalties for non-compliance, if applicable, may also apply to these non-business entities and individuals.
Personal data covers any information that identifies or can identify an individual, in any form such as written, electronic, audio, visual, or otherwise.
Under the PDPL, this includes both basic personal data (e.g., names, addresses, emails, phone numbers) and sensitive personal data (e.g., biometric or genetic details, health, financial, political, or religious information).
Personal data is legally protected as a right, not a commodity that can be freely traded.
Sensitive data refers to information closely tied to an individual’s privacy and can cause significant harm if compromised, for example, sensitive personal data such as health records, biometric information (e.g., fingerprints, facial recognition), genetic data, financial details, and location data.
It requires stricter protections, such as explicit consent, enhanced security measures, and sector-specific rules (e.g., in healthcare or insurance).
Governance & roles
Under the PDPL, data controllers are entities that decide the purposes and means of processing personal data (e.g., a company collecting and using customer information). Data processors handle data on behalf of controllers (e.g., a payroll or cloud service provider).
Controllers bear primary responsibility for compliance, including consent management, impact assessments, and breach notifications. Processors must follow the controller’s instructions, apply security measures, and support compliance. Both must have clear contractual arrangements, conduct impact assessments, and remain accountable under the law, including compliance with consent requirements.
It should also be noted that the role of data controllers rarely exists in isolation, they often concurrently act as processors. This is because controllers typically receive and process personal data themselves, thereby assuming the role of a processor as well. Fundamentally, the rights and obligations of data controllers and those of controller-cum-processors are the same.
Under Vietnam’s PDPL and its draft implementing decree, organisations must formally designate a data protection officer (DPO) or establish a data protection department (DPD). The DPO is responsible for coordinating compliance, handling data subject requests, and liaising with the Ministry of Public Security (MPS).
While the law does not require the DPO to be a Vietnamese national, the draft decree sets minimum qualifications, including a university degree, at least three years of relevant experience, and completion of certified PDP training issued by a recognised Vietnamese training body. Future guidance may also require passing a professional assessment conducted by the MPS.
Many multinationals still appoint an overseas DPO (e.g., in Singapore, Hong Kong, or Dubai) to oversee regional compliance. However, it remains advisable to appoint or empower a Vietnam-based contact person who is fluent in Vietnamese, since official notifications and filings must be in Vietnamese, and the MPS may require direct communication within 72 hours of a breach.
Transition of PDPL/DPO requirements
Before 1 January 2026, under Decree 13, companies may appoint any individual whether local or overseas) to oversee PDP compliance. There are currently no restrictions on nationality, language, or qualifications.
From 1 January 2026, when the PDPL takes effect, organisations must formally designate a qualified DPO or data protection unit. The DPO will be required to meet specific standards on education, experience, and certification as prescribed by future regulations.
A transition or “qualification gap” period may be allowed for companies to meet these new requirements, though the details have not yet been confirmed. It is therefore advisable to begin identifying and training suitable DPO personnel in advance.
Consent & individual rights
Under the PDPL, consent must be voluntary, informed, specific to the purpose, and not bundled with unrelated services. It can be withdrawn at any time, and processing without consent is limited to specific cases like legal obligations or emergencies.
Valid consent must also be updated and communicated to the data subject or relevant parties, and corresponding agreement obtained, where applicable, in the event of any changes to the data processing procedures.
Under the PDPL, individuals have extensive rights over their personal data, including the right to:
- Be informed about how their data is collected, used, and shared.
- Access, obtain copies, and request correction or deletion of their personal data.
- Restrict or object to the processing of their data in certain cases.
- Withdraw consent at any time.
- Request data portability (to transfer their data to another system or service).
- Opt out of automated decision-making or profiling that significantly affects them.
- Complain or seek compensation for violations of their data protection rights.
These rights can be exercised directly with the data controller, who must respond within the legally prescribed time frame.
Compliance procedures (DPIA, CTIA, cross‑border)
Under Decree 13 (effective from 1 July 2023), organisations are required to submit PDP reports to relevant authorities within 60 days of starting personal data processing activities. For entities that began operations before 1 July 2023, the initial reporting deadline was 29 August 2023.
