VietnamLaw on Personal Data Protection, comprehensive regime
Law No. 91/2025/QH15, passed by the 15th National Assembly, 9th session, , in force
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Audit expectation
- continuous
- Who audits it
- Regulator
- Where the report goes
- Filed with regulator, Kept
What it requires
- An app that collects, uses, or discloses the personal data of an individual in Vietnam must comply with the Law on Personal Data Protection, Law No. 91/2025/QH15, in force since .
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Does Article 1(2)(c), which reaches a foreign organization that is "trực tiếp tham gia hoặc có liên quan đến hoạt động xử lý dữ liệu cá nhân của công dân Việt Nam" ("directly participating in or related to the processing of personal data of Vietnamese citizens"), apply to a foreign operator with no entity in Vietnam that processes the data of users in Vietnam who are not Vietnamese citizens?
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 21(1) requires a controller, or a controller and processor, to prepare and store a personal data processing impact assessment dossier and send one original to the specialized personal data protection agency within 60 days of first processing; Article 21(3) has a processor prepare and store its own dossier under its agreement with the controller. Article 21(4) has the agency evaluate the dossier and require it to be completed when it falls short, which is a review of each dossier as it arrives. The dossier is a register of the processing the party does, filed and kept. The Law sets no retention period for it. Article 22, which sets the six-month and immediate update rules, and Article 9(3), which asks for consent in a printable or verifiable form, are separate provisions that supply no value here. Article 1(2)(c) reaches a foreign party by the nationality of the data subjects and has no matching hook value, so the hook lists only Article 1(2)(a) and (b).
- Kind
- Explicit
- As of
- Provision
- Article 21(1)
- Trigger
- personal_data_processing
What this law does
The Law on Personal Data Protection (Law No. 91/2025/QH15) is Vietnam's first standalone, comprehensive personal-data statute. Decree 13/2023/ND-CP, which was itself only a government decree rather than a National Assembly law, preceded it, and Article 39 lets consents given under that Decree continue without being obtained again. Article 38(1) fixes its commencement at . The signed text records its passage by the 15th National Assembly at its 9th session on .
A companion implementing decree, Decree 356/2025/ND-CP, issued on , took effect alongside the Law on . A citation of this same enactment as Law No. 34/2025/QH15 is incorrect, because the signed text is numbered 91/2025/QH15.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .