Vietnam's Personal Data Protection Law (Law No. 91/2025/QH15) has applied since 1 January 2026, and it is now the rule your website follows when it collects data from people in Vietnam. Decree 13/2023/ND-CP, the decree most guides still describe, was replaced on the same day by the law's implementing decree, Decree 356/2025/ND-CP. For a website, the practical answer is unchanged in spirit: get explicit consent for each purpose before trackers that identify a visitor run, and keep proof of it.
The law applies to Vietnamese and foreign organisations that process the personal data of people in Vietnam, so a site hosted in Europe or the US with Vietnamese visitors is in scope. It is part of a wider set of privacy laws around the world that ask for consent before tracking.
Decree 13 was the first framework, and it has been replaced
The Government issued Decree No. 13/2023/ND-CP on Personal Data Protection on 17 April 2023, and it took effect on 1 July 2023. It was Vietnam's first single set of data protection rules, covering data classification, consent, impact assessments, cross-border transfers and breach notices.
The National Assembly then adopted the Personal Data Protection Law on 26 June 2025, lifting the rules from decree level to a statute. On 31 December 2025 the Government issued Decree 356/2025/ND-CP, which details the law, took effect with it on 1 January 2026 and supersedes Decree 13.
If you searched for "Decree 13", this is the short version: its core ideas (consent per purpose, impact assessments filed with the Ministry of Public Security, 72-hour breach notices) carried over into the law, with higher fines and more detail. Impact assessments filed under Decree 13 before 2026 stay valid, but later updates follow the new rules, according to Tilleke and Gibbins' analysis of the law.
From Decree 13 to the Personal Data Protection Law
Decree 13 and the law side by side
The table compares the old decree with the rules that apply as of October 2026. Only the right-hand column is current.
| Requirement | Decree 13 (1 July 2023 to 31 December 2025) | PDP Law and Decree 356 (since 1 January 2026) |
|---|---|---|
| Consent | Explicit, per purpose, and silence is not consent | Explicit, per purpose, and silence is not consent, with a short list of cases without consent |
| Breach notice to the authority | 72 hours | 72 hours, counted from detection |
| Data protection staff | Required in limited cases | Required, with exemptions for household and micro businesses and a five-year option for small businesses and start-ups |
| Cross-border transfer assessment | Filed within 60 days | Filed within 60 days of the transfer, updated when things change |
| Fines | Set by separate administrative rules | Up to VND 3 billion, up to 5% of revenue for transfer breaches, up to 10 times the revenue from trading data |
How Vietnam classifies personal data
Vietnamese law splits personal data into two groups: basic and sensitive. Basic personal data includes names, dates of birth, contact details, nationality and similar identifiers.
Sensitive personal data covers political and religious views, health conditions, biometric and genetic data, financial records and sexual orientation, among others. Processing it carries more duties, and the exemptions for small businesses described below do not apply to anyone who processes sensitive data directly.
Children get their own rule. Processing a child's personal data generally needs the consent of a parent or legal representative, and where the data concerns the private life of a child aged 7 or older, the child's consent is needed too.
Consent is still the centre of the system
Consent is the main lawful basis for processing personal data in Vietnam. Unlike the GDPR, which offers six equal legal bases, Vietnamese law starts from consent and lists a small number of exceptions.
The consent must be voluntary, informed and given in a form that can be verified. Silence or no response does not count. Each purpose needs its own consent, so one tick-box that bundles analytics, advertising and functional cookies is not enough. Withdrawing consent must be possible at any time.
The law lets you process without consent in listed situations, such as protecting the rights of the data subject or others, or performing a contract with the data subject. That list is narrower than the GDPR's legitimate interest basis, and an organisation that relies on it is expected to keep a way of monitoring that use.
What the law means for cookies
Vietnam has no cookie rule shaped like the EU's ePrivacy Directive. The law applies whenever data collected through a cookie can be linked to an identifiable person. A PHPSESSID holding a signed-in session, a _ga cookie tracking visits, or a _fbp identifier set by the Meta Pixel can all qualify when they relate to a visitor in Vietnam.
The law also names cookies for some services. Tuoi Tre reported in December 2025 that social networks and online communication services must let users refuse the collection and sharing of cookies, and must offer a "do not track" option or track only with explicit consent.
For an ordinary website the result is the same: purpose-by-purpose choices on the banner, nothing pre-ticked, and trackers held back until the visitor agrees. If you run Google Analytics 4 or the Meta Pixel, load them only after consent, which is what script blocking does by holding the tags until the visitor chooses.
Cross-border transfers need an assessment on file
If your servers or analytics providers sit outside Vietnam, data from Vietnamese visitors leaves the country, and the transfer rules apply to you.
You prepare a cross-border transfer impact assessment and file it with the Cybersecurity and High-Tech Crime Prevention Department (A05) of the Ministry of Public Security. Decree 356 (Article 18) sets the deadline at 60 days from the date of the transfer. The dossier documents the purpose, the data categories, the recipient and the safeguards, and it must be updated when those facts change, in some cases every six months.
The authorities can also suspend transfers where data is used in ways that threaten national security or where serious violations occur.
Data localisation is narrower than often reported
Vietnam's data localisation rule does not come from the data protection law. It comes from the Cybersecurity Law and its Decree 53/2022/ND-CP, in force since 1 October 2022, and it covers foreign providers of ten service types, including telecoms, cloud storage, e-commerce, online payment, social networks, online games and messaging.
Even for those providers, local storage is triggered only when the Ministry of Public Security makes a formal request, typically after the service was used to break the Cybersecurity Law and the provider did not cooperate. A standard company website, blog or SaaS product outside those ten service types is unlikely to be asked.
Breach notices run on a 72-hour clock from detection
Under the law, a personal data breach must be reported to the authority within 72 hours, and the clock starts when the breach is detected, not when it happened. That matches the logic of the GDPR's 72-hour rule, which also counts from awareness.
Some breaches must also be told to the people affected. Decree 356 requires notice within 72 hours of detection for incidents involving location or biometric data, and for leaks of sensitive data in finance, banking and credit information.
Fines are now set in the law itself
Decree 13 set no fines of its own: sanctions came from separate administrative rules, and a dedicated sanctions decree was still a draft while Decree 13 applied. The Personal Data Protection Law changed that by writing the ceilings into the statute.
- Most violations: up to VND 3 billion per organisation.
- Cross-border transfer violations: up to 5% of the previous year's revenue, with VND 3 billion as the figure where that would be lower or there was no revenue.
- Buying or selling personal data: up to 10 times the revenue earned from it.
Enforcement sits with the Ministry of Public Security, through A05. The revenue-based fines follow the model European regulators use, although the amounts remain lower than the GDPR's.
How Vietnam compares with its neighbours
Vietnam's law sits alongside a growing number of Asia-Pacific regimes. Thailand's PDPA, South Korea's PIPA, Singapore's PDPA, Japan's APPI and China's PIPL each take a different line on consent, transfers and enforcement.
Vietnam stands out for three things: how heavily it relies on consent, the duty to file transfer assessments with the Ministry of Public Security, and a localisation rule that sits in a separate cybersecurity law.
Steps for a website with visitors in Vietnam
- List every cookie and tracker your site sets, and note which ones identify a visitor or build a profile.
- Give visitors from Vietnam a banner with a separate choice for each purpose and nothing pre-ticked.
- Hold analytics and advertising tags until the visitor agrees to that purpose.
- Keep a record of each choice with a timestamp and the purposes accepted, so you can show consent was given.
- Map where the data goes outside Vietnam and prepare the transfer impact assessment within 60 days of the first transfer.
- Check whether you need a data protection person or service provider, or whether a household, micro or small business exemption applies to you.
Questions about Vietnam's data protection rules
Is Decree 13/2023 still in force?
No. Decree 356/2025/ND-CP superseded it on 1 January 2026, the day the Personal Data Protection Law took effect. Impact assessments filed under Decree 13 stay valid, but later updates follow the new rules.
Does Vietnam's data protection law apply to websites outside Vietnam?
Yes. The law applies to Vietnamese and foreign organisations that process the personal data of people in Vietnam. If your website collects data from Vietnamese visitors, you may fall within scope.
Do I need cookie consent for visitors from Vietnam?
If cookies on your site collect data that can identify a person, such as analytics identifiers, advertising pixels or session tokens, you need explicit consent for each purpose before that data is processed.
What is the penalty for breaking Vietnam's data protection rules?
Up to VND 3 billion for most violations, up to 5% of the previous year's revenue for cross-border transfer violations, and up to 10 times the revenue earned from illegally buying or selling personal data.
Does Vietnam require data to be stored locally?
Only for foreign providers of ten service types under the Cybersecurity Law and Decree 53/2022, and only after a formal request from the Ministry of Public Security. Most websites outside those service types are not affected.
Do small businesses need a data protection officer in Vietnam?
Household businesses and micro-enterprises are exempt, and small businesses and start-ups may wait five years from 1 January 2026. The exemptions do not apply if you process sensitive data directly, process data about a large number of people or sell data processing services.
Show Vietnamese visitors a consent choice per purpose
Kukie.io lets you set a region rule for visitors from Vietnam, blocks the trackers you have not been given consent for and records each choice with its time and purposes in the Consent Log.