Under the draft PDPL implementing decree, organisations must update their Data Protection Impact Assessment (DPIA) and overseas data transfer impact assessment (TIA) according to the nature of changes:
- Minor changes: updates must be completed within six months, such as when new processing purposes arise, new data categories are added, or parties involved (controllers, processors, or third parties) are changed.
- Significant changes: re-submission is required within 60 days, for example in cases of corporate restructuring, mergers, cessation of activities, changes to the organisation’s legal status, or new business sectors involving personal data.
In practice, the data processing may begin very early, for example, when recording information about the owner, legal representative, or employees through internal documents such as employment contracts or decisions. Therefore, the 60-day period for data processing can essentially be considered as starting from the date of the businesses’ establishment.
A DPIA is a mandatory evaluation of the potential risks and impacts arising from the collection, storage, use, or transfer of personal data. It helps ensure that appropriate technical and organisational safeguards are in place before processing begins.
Under Decree 13, and reaffirmed under the upcoming PDPL, organisations must prepare and submit a DPIA to the MPS within 60 days of commencing personal data processing activities.
The DPIA must also be updated within six months of any minor changes (e.g., new processing purposes or changes in data recipients), and re-submitted within 60 days of any significant change (e.g., mergers, legal restructuring, or new business lines involving personal data).
Certain low-risk organisations, such as small businesses or those not handling sensitive or large-scale data, may be exempted from the DPIA filing requirement. However, there are currently no clear criteria or classifications for sensitive data or large-scale data processing. Therefore, data controllers should still consider conducting a DPIA if there is a potential that their activities may fall under these categories.
Before transferring personal data abroad, organisations must prepare a TIA and submit it to the MPS within 60 days of the first transfer. Even if the TIA is successfully submitted, it must be updated within six months for minor changes and re-submitted within 60 days for significant changes.
Additionally, a clear data transfer agreement between the transferring and receiving parties is required. This should specify the transfer location, types of data, purposes and methods of processing, data protection measures, retention and deletion timelines, and mechanisms for handling violations and complaints, among other key terms. The data transferor in Vietnam is typically the main subject of regulatory oversight during the transfer process.
Exemptions apply to state agencies, employee data stored in cloud systems, and self-transfers by data subjects.
A DPIA is required for all companies to evaluate the risks of handling personal data. A TIA is specifically required if personal data is transferred overseas. Fundamentally, the content of DPIA and TIA reports is not significantly different.
The key distinction lies in their scope: DPIA applies to all data processing activities, while TIA focuses specifically on cross-border data transfers, which may have broader implications not only for data subjects and processors, but also for national security and defense. These transfers are also subject to cybersecurity and general data protection regulations.
No. Companies that have already submitted and obtained MPS approval for their DPIA or TIA under Decree 13 are not required to resubmit them when the PDPL takes effect.
However, under the PDPL, these reports must be updated within six months for any minor changes (e.g., new processing purposes, data categories, or involved parties) and re-submitted for MPS approval within 60 days for any significant changes (e.g., corporate restructuring, new jurisdictions, or expanded data scope).
When we talk about developers, it could be anyone depending on the software you are using, such as a customised payroll software, an ERP system, or the Microsoft Azure platform. For well-known developers, it is generally obvious, and you do not have to provide much additional information.
However, if the software is developed by a local Vietnamese software company or by an overseas company that is not well known, then you need to provide more details—for example, what they have developed and what information is involved.
In most cases, data storage and related functions are handled by well-known companies rather than smaller firms. Smaller companies tend to focus more on accounting software, such as local solutions, or payroll software from overseas.
Third‑party processors & vendors
Under the PDPL, your company is considered the Personal Data Controller (and also a Processor, given its role in collecting and transferring data), while the payroll service provider is the Personal Data Processor.
As the Controller, your company remains ultimately responsible for ensuring that all data processing activities comply with the PDPL and its implementing decree. Your key obligations include:
- Obtaining valid employee consent
- Reviewing the Processor’s data protection measures
- Executing a written Data Processing Agreement (DPA)
- Monitoring compliance and handling breaches
- Providing internal training for employees
- Maintaining communication with the Processor for incident response
The Processor, in turn, must:
- Process data only under the Controller’s documented instructions
- Implement technical and organisational safeguards to protect the data
- Notify the Controller and the MPS of any data breach or unauthorised processing
- Not engage sub-processors without the Controller’s prior consent
Additionally, since employee data is also governed by labour laws, it is important to harmonise data sharing and processing practices to avoid potential labour law violations.
The answer is similar to the previous one. Note that if you have previously obtained consent from the employee, typically for general third-party processing purposes (such as payroll, healthcare, or technology), you do not need to obtain it again.
However, if the purpose of the new service vendor is not covered by the previously obtained consent, then a separate consent from the employees is required.
This remains a grey area under the PDPL, due to the nature of the data relationship, which involves three parties:
- The Personal Data Controller cum Processor: your Vietnam branch;
- The Personal Data Processor(s): your U.S. headquarters and the cloud service provider (e.g., Microsoft).
In theory, since Microsoft processes the data, it should be listed in the PDPL reports.
However, in practice, there may be many third-party processors (e.g., Google, Amazon, etc.), making it difficult to list them all.
A simplified approach could be to list the U.S. headquarters as the Processor only, and establish a data transfer/processing agreement between the Vietnam branch and the U.S. headquarters. This means that, formally speaking, only one Processor is clearly identifiable at this point.
That said, due to the lack of clear guidance from authorities and ongoing debates, if the number of third-party processors is not too large, it is recommended to list all of them in the reports.
Third-party processors are entities that process personal data on behalf of a Personal Data Controller under a contractual arrangement.
This includes payroll providers, IT maintenance vendors, cloud storage operators, or any external party that accesses, stores, or processes personal data for business operations.
The Controller remains legally responsible for ensuring that all processing conducted by a Processor complies with the PDPL.
Key duties include:
- Obtaining valid consent from data subjects;
- Conducting due diligence on the Processor’s data protection measures;
- Signing a Data Processing Agreement (DPA) defining scope, duration, and responsibilities;
- Monitoring the Processor’s compliance and incident handling;
- Keeping impact assessments (DPIA) updated and reflecting any third-party involvement.
Processors must:
- Process data only under the Controller’s documented instructions;
- Implement technical and organisational safeguards;
- Report any data breaches or unauthorised processing to the Controller and the MPS;
- Obtain prior written consent from the Controller before engaging any sub-processor;
- Conduct a DPIA and submit it to the MPS as required.
If the existing consent already covers general third-party data processing (e.g., for payroll, IT support, or HR systems), new consent is not required.
However, if the vendor’s processing purpose or scope differs from what was previously consented, fresh consent must be obtained before processing begins.
Vendor relationships must be formalised through a written agreement (DPA) or equivalent contract that clearly defines:
- The nature and purpose of data processing;
- Data categories and security measures;
- Roles and liabilities of each party;
- Breach notification procedures; and
- Post-termination data return or deletion obligations.
Exemptions & penalties
Currently, Vietnam’s PDP obligations are governed by Decree 13, which outlines compliance requirements but does not yet provide detailed sanctioning provisions. Enforcement is presently based on general administrative penalties under existing laws on cybersecurity, information technology, and administrative violations.
Once the PDPL takes effect on 1 January 2026, additional implementing decrees are expected to introduce clearer and stricter sanctioning mechanisms. These may include:
- Higher administrative fines proportional to the scale and impact of the violation;
- Civil liability, requiring organisations to compensate affected individuals for damages caused by unlawful data processing; and
- Criminal penalties for serious offences such as unauthorised disclosure, trading, or cross-border transfer of personal data without consent.
These forthcoming sanctions reflect the Government’s intent to establish a more robust and enforceable data protection framework in Vietnam.
It is also important to assess the potential commercial consequences of non-compliance, particularly reputational damage, serious data loss, and increased regulatory scrutiny. These risks may arise not only in Vietnam but also in jurisdictions with strict personal data protection frameworks.
Under the PDPL, small and start-up enterprises may be exempt from filing a DPIA, following the criteria in Vietnam’s Law on SMEs and Decree 80/2021/ND-CP:
- Industry & construction: ≤100 employees, and either revenue ≤50 billion VND or capital ≤20 billion VND.
