Vietnam’s Personal Data Protection Law No. 91/2025/QH15 comes into force today, replacing Decree 13/2023 and elevating data protection to a full law passed by the National Assembly.
Key points
- Data processing and transfer impact assessments must be filed.
- Breaches must be notified within 72 hours.
- A data protection department or officer is required.
- Fines of up to 5% of revenue for transfer violations.
The law applies to foreign organisations processing Vietnamese citizens’ data, so UK organisations should review their impact assessments, transfer arrangements and breach procedures.
Source: Law on Personal Data Protection No. 91/2025/QH15 (Government of Vietnam)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
