Vietnam PDPL 2026: Personal Data Protection Law and Decree 356 Explained
Vietnam’s Personal Data Protection Law (PDPL) and Decree 356/2025/ND-CP have applied since 1 January 2026. Businesses that handle personal data within the law’s scope should identify what data they process, why they process it, who can access it, and whether it is stored or transferred overseas. The required measures depend on the business’s role, activities, and any applicable exceptions.
What Is Vietnam’s Personal Data Protection Law?
Vietnam’s Personal Data Protection Law sets out rules for protecting personal data during its collection, use, storage, sharing, and other processing activities. Decree 356 provides further detail on how certain provisions of the law are implemented.
When did the Vietnam PDPL take effect?
Law No. 91/2025/QH15 took effect on 1 January 2026. Decree 356/2025/ND-CP took effect on the same date. A company reviewing its current practices should assess them against the law and its implementing decree together.
Who should assess whether the law applies?
A Vietnam company collecting customer details, an employer managing personnel records, and a foreign group accessing data from its Vietnam operations may all need to assess their position. Incorporation outside Vietnam does not, by itself, settle whether the law applies. The answer depends on the company’s activities and the law’s scope.
For example, a Singapore parent company may receive reports containing information about employees of its Vietnam subsidiary. Both companies should identify what information is shared, why the parent needs it, and which entity determines how it is used.
What counts as personal data and sensitive personal data?
Personal data is information that identifies a person or can help identify them. Names, contact details, identification information, and employee records can fall within this category. Sensitive personal data includes categories that call for closer protection, such as health information, biometric data, and certain financial information.
A company should classify the data it actually handles. A general statement that it “processes customer data” is too broad to show where sensitive information or higher-risk activities may exist.
Which Personal Data Protection Decree Applies in Vietnam in 2026?
Document | Role | Effective date | What businesses should use it for |
Personal Data Protection Law No. 91/2025/QH15 | Establishes the legal framework | 1 January 2026 | Identifying the law’s scope, principles, rights, and obligations |
Decree 356/2025/ND-CP | Details and implements specified provisions of the law | 1 January 2026 | Checking the applicable detailed measures and procedures |
Decree 13/2023/ND-CP | Former personal data protection decree, replaced by Decree 356 | No longer the current decree from 1 January 2026 | Reviewing older policies or files that may need updating |
The law and Decree 356 should be read together. A summary of the decree alone may leave out a rule established in the law. Likewise, a business should not reuse a checklist based on Decree 13 without reviewing it against the 2026 framework.
What Must Businesses Check Under Vietnam’s PDPL?
Data inventory and the company’s processing role
Start with the personal data in customer systems, recruitment files, payroll records, websites, and other operations. Record where it comes from, its purpose, who uses it, and which suppliers can access it. Then identify whether the company decides the purposes and means of processing, processes data for another party, or performs more than one role.
That distinction matters because responsibilities can differ by role. A group agreement or vendor contract does not replace an assessment of what each party actually does.
Notices, consent, and data subject requests
Check what individuals are told when their data is collected. The notice should reflect the real purposes and parties involved. Where consent is required, examine how it is obtained and recorded rather than assume that a general clause covers every use.
The business also needs a way to receive and handle requests concerning personal data. The responsible team should know where to find the information and when a request must be escalated.
Policies, personnel, and processing records
Written policies should match operational practice. A company may have a privacy notice while its recruitment, HR, sales, and IT teams use different sharing arrangements. Map those activities before deciding which records, internal responsibilities, and protective measures are required.
Employee files and internal investigations deserve particular attention because they can contain identification details, allegations, health information, or other sensitive material. Access and retention should be reviewed against the purpose of each process. VINEX’s guide to internal investigations in Vietnam provides related operational context.
Impact assessments and applicable exceptions
Businesses should separately consider any assessment obligations for their personal data processing and for cross-border transfers. The applicable requirements, documentation, and exceptions depend on the activity and the entity involved. Do not assume that every small business has the same filing obligation, or that an exemption removes all other duties under the PDPL.
Overseas storage, vendors, and transfers
Identify whether an overseas group company, cloud provider, software vendor, or support team receives or can access personal data. Record where the data is stored, where it is accessed, and what the provider does with it. These facts help determine whether cross-border transfer requirements apply.
An overseas cloud subscription alone does not describe the full data flow. Examine its configuration, access permissions, contracts, and actual processing arrangements. This is also relevant when assessing the vendor issues discussed in VINEX’s guide to digital legal services and compliance risks.
Incident response and records
Establish how staff report a suspected data incident, who investigates it, and how decisions are documented. Then check whether the circumstances trigger any notification or other response required by law. Clear records help the company explain its processing decisions when a question arises later.
PDPL Compliance Checklist for Foreign Companies Operating in Vietnam
List the data. Identify personal data collected from customers, employees, and job applicants, including any sensitive categories.
Map its use. Record the purpose, system, access rights, vendors, and Vietnam or overseas entities involved.
Check individual-facing processes. Review privacy notices, consent where applicable, and how the business handles requests.
Compare documents with practice. Check whether contracts, policies, and internal records reflect the actual data flow.
Assess specific obligations. Review processing and cross-border transfer documentation requirements, including any applicable exceptions.
Assign follow-up work. Give each gap an owner and deadline. Reassess when a new system, vendor, data use, or overseas access arrangement is introduced.
For a broader review of operational obligations, see VINEX’s regulatory compliance services guide.
Our Services
Frequently Asked Questions About Vietnam’s PDPL
Does Vietnam’s PDPL apply to foreign companies?
It can. A foreign company should assess the law’s scope against its actual activities involving personal data connected to Vietnam. Its place of incorporation alone is not enough to answer the question.
Is Decree 13 still the main personal data protection decree?
No. Decree 356/2025/ND-CP replaced Decree 13/2023/ND-CP from 1 January 2026 and implements provisions of the Personal Data Protection Law. Older compliance documents should be checked against the current framework.
Does every business need a data protection impact assessment?
A business should assess the obligation against its processing role, activities, and any applicable exceptions. It should examine cross-border transfer requirements separately where data moves or becomes accessible overseas. Company size alone is not a reliable answer.
Does using an overseas cloud provider count as a cross-border data transfer?
It may, depending on where the personal data is stored, accessed, and processed. Check the provider’s configuration and the actual data flow before deciding which cross-border requirements apply.
How VINEX Can Help Businesses Review PDPL Compliance
VINEX can help businesses organise a review of their Vietnam operations, including the data they handle, the parties involved, and the documents that may need updating. The scope of any assistance should be confirmed against the company’s systems and the services VINEX provides.
To start a review, share the types of personal data your business handles, the Vietnam and overseas entities that use it, and the systems or vendors involved. This gives the review a defined starting point and helps identify which requirements need closer assessment.
Comments