- Commerce & services: ≤50 employees, and either revenue ≤100 billion VND or capital ≤30 billion VND.
- Start-ups: an SME that is established to implement its business ideas based on the exploitation of intellectual property, technology and new business models and is able to grow quickly.
However, the exemption does not apply if the enterprise processes sensitive personal data or conducts high-risk processing activities which, in practice, covers the majority of businesses operating in Vietnam today.
Penalties under the PDPL are stringent. Organisations may face administrative fines of up to VND 3 billion (approximately USD 115,000) for general violations, up to 5% of the previous year’s revenue for cross-border data transfer breaches, and up to 10 times the illegal gains for personal data trading. In serious cases, criminal liability may also apply.
Contracts, documentation & GDPR alignment
Yes. In practice, some companies submit only the data protection addendum when the main contract includes trade secrets or commercially sensitive terms. This can be acceptable to demonstrate the contractual basis for data processing.
However, the MPS has wide discretion in their review process. While they may accept the addendum initially, they can later request the full contract or supplementary documents once your DPIA or related dossier is under review. Companies should therefore be ready to provide the complete agreement if required.
In short, an addendum may work at the outset, but you should be prepared to disclose the full contract upon request.
Although your GDPR framework provides a strong foundation, Vietnam’s PDPL introduces distinct procedural and operational requirements that must be addressed separately. Key requirements include:
- DPIA and TIA reports must be submitted to the MPS within 60 days of initiating data processing or transfers.
- Appointment of a Data Protection Officer (DPO) or department is required, unless exempted (for example, for small or micro-enterprises that do not process sensitive data). The DPO’s contact details must be provided to MPS.
- Vietnamese-language communication is mandatory for all official correspondence with MPS. A Vietnamese-speaking DPO is advisable to ensure timely responses, especially given the 72-hour remediation window required by law and annual inspections by the authority.
- Authorities may also require the DPO to have a VNeID or appear in person for certain procedures.
- Consent and legal bases under PDPL may differ from GDPR, with stricter interpretations and narrower exceptions.
To ensure full compliance with Vietnam’s PDPL, your firm should assess any gaps between existing GDPR practices and local requirements, or localise the group-level policy, and fulfil the above obligations where applicable.
Acclime services
Absolutely. Acclime offers a comprehensive, end-to-end PDP compliance service – from gap assessment and data mapping, to drafting customised policies, preparing mandatory impact assessments, supporting regulatory filings, and ongoing advisory.
Our deliverables are tailored to your business sector and designed to be PDPL-ready, so you are compliant today and future-proof for 2026.
Every company will need Part A for the mandatory DPIA (and TIA if you transfer data overseas). As a first step, you can get our PDP Handbook, customised to your business operations, to quickly understand what compliance means for you.
If you don’t yet have data protection policies – or need to fine-tune existing ones – then Part B is required. Part C is mandatory to keep filings updated every 6 months or upon significant changes. Part D is optional and ideal if you want ongoing expert support beyond the initial setup.
It’s your first step to understanding PDP. The Handbook is a plain-language Quick Guide, customised to your business sector, that turns complex regulations into simple, practical insights. While not legally mandatory, it is highly recommended as it highlights your core obligations, common risks, and next steps – helping your team quickly grasp what PDP means for you before moving into deeper compliance work.
Our approach depends on your current status:
- If you don’t have existing policies: We will design and implement a full PDP compliance framework from the ground up, covering data mapping, contracts, policies, and internal procedures.
- If you already have certain policies in place: We will review and localise them, close compliance gaps, and deliver a complete, consolidated PDP compliance package tailored to your operations in Vietnam.
You will need to formally appoint a DPO and DPD as required by law, and assign one focal contact to coordinate with us. Your role mainly involves providing the necessary documents (e.g. HR forms, contracts, existing policies if any). We take care of the compliance analysis, drafting, and alignment with regulators, so the compliance process is smooth with minimal disruption to your operations.
We can support you with ongoing compliance. Under the upcoming PDPL, filings must be updated every six months for minor changes and immediately for major changes. In addition, our Part D – Advisory Retainer gives you direct access to our experts to handle any PDP concerns on an ongoing basis.
