{"id":1586,"date":"2026-01-01T08:03:26","date_gmt":"2026-01-01T08:03:26","guid":{"rendered":"https:\/\/lawpage.vn\/?p=1586"},"modified":"2026-08-01T14:08:39","modified_gmt":"2026-08-01T14:08:39","slug":"the-law-on-personal-data-protection-no-91-2025-qh15-will-take-effect-from-january-1-2026","status":"publish","type":"post","link":"https:\/\/lawpage.vn\/en\/the-law-on-personal-data-protection-no-91-2025-qh15-will-take-effect-from-january-1-2026\/","title":{"rendered":"The Law on Personal Data Protection No. 91\/2025\/QH15 will take effect from January 1, 2026."},"content":{"rendered":"
A) SUMMARY OF THIS LAW:<\/strong><\/span><\/div>\n
<\/div>\n
Chapter I \u2013 General Provisions<\/strong><\/div>\n
Main contents:<\/div>\n
    \n
  • Defines scope of regulation and subjects of application.<\/li>\n
  • Provides definitions of key terms: personal data, basic data, sensitive data, data processing, data controller, data processor, de-identification, etc.<\/li>\n
  • Principles of personal data protection: purpose limitation, accuracy, security, non\u2011infringement of personal rights.<\/li>\n
  • Rights and obligations of data subjects: right to be informed, to consent, to correct, to request deletion, to complain, etc.<\/li>\n
  • Prohibited acts: buying\/selling data, data appropriation, unlawful processing, etc.<\/li>\n
  • Violations may be penalized up to 3 billion VND or 5% of revenue for cross\u2011border violations.<\/li>\n<\/ul>\n
    <\/div>\n
    Chapter II \u2013 Protection of Personal Data<\/strong><\/div>\n
    Section 1 \u2013 During Personal Data Processing<\/div>\n
    Main contents:<\/div>\n
    <\/div>\n
      \n
    • Consent requirements: must be explicit, specific, unambiguous; silence does not constitute consent.<\/li>\n
    • Right to withdraw consent and request processing restrictions.<\/li>\n
    • Collection, analysis, and aggregation of data require consent (except where permitted by law).<\/li>\n
    • Rules on encryption\/decryption, data modification, deletion, destruction, and de\u2011identification.<\/li>\n
    • Providing data to the data subject or third parties when consent is granted.<\/li>\n
    • Public disclosure must align with the stated purpose and must not infringe personal rights.<\/li>\n
    • Data transfer within an organization, during mergers\/acquisitions, upon request of authorities, or with the data subject\u2019s consent.<\/li>\n<\/ul>\n

      \nChapter III \u2013 Processing Personal Data Without Consent<\/strong><\/div>\n
      Main contents:<\/div>\n
        \n
      • Special cases where data may be processed without consent, such as:<\/li>\n
      • Protecting life and health in emergencies.<\/li>\n
      • Crime prevention and counter\u2011terrorism.<\/li>\n
      • Serving state management functions.<\/li>\n
      • Fulfilling contractual obligations.<\/li>\n
      • Responsibilities of entities when processing without consent.<\/li>\n<\/ul>\n
        Chapter IV \u2013 Cross\u2011Border Transfer of Personal Data<\/strong><\/div>\n
        Main contents:<\/div>\n
          \n
        • Conditions for transferring personal data abroad.<\/li>\n
        • Requirement to conduct a Data Transfer Impact Assessment and submit it to the Ministry of Public Security within 60 days.<\/li>\n
        • Cases exempted from impact assessment.<\/li>\n
        • Right to request suspension of data transfer if it threatens national security.<\/li>\n
        • Responsibilities of foreign data recipients.<\/li>\n<\/ul>\n
          <\/div>\n
          Chapter V \u2013 Personal Data Protection in Specific Sectors<\/strong><\/div>\n
          Main contents:<\/div>\n
            \n
          • Special regulations for:<\/li>\n
          • Children and persons lacking legal capacity.<\/li>\n
          • Recruitment and labor management.<\/li>\n
          • Healthcare and insurance.<\/li>\n
          • Finance, banking, and credit.<\/li>\n
          • Advertising and marketing.<\/li>\n
          • Social networks and digital platforms.<\/li>\n
          • Location data and biometric data.<\/li>\n
          • Audio\/video recording in public places.<\/li>\n
          • Emerging technologies: AI, blockchain, cloud computing, metaverse, etc.<\/li>\n<\/ul>\n
            <\/div>\n
            Chapter VI \u2013 Personal Data Protection Forces<\/strong><\/div>\n
            Main contents:<\/div>\n
              \n
            • Identifies the core authority: the Ministry of Public Security.<\/li>\n
            • Requirements for internal data protection units within organizations.<\/li>\n
            • Regulations on organizations providing data protection services.<\/li>\n
            • Coordination mechanisms among relevant agencies.<\/li>\n<\/ul>\n
              <\/div>\n
              Chapter VII \u2013 Implementation Provisions<\/strong><\/div>\n
              Main contents:<\/div>\n
                \n
              • Effective date: January 1, 2026.<\/li>\n
              • Transitional provisions: small businesses and startups are exempt from certain obligations for 5 years.<\/li>\n
              • Impact assessment dossiers under Decree 13\/2023 remain valid<\/li>\n<\/ul>\n


