# Vietnam PDPL — Law No. 91/2025/QH15: Articles Overview

## Table of Contents
1. [Law Structure](#law-structure)
2. [Article 2 — Definitions](#article-2--definitions)
3. [Article 3 — Principles](#article-3--principles)
4. [Article 4 — Data Subject Rights](#article-4--data-subject-rights)
5. [Article 5 — Obligations of Data Controllers/Processors](#article-5--obligations)
6. [Article 8 — Penalties](#article-8--penalties)
7. [Article 9 — Consent](#article-9--consent)
8. [Article 10 — Consent for Sensitive Data](#article-10--consent-for-sensitive-data)
9. [Article 19 — Processing Without Consent](#article-19--processing-without-consent)
10. [Article 20 — Cross-Border Transfer](#article-20--cross-border-transfer)
11. [Article 21 — Impact Assessment (DPIA)](#article-21--impact-assessment-dpia)
12. [Article 23 — Breach Notification](#article-23--breach-notification)
13. [Article 38 — Effective Date and Transitional Provisions](#article-38--effective-date)

---

## Law Structure

| Chapter | Title | Key Articles |
|---|---|---|
| Chapter I | General Provisions | 1–7 |
| Chapter II | Consent and Legal Bases | 8–19 |
| Chapter III | Cross-Border Transfer | 20 |
| Chapter IV | Impact Assessments | 21–22 |
| Chapter V | Security and Breach | 23–25 |
| Chapter VI | Rights of Data Subjects | 26–32 |
| Chapter VII | Obligations of Parties | 33–35 |
| Chapter VIII | State Management | 36–37 |
| Chapter IX | Transitional and Final Provisions | 38–39 |

**Administering authority:** Ministry of Public Security (specialized agency for personal data protection)

---

## Article 2 — Definitions

| Term | Definition |
|---|---|
| **Personal data** | Digital data that identifies or can identify a specific natural person; divided into basic and sensitive |
| **Basic personal data** | 11 categories: full name, date/place of birth and death, gender, current and permanent address, nationality, personal image, phone number, ID/passport/license plate numbers, marital status, family relationships, digital account information |
| **Sensitive personal data** | 13 categories: racial/ethnic origin, political views, religious/philosophical views, private life/personal secrets/family secrets, health and medical status, biometric and genetic data, sexual life/orientation, criminal data, location/movement data, electronic account credentials and ID card images, banking/financial/credit/transaction data, social media behavioural tracking data |
| **Processing** | Any operation on personal data including collection, recording, analysis, storage, disclosure, combination, access, retrieval, erasure, or destruction |
| **Personal data controller** | Organisation or individual that decides the purpose and means of processing |
| **Personal data processor** | Organisation or individual that processes personal data at the request of the controller |
| **Controlling-and-processing party** | An entity that both decides purposes AND directly processes personal data |
| **Third party** | Any participant in processing other than the data subject, controller, and processor |
| **De-identification** | Process of removing all information that identifies a specific individual |
| **Impact assessment** | Analysis of impacts and risks arising from personal data processing |

---

## Article 3 — Principles of Personal Data Processing

1. **Lawfulness** — processing must have a valid legal basis
2. **Purpose limitation** — data collected for specified, explicit, legitimate purposes; no further processing incompatible with original purpose
3. **Data minimisation** — collect only what is necessary for the stated purpose
4. **Accuracy** — data must be accurate and kept up to date
5. **Synchronous security measures** — security controls must be implemented before and during processing
6. **Proactive prevention** — risks must be identified and prevented before harm occurs
7. **Harmony with national interests** — processing must not threaten national security, social order, or legitimate rights of other organisations/individuals

---

## Article 4 — Data Subject Rights

Data subjects have the following **6 rights**:

**a) Right to be informed:** Know what personal data is processed, by whom, for what purpose, and how.

**b) Right to consent / disagree / withdraw consent:** Give, withhold, or withdraw consent at any time; withdrawal does not affect the lawfulness of prior processing.

**c) Right to access and rectify:** View their personal data and request corrections to inaccurate data.

**d) Right to delete, restrict, or object:** Request erasure of data, restriction of processing, or object to processing for specific purposes.

**e) Right to file complaints, lawsuits, and seek compensation:** Lodge complaints with competent authorities, bring legal action, and claim damages for violations.

**f) Right to request protection measures:** Request authorities to take measures to protect their personal data rights.

**Important distinctions from GDPR:**
- No explicit right to data portability
- No explicit right to human review of automated decisions (but Decree 356 requires opt-out for AI/automated processing)
- Withdrawal of consent does not retroactively invalidate prior processing

---

## Article 5 — Obligations (Summary)

**Controllers must:**
- Establish and maintain a lawful basis for all processing
- Implement technical and organisational security measures
- Notify data subjects of processing activities
- Respond to data subject rights requests within required timeframes
- Notify the authority of breaches within 72 hours
- Conduct impact assessments for new processing (unless SME exempt)
- Appoint a DPO (where required)

**Processors must:**
- Process only on documented instructions from the controller
- Implement security measures equivalent to controller requirements
- Assist controller in fulfilling data subject rights
- Notify controller immediately of any breach
- Delete or return data at end of processing relationship

---

## Article 8 — Penalties

| Violation | Organisation | Individual |
|---|---|---|
| Buying/selling personal data | 10× the proceeds | 10× the proceeds |
| Cross-border transfer violations | Up to 5% of preceding year's revenue in Vietnam | VND 1.5 billion |
| Violations causing serious harm | VND 3 billion | VND 1.5 billion |
| Other administrative violations | Proportional to severity | Half of organisation rate |

**Note:** Criminal liability may also apply under the Penal Code for serious violations.

---

## Article 9 — Consent

**Validity requirements:**
- **Voluntary** — not coerced or made a condition of service where unnecessary
- **Explicit** — clear affirmative action; silence, inaction, or pre-ticked boxes do NOT constitute consent
- **Specific** — separate consent for each distinct purpose
- **Informed** — data subject must know what they are consenting to
- **Recorded** — controller must maintain proof of consent

**Consent must specify:**
- The type of personal data
- The purpose of processing
- The organisation processing the data
- The rights of the data subject

**Withdrawal:** Data subjects may withdraw consent at any time. Processing must cease within the relevant timeframe (15 working days per Decree 356 Article 5). Withdrawal does not affect legality of prior processing.

---

## Article 10 — Consent for Sensitive Personal Data

- **Explicit, separate consent** required for each category of sensitive data
- Controller must clearly distinguish sensitive data consent from general consent
- Processing sensitive data without separate explicit consent is a violation subject to higher penalties
- Children's sensitive data requires consent of parent or legal guardian

---

## Article 19 — Processing Without Consent (Legal Bases Other Than Consent)

Processing without consent is permitted only in these **5 cases**:

1. **Emergency situations** — to protect the life or health of the data subject or another person when the data subject is incapable of giving consent
2. **National/public security threats** — at the request of competent state agencies in accordance with law
3. **State agency statutory functions** — public bodies processing data in exercising their legally assigned functions
4. **Contract performance** — processing is necessary for performance of a contract to which the data subject is party
5. **Other cases as prescribed by law** — specific sectoral laws may permit additional bases

**Note:** This is narrower than GDPR's 6 lawful bases. Legitimate interests is not a standalone basis under VN-PDPL.

---

## Article 20 — Cross-Border Transfer of Personal Data

**General rule:** Personal data of Vietnamese data subjects may be transferred abroad subject to impact assessment.

**Impact assessment dossier:**
- Submit to Ministry of Public Security **within 60 days** of the first transfer
- Must describe: the data to be transferred, recipient, recipient country, purpose, security measures, risk mitigation
- **Update every 6 months** or immediately on any material change (change in purpose, data types, recipient, or security measures)

**Authority's power:** Ministry may **suspend or terminate** a cross-border transfer if it finds a national security, public interest, or other significant risk.

**Exceptions (no impact assessment required):**
1. State agencies exercising statutory functions
2. Organisations storing employee personal data in cloud HR systems (within scope)
3. Data subjects transferring their own data
4. Other cases as the Government may determine

**Penalties for violation:** Up to 5% of the organisation's preceding year's Vietnam revenue.

---

## Article 21 — Impact Assessment (DPIA)

**Trigger:** Any organisation commencing personal data processing.

**Timeline:** Submit to Ministry of Public Security **within 60 days** of first processing.

**Content:**
- Type and scope of personal data processed
- Purpose and legal basis
- Processing methods and third parties involved
- Retention periods
- Security measures (technical and organisational)
- Risk assessment and mitigation

**SME Exemptions:**
- **Small enterprises:** May opt out of Article 21 for 5 years from 1 January 2026, **unless** they process sensitive personal data or process at large scale
- **Micro-enterprises:** Fully exempt unless they process sensitive personal data or at large scale
- Exemption election must be documented

---

## Article 23 — Breach Notification

**72-hour rule:** Personal data controllers must notify the personal data protection authority **within 72 hours** of becoming aware of a breach.

**Notification must include:**
- Description of the nature of the breach
- Categories and approximate number of data subjects affected
- Categories and approximate number of records affected
- Name and contact details of DPO or responsible officer
- Likely consequences of the breach
- Measures taken or proposed to address the breach

**Data subject notification:** Notify affected data subjects simultaneously with or as soon as practicable after the authority notification, unless law enforcement restricts disclosure.

**Internal breach register:** Controllers must maintain a register of all personal data breaches, whether or not they trigger notification obligations.

---

## Article 38 — Effective Date and Transitional Provisions

- **Law effective date:** 1 January 2026
- **SME opt-out period:** 5 years from 1 January 2026 for Articles 21, 22, 33(2) — unless processing sensitive data or at large scale
- **Decree 356** (implementing decree): 31 December 2025, effective 1 January 2026
- Prior processing activities: organisations had a transition period to align with the law; from 1 January 2026 full compliance is required