Processes biometric data, in Vietnam

Law No. 91/2025/QH15, Article 20 · Read the law's page

• An app transferring the personal data of an individual in Vietnam, including biometric data, to a recipient outside the country must prepare a cross-border transfer impact assessment dossier and send it to the specialized personal data protection agency within 60 days of the first transfer; a violation risks a fine of up to 5 percent of the organization's prior-year revenue, a materially higher tier than the Law's general penalty.

Law No. 91/2025/QH15, Article 31 · Read the law's page

• An app that collects or processes biometric data, meaning physical attributes and unique, stable biological characteristics used to identify a person, from an individual in Vietnam must apply physical security measures, limit access, and maintain a monitoring system to detect infringement, and must notify the data subject where its processing damages that person.

Law No. 134/2025/QH15, art. 11 · Read the law's page

• Design an AI system that interacts directly with users so that users can recognise they are interacting with an AI system, unless the law provides otherwise.
• Mark AI-generated audio, image, and video content in a machine-readable format under the Government's regulations.
• Notify the public clearly when providing AI-generated or AI-edited text, audio, images, or video that could cause confusion about the authenticity of an event or a person.
• Attach an easily recognisable label to AI-generated or AI-edited content that simulates or replicates a real person's appearance or voice, or recreates a real event.

Law No. 134/2025/QH15, art. 7 · Read the law's page

• Do not use an AI system with forged or simulated real people or events to intentionally and systematically deceive or manipulate people's perceptions or behaviour in a way that seriously harms their rights.
• Do not use an AI system to exploit a vulnerable group, including children, the elderly, people with disabilities, or people with limited cognitive or civil-act capacity, in a way that causes them harm.
• Do not collect, process, or use data to develop, train, test, or operate an AI system in violation of Vietnam's data, personal data protection, intellectual property, or cybersecurity law.
• Do not obstruct, disable, or distort the human-oversight mechanisms this Law requires over your AI system.

Law No. 116/2025/QH15 (Law on Cybersecurity), arts. 40(1)(c), 41(2)-(4) · Read the law's page

• As the manager of an information system, connect its cybersecurity monitoring to the National Cybersecurity Centre of the Ministry of Public Security, or to the Ministry of National Defence's centre for a military system, and report a cybersecurity incident to that specialised force.
• As an enterprise providing a service on a telecommunications network, the Internet, or another value-added service in cyberspace in Vietnam, warn users of the cybersecurity risks in the service and give guidance on preventive measures, and keep an emergency response plan ready to address cybersecurity weaknesses, risks and incidents.
• When a cybersecurity incident occurs, implement that plan immediately and simultaneously report it to the specialized cybersecurity protection force; the Law states no fixed number of hours for this report.
• Apply technical measures to secure data processing, including personal-data processing, consistent with this Law, Vietnam's law on data, and its Law on Personal Data Protection.
• This duty binds now: Law No. 116/2025/QH15 took effect 1 July 2026.

Law No. 116/2025/QH15 (Law on Cybersecurity), arts. 8, 10 · Read the law's page

• This duty binds now: Law No. 116/2025/QH15 took effect 1 July 2026, and Decree No. 331/2026/ND-CP, which sets the classification criteria, has applied since 19 August 2026.
• Determine which of the five statutory levels your information system falls into, based on the damage an incident or a cybersecurity-law violation could cause to lawful rights and interests, public interests, social order and safety, or national security.
• At level 1 or level 2, perform every Article 10(1) task (determine your system's level, assess and manage its cybersecurity risk, supervise and inspect its protection activities, apply protection measures, follow the reporting regime, and raise cybersecurity awareness), and choose which Article 10(2) measures to apply based on your own needs and capacity.
• At level 3 or level 4, and not on the Prime Minister's list of information systems critical to national security, perform every Article 10(1) task and, without discretion, promulgate cybersecurity design-and-operation rules, apply management measures meeting national cybersecurity standards, back up and store data protecting the system's components, inspect and supervise compliance, monitor the system, and respond to and remedy incidents; file a dossier proposing your system's level and put it into operation only once that level is approved.
• This duty does not describe a system the Prime Minister has placed on the list of information systems critical to national security: that class carries the full Article 10(1) and 10(2) obligation set plus its own appraisal, certification and annual self-inspection regime under Articles 9 and 11, gated on a government designation rather than a declared activity.