New Personal Data Protection Law 2025 in Vietnam

Vietnam is entering a new phase in protecting personal data with the introduction of the Law on Personal Data Protection, which is expected to take effect from January 1, 2026. This is an important step in perfecting the legal framework on personal data protection, replacing the current Decree 13/2023/ND-CP. At Viet An Law, we recognize that the new Personal Data Protection Law 2025 in Vietnam, compared to Decree 13/2023/ND-CP, will create fundamental changes in the way businesses and organizations handle personal data.

Expanding the subject of regulation and the scope of application of personal data protection

One of the most important changes to the law is the significant expansion of the subjects of regulation under Article 1. While Decree 13/2023/ND-CP only applies to Vietnamese agencies, organizations, and individuals operating abroad, the new law has removed this provision and replaced it with a more comprehensive approach.

Under the new regulations, the law applies to

• Vietnamese agencies, organizations, and individuals;
• Foreign agencies, organizations, and individuals in Vietnam;
• Foreign agencies, organizations, and individuals directly involved in or related to the processing of personal data of Vietnamese citizens and people of Vietnamese origin whose nationality has not been determined and who are living in Vietnam and have been granted identity certificates.

This change shows the new points of the Law on Personal Data Protection 2025 compared to Decree 13/2023/ND-CP towards more comprehensive protection of the rights of Vietnamese citizens, while expanding compliance responsibilities for foreign organizations.

Finalizing the definition of personal data

Article 2 of the Law has improved the definition of personal data, from the concept of “information in the form of symbols, letters, numbers, images, sounds or similar forms in the electronic environment” in Decree 13 to “digital data or information in other forms that identify or help identify a specific person“.

This new definition has:

• Expanding the scope from just the electronic environment to all forms of information;
• Focus on the ability to identify rather than the form of storage;
• More in line with international trends and modern data processing practices.

At the same time, the law also clearly classifies personal data into two groups: basic personal data and sensitive personal data, with specific categories issued by the government.

Strengthening the rights and obligations of personal data subjects

According to Article 4 of the Law, the new points of the Law on Personal Data Protection 2025, compared to Decree 13/2023/ND-CP, are clearly shown in the adjustment of the rights and obligations of data subjects. While Decree 13 stipulates 11 rights and 5 obligations, the new law simplifies them into 6 basic rights and 4 obligations.

A highlight is the addition of the right to request that other parties take measures and solutions to protect their personal data. The law also establishes three basic principles:

• Comply with laws and contracts;
• Do not cause difficulties or hinder the exercise of rights and obligations;
• Do not infringe upon legitimate rights and interests.

Specify prohibited behaviours under the new Personal Data Protection Law 2025 in Vietnam

Article 7 of the Law specifies and supplements prohibited acts. In addition to maintaining existing regulations, the Law additionally prohibits:

• Using other people’s personal data, allowing others to use one’s personal data to commit acts contrary to the provisions of law;
• Buying and selling personal data (except where otherwise provided by law);
• Acts of appropriation, intentional disclosure, or loss of personal data.

Establish a strict violation handling framework

Article 8 adds a separate provision on handling violations of the law with penalties designed according to the seriousness of the violation:

• For organizations violating regulations on cross-border personal data transfer: a fine of up to 5% of the revenue of the previous year;
• For the act of buying and selling personal data: maximum fine of 10 times the amount of income obtained from the violation;
• For other violations: maximum fine of 3 billion VND for organizations, for individuals, this maximum fine is half.

Improving the regulation on consent of personal data subjects

According to Article 9, the new points of the Law on Personal Data Protection 2025, compared to Decree 13/2023/ND-CP, are reflected in clarifying the criteria for valid consent:

• Legible: capable of being printed or reproduced in writing, including in electronic or verifiable format;
• Active: silence or non-response is not considered consent;
• Unconditional: no obligation to consent for other purposes;
• Each purpose: express agreement for each specific purpose.
• Validity: when based on voluntary and knowing the following information:

• Types of personal data processed, purposes of processing personal data;
• Personal data controller or personal data controller and processor;
• Rights and obligations of personal data subjects

Accordingly, where the criteria for constituting valid consent are not met, the data subject may constitute a violation of the rights to the data subject’s personal data.

Supplementing regulations on de-identification and disclosure of personal data

Article 14 of the Personal Data Protection Act 2025 introduces the concept of “anonymization” with specific methods such as deletion, masking, generalization, obfuscation, and noise addition. This is an important tool that allows organizations to use data in research and analysis without violating privacy.

Article 16 of the Law on Personal Data Protection 2025 for the first time specifically regulates the disclosure of personal data, requiring:

• Disclosure is only made with the consent of the personal data subject or to fulfill a legal or contractual obligation;
• Have specific purposes and appropriate public scope;
• The type of public data must be appropriate to the purpose;
• Do not infringe upon the rights and legitimate interests of data subjects.
• Forms of public disclosure of personal data include posting data on websites, electronic portals, mass media, and other forms as prescribed by law.

Improving regulations on cross-border data transfers

Article 17 of the Personal Data Protection Law 2025 clearly stipulates cases of personal data transfer, including sharing between departments within the same organization, business reorganization, and transfer to processors.

Article 20 of the Law on Personal Data Protection 2025 changes the word “overseas” to “cross-border” and expands the concept to include transferring data stored in Vietnam to an extraterritorial storage system. New points of the Law on Personal Data Protection 2025 compared to Decree 13/2023/ND-CP in this area include:

• The impact assessment dossier must be submitted to the competent authority within 60 days.
• Impact assessment is conducted only once for the entire period of operation and is updated as prescribed.

Establish a personal data protection force

Article 33 of the Law on Personal Data Protection 2025 establishes a personal data protection force system, including:

• Specialized agency under the Ministry of Public Security;
• Department, data protection personnel in the organization;
• Organizations and individuals providing personal data protection services;
• Forces mobilized to protect personal data.

Flexible implementation and transitional provisions

Articles 38 and 39 of the Personal Data Protection Law 2025 demonstrate flexibility in implementing the law:

• Small businesses and startups have a five-year option for impact assessments, data protection, and record updates;
• Business households and micro-enterprises are not required to perform these obligations;
• Impact assessment dossiers received under Decree 13 continue to be valid.

The new points of the Law on Personal Data Protection 2025, compared to Decree 13/2023/ND-CP, show that Vietnam is building a comprehensive, modern legal framework in line with international trends. The upgrade from Decree to law not only demonstrates the importance of the issue but also creates a solid legal basis for protecting privacy rights and promoting digital economic development.

At Viet An Law, we are committed to accompanying businesses in understanding and complying with new regulations, ensuring business operations run smoothly within the legal framework. With a team of experienced experts, we are ready to provide profound legal consulting services on personal data protection, helping businesses best prepare for this important change.