VietnamLaw on Personal Data Protection, cross-border transfer
Law No. 91/2025/QH15, Article 20
In force since .
A cross border transfer rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Audit expectation
- periodic
- Who audits it
- Regulator
What it requires
- An app transferring the personal data of an individual in Vietnam, including biometric data, to a recipient outside the country must prepare a cross-border transfer impact assessment dossier and send it to the specialized personal data protection agency within 60 days of the first transfer; a violation risks a fine of up to 5 percent of the organization's prior-year revenue, a materially higher tier than the Law's general penalty.
These lines are LexLint's reading of the law's text.
In the frameworks
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- For a party that falls under Article 20(1)(c) by using a platform outside Vietnam "để xử lý dữ liệu cá nhân được thu thập tại Việt Nam" ("to process personal data collected in Vietnam") with no separate handover of the data, from what event does the 60-day period in Article 20(2) run, given that it counts from "ngày đầu tiên chuyển dữ liệu cá nhân xuyên biên giới" ("the first day of transferring personal data across the border")?
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 20(2) requires whoever transfers personal data across the border to prepare a cross-border transfer impact assessment dossier and send one original to the specialized personal data protection agency within 60 days of the first transfer. Article 20(4) lets that agency inspect transfers periodically, no more than once a year, or at any time after a violation or a leak or loss of personal data. The Article names no log, but the dossier is a standing record the party must be able to hand to the agency. Article 22 sets the dossier update rules that Article 20(3) cites; this row does not cite Article 22 and takes no value from it. Article 20(1)(c) also reaches a foreign party that uses a platform outside Vietnam for data collected in Vietnam; that prong turns on where the data was collected and has no matching hook value, so the hook lists only the establishment prong.
- Kind
- Implicit
- As of
- Provision
- Article 20(2) to (4)
- Trigger
- personal_data_processing
What this law does
Article 20(1) lists the cross-border transfers the Law covers: moving personal data stored in Vietnam to a storage system outside Vietnam, an agency, organization, or individual in Vietnam passing personal data to a counterpart abroad, and using a platform outside Vietnam to process personal data collected in Vietnam.
Under Article 20(2), whoever transfers personal data across the border must prepare a cross-border transfer impact assessment dossier and send one original to the specialized personal data protection agency within 60 days of the first day of transfer. Under Article 20(3), the assessment is done once for the whole period of the party's operation and updated as Article 22 requires.
Under Article 20(5), that agency decides to require a transfer to stop when the data is being sent for use in activity that may harm national defense or security. Article 20(6) excuses transfers by competent state bodies, an organization storing its own employees' data on a cloud service, and a data subject transferring his or her own data. The paragraphs of Article 20 set no adequacy list, no approval step, and no data-localization element.
Article 20(7) leaves the detailed conditions and procedures to the Government. A separate penalties article sets the maximum fine for an organization violating the cross-border transfer rules at 5 percent of its prior-year revenue, a tier distinct from the Law's general fine.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .