VietnamLaw on Personal Data Protection, breach notification
Law No. 91/2025/QH15, Article 23
In force since .
A breach notification rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that detects a violation of Vietnam's personal data protection rules likely to cause harm to national defense and security, social order, or an individual's life, health, honor, dignity, or property must notify the agency in charge of personal data protection within 72 hours.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Which breaches by an ordinary app meet the threshold "có thể gây tổn hại đến quốc phòng, an ninh quốc gia, trật tự, an toàn xã hội hoặc xâm phạm đến tính mạng, sức khỏe, danh dự, nhân phẩm, tài sản" ("likely to harm national defense and security, social order and safety, or to infringe the life, health, honor, dignity or property") for the 72-hour notice in Article 23(1), given that Article 23(3) separately lists notice to the specialized agency of any detected violation without that threshold or a deadline?
What it makes you log
Logging duty
Article 23(2) requires the controller, or the controller and processor, to draw up a written record confirming that a violation of the personal data protection rules occurred and to work with the specialized agency in handling it. The duty to prepare the record has no harm threshold in its text, unlike the 72-hour notice in Article 23(1), which is a notification and not a record. The Article does not say the record is filed with the agency, how long it is kept, or that anyone reviews it, so access, retention and audit are left empty. The Article has no scope clause of its own.
- Kind
- Explicit
- As of
- Provision
- Article 23(2)
- Trigger
- security_incident
What this law does
Article 23 requires the personal data controller, the personal data controlling and processing party, or a third party to notify the agency in charge of personal data protection within 72 hours after detecting a violation likely to cause harm to national defense and security and social order and safety, or to infringe upon the life, health, honor, dignity, or property of the personal data subject.
Where a personal data processor detects a violation, it must promptly notify the controller or the controlling and processing party.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .