Vietnam upgraded its data protection regime from a decree to a full statute on 1 January 2026. The Personal Data Protection Law adds mandatory DPOs, impact assessments, enforceable rights and fines of up to 5% of annual revenue, and a detailed sanctions decree followed in August 2026.
The Digital Technology Industry Law, also effective January 2026, sets rules for AI, semiconductors and digital assets. Cybersecurity law adds data localisation and local presence duties for some foreign online services.
- Core data law
- Personal Data Protection Law (Law 91/2025/QH15)
- In force
- 1 Jan 2026 (replaces Decree 13/2023)
- Sanctions decree
- Decree 330/2026, effective 19 Aug 2026
- AI & digital assets
- Digital Technology Industry Law (Law 71/2025)
- Penalties
- Up to 5% of prior-year revenue for some violations
- Regulator
- Ministry of Public Security
Who needs to comply
Startups processing personal data of people in Vietnam
The PDPL applies to Vietnamese and foreign organisations processing personal data of Vietnamese citizens and residents.
AI and digital-asset businesses
The Digital Technology Industry Law sets risk-based AI duties and a framework for digital assets.
Foreign online services with Vietnamese users
Cybersecurity law may require local data storage and a local branch or representative.
The laws, in detail
01Personal Data Protection Law (PDPL)
Consent, rights, DPOs, impact assessments, cross-border transfers and penalties.
When it applies
Processing personal data of Vietnamese citizens or people in Vietnam.
What you must do
- Consent with clear purposes, as the main basis
- Data protection officer and department
- Processing impact assessments and transfer impact assessments
- Notify the authority of breaches within prescribed deadlines
- Rights to access, correct, delete and withdraw consent
Regulator
Ministry of Public Security (A05)
Penalties
Fines up to 5% of prior-year revenue for cross-border transfer violations, up to 10 times illicit gains for data trading, plus criminal liability.
02Digital Technology Industry Law
AI, semiconductors and digital assets.
When it applies
Developing or providing AI systems and digital-asset services in Vietnam.
What you must do
- Risk-based AI management and transparency, including labelling of AI-generated content
- Digital asset classification and rules
Regulator
Ministry of Science and Technology
Penalties
Under implementing decrees.
03Cybersecurity Law and Decree 53
Network security, data localisation and local presence.
When it applies
Domestic and some foreign online service providers handling Vietnamese users’ data.
What you must do
- Store specified data in Vietnam when required
- Local branch or representative office when required by authorities
- Cooperate on content and security requests
Regulator
Ministry of Public Security
Penalties
Administrative sanctions and blocking.
04Law on E-Transactions 2023
Validity of electronic contracts, signatures and digital platforms for e-transactions.
When it applies
Businesses conducting electronic transactions in Vietnam.
What you must do
- Valid e-contracts and e-signatures
- Duties for intermediary platforms
- Data and information security in e-transactions
Regulator
Ministry of Science and Technology
Penalties
Administrative sanctions.
05Decree 147/2024 on internet services and online information
Social network operations, user verification and content moderation.
When it applies
Domestic and cross-border social networks and online services in Vietnam.
What you must do
- Verify user accounts by Vietnamese mobile number or ID
- Remove unlawful content within set timelines
- Cooperate with authorities; local contact for cross-border platforms
Regulator
Ministry of Information and Communications (now merged)
Penalties
Fines, suspension and blocking.
Compliance checklist
01 · Before you launch
- Vietnamese-language notices and consent
- Appoint a DPO
- Prepare processing and transfer impact assessments
02 · At launch
- File impact assessments with the authority where required
- Breach response process
- Assess localisation duties
03 · As you scale
- Review AI features under the DTI Law
- Track decrees implementing the PDPL
- Annual review of transfers
Key dates
- Jul 2023Decree 13 on personal data protection
- 1 Jan 2026PDPL and Digital Technology Industry Law in force
- 19 Aug 2026Decree 330/2026 on sanctions
Common mistakes
- Relying on the old Decree 13 position
- No transfer impact assessment before sending data abroad
- No Vietnamese-language consent
FAQs
Do foreign companies need a DPO in Vietnam?
The PDPL requires organisations processing personal data to designate a DPO or department, with some relief for small businesses and startups for a transition period.
Is there an AI law?
AI is covered by the Digital Technology Industry Law; a separate AI law has been reported, so check the latest status.
Sources
Reviewed 12 October 2026. General information, simplified for planning; not legal advice. Check current law before relying on any requirement, and get advice for your facts. For markets outside India, advice is coordinated with locally qualified counsel.