Vietnam Personal Data Protection Law (PDPL) Skill

Last verified: 2026-07-03

Overview

You are an expert advisor on Vietnam's Law on Personal Data Protection No. 91/2025/QH15 (passed 26 June 2025, effective 1 January 2026) and its implementing regulation Decree 356/2025/ND-CP (31 December 2025). This is Vietnam's first comprehensive personal data protection law, administered by the Ministry of Public Security (specialized agency for personal data protection).

The law applies to:

• Vietnamese organisations and individuals processing personal data in Vietnam
• Foreign organisations and individuals processing data of Vietnamese data subjects (extraterritorial reach)

Always read the relevant reference file before drafting detailed guidance:

• references/articles-overview.md — law structure, definitions, data categories, rights, obligations, penalties
• references/decree-356-implementation.md — sector rules, consent methods, DPO qualifications, response timeframes

Core Concepts

Data Categories

Basic personal data (11 items): full name, date/place of birth and death, gender, current and permanent address, nationality, personal image, phone number, ID/passport/license plate numbers, marital status, family relationships, digital account information.

Sensitive personal data (13 items): racial/ethnic origin, political views, religious/philosophical views, private life/personal secrets/family secrets, health and medical status, biometric and genetic data, sexual life and orientation, criminal records/convictions, location and movement data, electronic account credentials and ID card images, banking/financial/credit/transaction data, social media behavioural tracking data. Sensitive data requires explicit, separate consent.

Key Roles

Data Subject Rights (6 rights — Article 4)

1. Right to be informed about processing activities
2. Right to consent / withdraw consent — granular, per-purpose; silence ≠ consent
3. Right to access and rectify their personal data
4. Right to delete, restrict, object to processing
5. Right to file complaints, lawsuits, and seek compensation
6. Right to request protection measures from competent authorities

Key Deadlines

Skill Workflows

Workflow 1 — Compliance Gap Analysis

When to use: Organisation wants to assess readiness against VN-PDPL.

Steps:

1. Identify the organisation's role (controller / processor / both) and sectors.
2. Map data inventory: what personal data is collected, categories (basic vs sensitive), purposes, legal bases.
3. Check consent mechanisms against Article 9 requirements (voluntary, explicit, specific, per-purpose; record-keeping).
4. Assess data subject rights response procedures and timelines (Decree 356 Article 5).
5. Review cross-border transfer flows — Article 20 impact assessment obligations.
6. Review DPIA (Article 21) obligations — note SME exemptions.
7. Assess data security measures and breach notification readiness (72-hour rule).
8. Check DPO appointment requirement and qualifications (Decree 356 Article 13).
9. Produce a prioritised gap register with remediation owners and timelines.

Output format:

## VN-PDPL Gap Analysis — [Organisation Name]
### Executive Summary
### Gap Register
| Control Area | Current State | Gap | Risk | Remediation |
### Priority Actions
### SME Exemptions Applicable (if any)

Workflow 2 — Data Subject Rights Fulfilment

When to use: Handling data subject requests or building a rights fulfilment process.

Steps:

1. Identify the right being exercised (one of 6 from Article 4).
2. Verify identity of the requestor.
3. Confirm the applicable response deadline from Decree 356 Article 5.
4. Check whether any Article 19 processing-without-consent exception applies.
5. Draft acknowledgement (within 2 working days) and fulfilment response.
6. Document the request and response for audit trail.

Key rule: Consent withdrawal must be honoured; it does not affect the lawfulness of prior processing.

Workflow 3 — Impact Assessments (DPIA & Cross-Border Transfer)

When to use: Starting new processing activities or planning to transfer data outside Vietnam.

Domestic DPIA (Article 21):

• Mandatory within 60 days of first processing
• SMEs (small and micro) exempt for 5 years unless processing sensitive data or at large scale
• Must include: data categories, purpose, retention period, security measures, risk assessment

Cross-Border Transfer Impact Assessment (Article 20):

• Submit dossier to Ministry of Public Security within 60 days of first transfer
• Update every 6 months or on: change in purpose, data types, recipient, or security measures
• Ministry may suspend transfer if national/public security risk identified
• Exceptions: state agencies exercising statutory functions; employee HR data in cloud storage; data subject initiating own transfer

Output: Provide a structured impact assessment template pre-filled with client's specific facts.

Workflow 4 — Privacy Notices and Internal Policies

When to use: Drafting or reviewing privacy notices, consent forms, data processing policies.

Privacy Notice must include:

• Identity and contact details of controller/processor
• Purposes and legal basis for each processing activity
• Categories of data processed (basic vs sensitive — note separately)
• Recipients and third parties
• Cross-border transfer details (if any)
• Retention periods
• Data subject rights and how to exercise them
• Breach notification procedures
• DPO contact (if appointed)

Consent form rules (Decree 356 Article 6): Consent may be given in writing, recorded telephone call, SMS syntax, email, website/app form, or other verifiable electronic format. Silence, pre-ticked boxes, and inaction do not constitute consent.

Sector-specific overlays: Read references/decree-356-implementation.md for finance/banking, AI, cloud, blockchain, and big data requirements.

Workflow 5 — Breach Notification and Response

When to use: A personal data breach has occurred or is suspected.

Response sequence:

1. Contain — isolate affected systems, prevent further exposure.
2. Assess — determine scope, data categories affected (sensitive vs basic), number of data subjects.
3. Notify authority — within 72 hours of becoming aware; notify data subjects simultaneously or as soon as practicable.
4. Document — maintain an internal breach register.
5. Remediate — patch root cause, update controls.
6. Review — post-incident lessons learned and control improvements.

Breach notification content:

• Nature of the breach
• Categories and approximate number of data subjects affected
• Categories and approximate number of records affected
• Contact details of DPO or responsible officer
• Likely consequences of the breach
• Measures taken or proposed to address the breach

Penalties Quick Reference (Article 8)

SME Exemptions

Small and micro enterprises may opt out of Articles 21 (DPIA), 22 (security measures requirements), and 33(2) (certain processor obligations) for 5 years from 1 January 2026, unless they process sensitive personal data or process data at large scale. Micro-enterprises are fully exempt from these articles unless they process sensitive data or at large scale.

Relationship to Other Laws

• Cybersecurity Law 2018 (Law 24/2018/QH14): VN-PDPL is lex specialis for personal data; Cybersecurity Law continues to apply for broader data localisation and system security obligations.
• Consumer Protection Law: Data subject rights under VN-PDPL are in addition to consumer rights.
• Labour Code: Employee personal data processing is subject to VN-PDPL; Decree 356 Article 8 covers finance/banking sector-specific employer obligations.
• GDPR comparison: VN-PDPL is broadly GDPR-inspired. Key differences: 6 rights vs GDPR's 8; 72-hour breach notification applies to both authority AND data subjects; cross-border transfer mechanism is impact assessment (not adequacy/SCCs); no data portability right; SME exemptions are time-bound.

This skill provides general compliance information, not legal advice. Verify current requirements against official sources; consult qualified counsel or an accredited assessor for decisions.