                \nB) RISK & IMPACT ANALYSIS OF VIETNAM\u2019S PERSONAL DATA PROTECTION LAW 2025<\/strong><\/span><\/p>\n

                The Personal Data Protection Law 91\/2025\/QH15 marks a major regulatory shift in Vietnam, comparable to the GDPR in Europe. It establishes a strong legal framework for personal data protection while imposing significant obligations on organizations that process data.<\/div>\n
                <\/div>\n
                \n

                Below is a three\u2011layer analysis: legal risks, operational risks, and strategic impacts.<\/p>\n<\/div>\n

                <\/div>\n
                I. LEGAL RISKS<\/strong><\/div>\n
                1. High administrative penalties<\/div>\n
                The law sets substantial maximum fines:<\/div>\n
                <\/div>\n
                  \n
                • Up to 3 billion VND for most violations.<\/li>\n
                • 10 times the revenue gained from illegal data trading.<\/li>\n
                • 5% of the previous year\u2019s revenue for cross\u2011border data transfer violations.<\/li>\n<\/ul>\n
                  \n

                  These penalties align with international standards and pose major risks for digital\u2011driven businesses.<\/p>\n<\/div>\n

                  <\/div>\n
                  2. Criminal liability<\/div>\n
                  Certain actions may lead to criminal prosecution, including:<\/div>\n
                  <\/div>\n
                    \n
                  • Data appropriation.<\/li>\n
                  • Intentional disclosure or destruction of data.<\/li>\n
                  • Using personal data to commit unlawful acts.<\/li>\n<\/ul>\n
                    <\/div>\n
                    \n

                    This creates heightened exposure for IT, marketing, and data operations personnel.<\/p>\n<\/div>\n

                    <\/div>\n
                    3. Risks related to \u201cexplicit consent\u201d<\/div>\n
                    The law requires:<\/div>\n
                    <\/div>\n
                      \n
                    • Consent must be explicit, specific, and not pre\u2011ticked or defaulted.<\/li>\n
                    • Multiple purposes cannot be bundled into a single consent request.<\/li>\n
                    • Silence does not constitute consent.<\/li>\n<\/ul>\n
                      \n

                      This invalidates many legacy \u201cdefault\u2011on\u201d data collection models.<\/p>\n<\/div>\n

                      <\/div>\n
                      4. Risks from data deletion obligations<\/div>\n
                      \n

                      Data subjects may request deletion or restriction of processing. Organizations must comply within statutory deadlines. If systems cannot fully delete or erase data \u2192 non\u2011compliance.<\/p>\n<\/div>\n

                      <\/div>\n
                      5. Risks in processing sensitive data<\/div>\n
                      \n

                      Sensitive data (health, biometrics, location, finance, etc.) requires enhanced protection. Industries facing the highest exposure: Healthcare, Banking, Insurance, E\u2011commerce, Fintech, Telecommunications<\/p>\n<\/div>\n

                      <\/div>\n
                      6. Risks in cross\u2011border data transfers<\/div>\n
                      The law requires:<\/div>\n
                        \n
                      • A Data Transfer Impact Assessment.<\/li>\n
                      • Submission to the Ministry of Public Security within 60 days.<\/li>\n
                      • Transfers may be suspended if they pose national security risks.<\/li>\n
                      • Companies using international cloud services (AWS, Google Cloud, Meta, TikTok, etc.) will be heavily affected.<\/li>\n<\/ul>\n
                        II. OPERATIONAL RISKS<\/strong><\/div>\n
                        1. IT systems may fail to meet compliance requirements<\/div>\n
                        The law mandates:<\/div>\n
                          \n
                        • Data encryption.<\/li>\n
                        • De\u2011identification.<\/li>\n
                        • Access control.<\/li>\n
                        • Monitoring of public data disclosures.<\/li>\n
                        • Secure deletion\/destruction.<\/li>\n
                        • Legacy systems may not support these capabilities.<\/li>\n<\/ul>\n
                          <\/div>\n
                          2. Human\u2011related risks<\/div>\n
                          Employees may:<\/div>\n
                            \n
                          • Copy data externally.<\/li>\n
                          • Share data via personal email.<\/li>\n
                          • Store data on personal devices.<\/li>\n
                          • Use customer data for marketing without proper consent.<\/li>\n<\/ul>\n
                            The law requires strict training and internal controls.<\/div>\n
                            <\/div>\n
                            3. Third\u2011party risks<\/div>\n
                            Vendors such as:<\/div>\n
                            <\/div>\n
                              \n
                            • CRM providers<\/li>\n
                            • Email marketing platforms<\/li>\n
                            • Cloud services<\/li>\n
                            • Data analytics firms<\/li>\n
                            • Call centers<\/li>\n
                            • Advertising agencies<\/li>\n<\/ul>\n
                              \n

