Law on Personal Data Protection, breach notification

Law No. 91/2025/QH15, Article 23

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force 9 months, effective 1 January 2026.

A breach notification rule binding public and private bodies.

As of 29 August 2026.

What it requires

An app that detects a violation of Vietnam's personal data protection rules likely to cause harm to national defense and security, social order, or an individual's life, health, honor, dignity, or property must notify the agency in charge of personal data protection within 72 hours.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 23 requires the personal data controller, the personal data controlling and processing party, or a third party to notify the agency in charge of personal data protection within 72 hours after detecting a violation likely to cause harm to national defense and security and social order and safety, or to infringe upon the life, health, honor, dignity, or property of the personal data subject.

Where a personal data processor detects a violation, it must promptly notify the controller or the controlling and processing party.

When LexLint raises it

processes_biometrics
processes_voice
crawls_web

Read the law

Government Portal (chinhphu.vn) citation
substantive text read via a private secondary translation (LuatVietnam)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app