Vietnam

The 2023 personal data decree sets out its reach in four parts. It covers Vietnamese bodies, organisations and individuals. It covers foreign bodies, organisations and individuals in Vietnam. It covers Vietnamese bodies, organisations and individuals operating abroad. And it covers foreign bodies, organisations and individuals directly involved in data work in Vietnam. The 2025 Law on Personal Data Protection replaced the decree's parent law from 1 January 2026. Decree 356/2025 now carries the detail. We could not open the 2025 Law's own scope article on a government site. So the wording quoted here is the 2023 decree's. Decree 356/2025 adds a harder rule for one group. An organisation that sells personal-data handling services must be set up under Vietnamese law. Its head of data work must be a Vietnamese citizen living in Vietnam. And it must have at least three staff who meet the qualification test.

Industry by industry, checked on 18 August 2026. BANKING, CREDIT AND PAYMENTS. The 2025 Law adds duties for finance, banking and credit-information businesses. No credit scoring without consent. Collect only the minimum needed. Tell the customer when account or credit information leaks. We found no rule requiring banking data to stay in Vietnam in an official source. Treat that as unconfirmed, not as an absence. HEALTH AND INSURANCE. This is a real barrier. Health bodies may not pass personal data to other healthcare providers, health insurers or life insurers unless the person asks in writing. Reinsurance transfers must be spelled out in the customer's contract. TELECOMS, SOCIAL MEDIA, ONLINE PAYMENT, CLOUD AND GAMING. These are the services the cybersecurity rules aim their storage-in-Vietnam power at. The power works by order of the police ministry. It does not apply automatically. The decree setting out the detail under the 2025 Cybersecurity Law was still being written when we checked. GOVERNMENT AND STATE DATA. The Prime Minister has issued a list of 26 core data and 18 important data categories. Nearly all are non-public data held by state bodies. They include health data, geospatial and aerial imagery of sensitive sites, finance and budget data, and non-public data about organisations and citizens. E-COMMERCE. From 1 July 2026 a foreign platform does not have to set up a Vietnamese company. But it must appoint a Vietnamese legal entity to carry its duties. Sellers are identified through the national digital identity system. MAPPING, EDUCATION, DEFENCE AND GAMBLING. We confirmed no rule against an official source.

Vietnam has no list of countries at all, neither banned nor approved. You file paperwork and the police inspect it. They also hold a live power to stop a transfer. Under the 2023 decree the police may inspect a transfer once a year. They may inspect at any time after a leak or a suspected breach. They may order the transfer to stop in three cases. Where the data is used against Vietnam's national interests or security. Where the sender ignores a request to complete the file. Or simply where Vietnamese citizens' data has leaked. A sender has ten days to fix a file the police say is incomplete. Decree 356/2025 details the 2025 Law. It still turns on the same two documents: a data handling impact file and a cross-border transfer impact file. Passing both is a licensing condition for businesses that handle personal data as a service. We could not open the 2025 decree's own transfer article. So the 60-day and 10-day deadlines quoted here are the 2023 decree's, and you should re-check them.

A05 receives breach reports. It receives and assesses transfer impact files, and inspects transfers. Under Decree 356/2025 it issues, re-issues and revokes the certificates that personal-data service businesses must hold. The Ministry of Public Security also leads on the Law on Data, the National Data Centre, and the core and important data lists. That makes it unusually powerful next to a European-style privacy authority. The same ministry writes the rules, licenses the market and investigates crime. We rate it waking rather than active for two reasons. The penalties decree covering cyber security and personal data protection had not been issued when we checked. And we found no published register of company fines under the 2025 Law.

The employment rule has three parts. Comply with the data law, labour law and the Law on Data. Keep the worker's personal data only for the period the law sets or the parties agreed. And erase or destroy it when the contract ends, unless an agreement or a legal rule says otherwise. Sometimes a duty to keep data under tax or accounting law clashes with that erasure duty. The erasure duty gives way, because it is written as subject to other law. So the industry rule usually decides the answer, not the data law.

The 2023 decree also fixes what the notice must contain. That is the nature, time, place and actors of the breach. It is also the categories and volume of data involved. Plus contact details for the person responsible for data protection, the likely consequences, and the steps you took to limit harm. You may notify in stages where you do not yet know everything. You must also draw up a record of the incident and work with the cyber police on handling it. Separately, you must report to the cyber police when you discover unlawful acts against personal data. The same goes for using data outside the agreed purpose, or failing to honour a person's rights.

More detail on each. The list of banned acts in the 2025 Law has seven parts. It includes using data against the state, obstructing data protection work, unlawful data handling, buying or selling personal data, and taking or deliberately leaking data. Fines: up to ten times the gain for buying or selling data. Up to 5 percent of the organisation's previous year's revenue for breaking the cross-border transfer rules. Up to 3 billion Vietnamese dong, roughly 115,000 US dollars, for everything else. An individual pays half the maximum set for organisations. Criminal prosecution is still available. Social networks and online communication services carry their own list. They may not demand a photo or video of an identity document to verify an account. They must let users refuse cookie files. They must offer a do-not-track choice. And they may not listen to calls or read messages without consent. Location tracking through radio-frequency tags and similar technology is off. It is allowed only if the person agrees or an authority requires it. Mobile app platforms must offer location choices.

Dated items. 1 July 2026: Law on Cybersecurity No. 116/2025/QH15 takes effect. It merges the 2018 cybersecurity law and the 2015 network information security law into 8 chapters and 45 articles. 1 July 2026: Law on E-commerce No. 122/2025/QH15 takes effect. A foreign platform does not have to set up a Vietnamese company. But it must appoint a Vietnamese legal entity to carry its duties. Sellers are identified through the national digital identity system. Before 31 December 2026: the Prime Minister's list of information systems critical to national security. Pending with no fixed date: the penalties decree for cyber security and personal data protection. It will also cover artificial-intelligence and deepfake content, and platform duties. Also pending: a decree on preventing and handling unlawful information. That would regulate social media group administrators. It would also push identity checks for social accounts, bank accounts and phone numbers. POWERS ALREADY HELD, all usable without new legislation. The police ministry can order data storage in Vietnam and a local office for named services. The Prime Minister can amend the core and important data lists by decision. And there is a standing power to order a company to stop transferring data abroad.