Vietnam

The 2023 personal data decree states its reach in four limbs: Vietnamese bodies, organisations and individuals; foreign bodies, organisations and individuals in Vietnam; Vietnamese bodies, organisations and individuals operating abroad; and foreign bodies, organisations and individuals directly involved in or related to personal data processing activity in Vietnam. The 2025 Law on Personal Data Protection replaced the decree's parent framework from 1 January 2026 and Decree 356/2025 now carries the detail; we could not open the 2025 Law's own scope article on a government site, so the wording quoted here is the 2023 decree's. Decree 356/2025 adds a separate, harder rule for one group: an organisation that sells personal-data-processing services must be established under Vietnamese law, its head of data processing must be a Vietnamese citizen resident in Vietnam, and it must hold at least three staff who meet the qualification test.

Sector by sector, checked on 18 August 2026. BANKING, CREDIT AND PAYMENTS: the 2025 Law adds duties for finance, banking and credit-information businesses (no credit scoring without consent, minimum necessary collection, tell the customer when account or credit information leaks) but we found no localisation rule for banking in an official source during this run; treat that as unverified, not as an absence. HEALTH AND INSURANCE: a genuine wall - health bodies may not pass personal data to third-party healthcare providers, health insurers or life insurers unless the person asks in writing, and reinsurance transfers must be spelled out in the customer's contract. TELECOMS, SOCIAL MEDIA, ONLINE PAYMENT, CLOUD AND GAMING: these are the service types the cybersecurity regime aims its storage-in-Vietnam power at; the power is exercised by order of the police ministry rather than applying automatically, and the decree detailing it under the 2025 Cybersecurity Law was still being written when we checked. GOVERNMENT AND STATE DATA: the Prime Minister has issued a list of 26 core data and 18 important data categories, nearly all of them non-public data held by state bodies, including health data, geospatial and aerial imagery of sensitive sites, finance and budget data, and non-public data about organisations and citizens. E-COMMERCE: from 1 July 2026 a foreign platform need not incorporate in Vietnam but must appoint a Vietnamese legal entity to carry its obligations, and sellers are identified through the national digital identity system. MAPPING, EDUCATION, DEFENCE AND GAMBLING: no rule verified against an official source in this run.

The model is neither a blocklist nor an allowlist: there is no list of countries at all, populated or empty. It is a filing-and-inspection model with a live stop power. Under the 2023 decree the police may inspect a transfer once a year, or at any time after a leak or a suspected breach, and may order the transfer to stop where the data is used against Vietnam's national interests or security, where the sender ignores a request to complete the file, or simply where Vietnamese citizens' data has leaked. A sender has ten days to fix a file the police say is incomplete. Decree 356/2025, which details the 2025 Law, still turns on the same two documents - a processing impact file and a cross-border transfer impact file - and makes a passing result on both a licensing condition for personal-data-processing service businesses. We could not open the 2025 decree's own transfer article, so the 60-day and 10-day clocks quoted here are the 2023 decree's and should be re-checked.

A05 receives breach reports, receives and assesses transfer impact files, inspects transfers, and under Decree 356/2025 issues, re-issues and revokes the certificates that personal-data-processing service businesses must hold. The Ministry of Public Security is also the lead body for the Law on Data, the National Data Centre and the core and important data lists, which makes it unusually powerful compared with a European-style privacy authority: the same ministry writes the rules, licenses the market and investigates crime. Rated waking rather than active because the administrative sanctions decree covering cyber security and personal data protection had not been issued when we checked, and because we found no published register of company fines under the 2025 Law.

The employment rule has three limbs: comply with the data law, labour law and the Law on Data; keep the worker's personal data only for the period set by law or agreed; and erase or destroy it when the contract ends unless there is an agreement or a legal rule to the contrary. Where a keeping duty in tax or accounting law collides with that erasure duty, the erasure duty gives way, because it is expressed as subject to other law. The general shape - a deletion duty that yields to any statutory retention rule - means the practical answer is usually determined by the sector rule, not by the data law.

The 2023 decree also fixes what the notice must contain: the nature, time, place and actors of the breach, the categories and volume of data involved, contact details for the person responsible for data protection, the likely consequences, and the steps taken to limit harm. Partial notification in stages is allowed where the full picture is not yet known. The company must also draw up a record of the incident and work with the cyber police on handling it. Separately, organisations must report to the cyber police when they discover unlawful acts against personal data, processing outside the agreed purpose, or failures to honour a person's rights.

More detail on each. The prohibition list in the 2025 Law has seven limbs and includes processing aimed against the state, obstructing data protection work, unlawful processing, buying or selling personal data, and appropriating or deliberately leaking data. Fines: up to ten times the gain for buying or selling data; up to 5 percent of the organisation's previous year's revenue for breaking the cross-border transfer rules; up to 3 billion Vietnamese dong, roughly 115,000 US dollars, for everything else; an individual pays half the organisational maximum; and criminal prosecution remains available. Social networks and online communication services carry their own list: they may not demand a photo or video of an identity document to verify an account, they must let users refuse cookie files, they must offer a do-not-track choice, and they may not listen to calls or read messages without consent. Location tracking through radio-frequency tags and similar technology is off unless the person agrees or an authority requires it, and mobile app platforms must offer location choices.

Dated items. 1 July 2026: Law on Cybersecurity No. 116/2025/QH15 takes effect, merging the 2018 cybersecurity law and the 2015 network information security law into 8 chapters and 45 articles. 1 July 2026: Law on E-commerce No. 122/2025/QH15 takes effect; a foreign platform need not set up a Vietnamese company but must appoint a Vietnamese legal entity to carry its obligations, and sellers are identified through the national digital identity system. Before 31 December 2026: the Prime Minister's list of information systems critical to national security. Pending with no fixed date: the administrative penalties decree for cyber security and personal data protection, which will also cover artificial-intelligence and deepfake content and platform duties, and a decree on preventing and handling unlawful information that would regulate social media group administrators and push identity verification for social accounts, bank accounts and phone numbers. DORMANT SWITCHES, all exercisable without new legislation: the police ministry's power to order data storage in Vietnam and a local office for named services; the Prime Minister's power to amend the core and important data lists by decision; and the standing power to order a company to stop transferring data abroad.