VietnamLaw on Personal Data Protection, enforcement and data subject rights
Law No. 91/2025/QH15, enforcement and data subject rights provisions
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Data subject rights
- Audit expectation
- none
What it requires
- An app processing the personal data of an individual in Vietnam must be prepared to answer to the agency in charge of personal data protection, facing a fine of up to 5 percent of prior-year revenue for a cross-border transfer violation, and an individual harmed by the app's processing may file a complaint, initiate a lawsuit, and request compensation for damage.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Article 8, Clause 1 of the Law says that a person or organization that violates it or another law on personal data protection may, depending on the nature, degree and consequences of the violation, be administratively sanctioned or prosecuted for criminal liability, and must pay compensation for damage caused. The Law defines no offense of its own; any offense sits in the Penal Code.
Penalty structure
Article 8, Clause 5 sets the Law's general/default administrative-fine cap at VND 3,000,000,000 for personal-data-protection violations not specifically covered by Clauses 3 or 4 of the same Article, which is the tier this broader enforcement-and-data-subject-rights instrument is scoped to describe. Two narrower, higher-effect tiers sit in the same Article: Clause 3 caps illegal purchase or sale of personal data at ten times the illicit gain from the violation, and Clause 4 caps cross-border-transfer violations at 5 percent of the organization's prior-year revenue; in both narrower cases, if there is no revenue or illicit gain, or the calculated fine is lower than the Clause 5 cap, the Clause 5 cap of VND 3,000,000,000 applies instead, making the general cap effectively a floor under the two narrower tiers as well as the standalone cap for everything else. Clauses 3-5 fines apply to organizations; Clause 6 caps individual violators at half the organizational maximum.
- Rule
- Fixed only
- As of
- Currency
- VND
- Fixed cap
- 3,000,000,000
Who enforces it
Enforcement body
The Ministry of Public Security, the focal agency answerable to the Government for state management of personal data protection (Article 36, Clause 2), acting through the specialized personal data protection agency under it (Article 33, Clause 1, point a), except for matters within the Ministry of National Defence's scope (Article 36, Clause 3).
Settledness
- As of
- Open questions
- Does "5% doanh thu của năm trước liền kề của tổ chức đó" ("5 percent of the revenue of that organization in the immediately preceding year") in Article 8(4) mean the organization's worldwide revenue, its revenue from Vietnam, or the revenue from the cross-border transfer concerned?
What it makes you log
Logging duty
The row rests on Article 4 (the data subject rights and the duty to act on a request within the legal period), Article 8 (the fine tiers), Article 33(1)(a) and Article 36 (the agency and the ministry in charge). None of them asks a controller for a log or a record, and none gives the agency a power to demand one. Article 35, which says only that inspection follows the Law and Government rules, and Article 37(1)(i), which has the controller supply information for investigations, are not cited by this row and take no value here.
- Kind
- None
- As of
What this law does
Article 33(1)(a) names the specialized personal data protection agency under the Ministry of Public Security as part of the personal data protection force. Article 36(2) makes the Ministry of Public Security the focal agency answerable to the Government for state management of personal data protection, except for matters within the Ministry of National Defence's scope.
Under Article 8(4), the administrative fine for an organization violating the cross-border transfer rules reaches up to 5 percent of the prior year's revenue. Under Article 8(3), the fine for buying or selling personal data reaches up to 10 times the proceeds. Under Article 8(5), the fine for other violations reaches up to VND 3 billion. Under Article 8(6), individuals are capped at half the organizational maximum.
Article 4(1) gives individuals the right to request the provision, deletion, or restriction of processing of their personal data and to object to its processing. Article 4(1) also gives individuals the right to file complaints and denunciations, initiate lawsuits, and request compensation for damage in accordance with law, arming a private plaintiff.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .