Processes personal data, in Vietnam

Law No. 91/2025/QH15, Article 20 · Read the law's page

• An app transferring the personal data of an individual in Vietnam, including biometric data, to a recipient outside the country must prepare a cross-border transfer impact assessment dossier and send it to the specialized personal data protection agency within 60 days of the first transfer; a violation risks a fine of up to 5 percent of the organization's prior-year revenue, a materially higher tier than the Law's general penalty.

Law No. 91/2025/QH15, Article 23 · Read the law's page

• An app that detects a violation of Vietnam's personal data protection rules likely to cause harm to national defense and security, social order, or an individual's life, health, honor, dignity, or property must notify the agency in charge of personal data protection within 72 hours.

Law No. 91/2025/QH15, Article 31 · Read the law's page

• An app that collects or processes biometric data, meaning physical attributes and unique, stable biological characteristics used to identify a person, from an individual in Vietnam must apply physical security measures, limit access, and maintain a monitoring system to detect infringement, and must notify the data subject where its processing damages that person.

Law No. 91/2025/QH15, enforcement and data subject rights provisions · Read the law's page

• An app processing the personal data of an individual in Vietnam must be prepared to answer to the agency in charge of personal data protection, facing a fine of up to 5 percent of prior-year revenue for a cross-border transfer violation, and an individual harmed by the app's processing may file a complaint, initiate a lawsuit, and request compensation for damage.

Law No. 91/2025/QH15, passed by the 15th National Assembly, 9th session, 26 June 2025, in force 1 January 2026 · Read the law's page

• An app that collects, uses, or discloses the personal data of an individual in Vietnam must comply with the Law on Personal Data Protection, Law No. 91/2025/QH15, in force since 1 January 2026.

Law No. 116/2025/QH15 (Law on Cybersecurity), arts. 40(1)(c), 41(2)-(4) · Read the law's page

• As the manager of an information system, connect its cybersecurity monitoring to the National Cybersecurity Centre of the Ministry of Public Security, or to the Ministry of National Defence's centre for a military system, and report a cybersecurity incident to that specialised force.
• As an enterprise providing a service on a telecommunications network, the Internet, or another value-added service in cyberspace in Vietnam, warn users of the cybersecurity risks in the service and give guidance on preventive measures, and keep an emergency response plan ready to address cybersecurity weaknesses, risks and incidents.
• When a cybersecurity incident occurs, implement that plan immediately and simultaneously report it to the specialized cybersecurity protection force; the Law states no fixed number of hours for this report.
• Apply technical measures to secure data processing, including personal-data processing, consistent with this Law, Vietnam's law on data, and its Law on Personal Data Protection.
• This duty binds now: Law No. 116/2025/QH15 took effect 1 July 2026.

Law No. 116/2025/QH15 (Law on Cybersecurity), arts. 8, 10 · Read the law's page

• This duty binds now: Law No. 116/2025/QH15 took effect 1 July 2026, and Decree No. 331/2026/ND-CP, which sets the classification criteria, has applied since 19 August 2026.
• Determine which of the five statutory levels your information system falls into, based on the damage an incident or a cybersecurity-law violation could cause to lawful rights and interests, public interests, social order and safety, or national security.
• At level 1 or level 2, perform every Article 10(1) task (determine your system's level, assess and manage its cybersecurity risk, supervise and inspect its protection activities, apply protection measures, follow the reporting regime, and raise cybersecurity awareness), and choose which Article 10(2) measures to apply based on your own needs and capacity.
• At level 3 or level 4, and not on the Prime Minister's list of information systems critical to national security, perform every Article 10(1) task and, without discretion, promulgate cybersecurity design-and-operation rules, apply management measures meeting national cybersecurity standards, back up and store data protecting the system's components, inspect and supervise compliance, monitor the system, and respond to and remedy incidents; file a dossier proposing your system's level and put it into operation only once that level is approved.
• This duty does not describe a system the Prime Minister has placed on the list of information systems critical to national security: that class carries the full Article 10(1) and 10(2) obligation set plus its own appraisal, certification and annual self-inspection regime under Articles 9 and 11, gated on a government designation rather than a declared activity.

Decree No. 330/2026/ND-CP of 19 August 2026, personal data protection sanctions (Chapter II, Section 6, Articles 39 to 71) · Read the law's page

• Prepare and keep a personal data processing impact assessment dossier at the enterprise's premises before processing personal data, and send one original to the Department of Cybersecurity and High-Tech Crime Prevention of the Ministry of Public Security within 60 days of the first day of processing.
• Notify the specialized personal data protection agency within 72 hours of discovering a violation of personal data protection rules that harms or may harm national defense, security, social order and safety, or the life, health, honor, dignity or property of the data subject.
• Prepare a cross-border personal data transfer impact assessment dossier before or during the transfer, and file one original with the specialized personal data protection agency within 60 days of the first day of transfer.