                              If they violate the law \u2192 the organization remains liable.<\/p>\n<\/div>\n

                              <\/div>\n
                              4. Risks from unstandardized internal processes<\/div>\n
                              Examples:<\/div>\n
                              <\/div>\n
                              – No process for handling data deletion requests.<\/div>\n
                              <\/div>\n
                              – No incident reporting workflow for data breaches.<\/div>\n
                              <\/div>\n
                              \n

                              – No impact assessment when launching new products or features.<\/p>\n<\/div>\n

                              <\/div>\n
                              III. STRATEGIC IMPACTS<\/strong><\/div>\n
                              1. Positive impacts<\/div>\n
                              a. Increased customer trust<\/div>\n
                              Organizations with strong compliance will Enhance reputation, Improve international competitiveness and Attract privacy\u2011conscious customers.<\/div>\n
                              <\/div>\n
                              b. Alignment with global standards<\/div>\n
                              The law is compatible with:<\/div>\n
                                \n
                              • GDPR (EU)<\/li>\n
                              • PDPA (Singapore)<\/li>\n
                              • CCPA (California)<\/li>\n<\/ul>\n
                                This facilitates international expansion.<\/div>\n
                                <\/div>\n
                                c. Boost to cybersecurity investment<\/div>\n
                                Creates demand for:<\/div>\n
                                  \n
                                • SOC<\/li>\n
                                • SIEM<\/li>\n
                                • DLP<\/li>\n
                                • IAM<\/li>\n
                                • Zero Trust architectures<\/li>\n
                                • Cloud security solutions<\/li>\n<\/ul>\n
                                  2. Negative impacts \/ challenges<\/div>\n
                                  a. Significant compliance costs<\/div>\n
                                  Including:<\/div>\n
                                    \n
                                  • Technical systems<\/li>\n
                                  • Data protection personnel<\/li>\n
                                  • Impact assessments<\/li>\n
                                  • Legal consulting<\/li>\n
                                  • Third\u2011party monitoring<\/li>\n<\/ul>\n
                                    b. Disruption to data\u2011driven business models<\/div>\n
                                    Industries most affected:<\/div>\n
                                      \n
                                    • Digital advertising<\/li>\n
                                    • User behavior analytics<\/li>\n
                                    • Data brokerage<\/li>\n
                                    • Fintech using alternative data<\/li>\n
                                    • Social media platforms<\/li>\n<\/ul>\n
                                      <\/div>\n
                                      c. Operational disruption risks<\/div>\n
                                      Organizations may be required to:<\/div>\n
                                        \n
                                      • Stop processing certain data.<\/li>\n
                                      • Suspend cross\u2011border data transfers.<\/li>\n<\/ul>\n
                                        <\/div>\n
                                        This can lead to system downtime or business interruption.<\/div>\n
                                        <\/div>\n

                                        \n","protected":false},"excerpt":{"rendered":"

                                        A) SUMMARY OF THIS LAW: Chapter I \u2013 General Provisions Main contents: Defines scope of regulation and subjects of application. Provides definitions of key terms: personal data, basic data, sensitive data, data processing, data controller, data processor, de-identification, etc. Principles of personal data protection: purpose limitation, accuracy, security, non\u2011infringement of personal rights. Rights and obligations […]\n","protected":false},"author":78,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-1586","post","type-post","status-publish","format-standard","hentry","category-legal-updates"],"_links":{"self":[{"href":"https:\/\/lawpage.vn\/en\/wp-json\/wp\/v2\/posts\/1586","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lawpage.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lawpage.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lawpage.vn\/en\/wp-json\/wp\/v2\/users\/78"}],"replies":[{"embeddable":true,"href":"https:\/\/lawpage.vn\/en\/wp-json\/wp\/v2\/comments?post=1586"}],"version-history":[{"count":0,"href":"https:\/\/lawpage.vn\/en\/wp-json\/wp\/v2\/posts\/1586\/revisions"}],"wp:attachment":[{"href":"https:\/\/lawpage.vn\/en\/wp-json\/wp\/v2\/media?parent=1586"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lawpage.vn\/en\/wp-json\/wp\/v2\/categories?post=1586"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lawpage.vn\/en\/wp-json\/wp\/v2\/tags?post=1586"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}