Vietnam’s Personal Data Protection: Key Requirements under Decree 356

Vietnam’s personal data protection requirements have entered a new phase with the adoption of Decree No. 356/2025/ND-CP (“Decree 356”). Companies now face expanded extraterritorial reach, mandatory impact assessments, and new, rigorous standards for consent and cross-border data transfers, requiring immediate compliance updates.

Find Business Support

Seamlessly Manage Your Operations Across Multiple Asian Markets

Effective January 1, 2026, Decree 356 replaces Decree No. 13/2023/ND-CP, serving as the primary implementing regulation for the Law on Personal Data Protection (PDPL). It translates statutory principles into enforceable operational obligations, closing previous compliance gaps and providing procedural clarity on consent, data subject rights, cross-border transfers, and impact assessments.

This article examines the decree’s key provisions, from its expanded extraterritorial scope to stricter operational responsibilities, and highlights initial compliance priorities for businesses operating in Vietnam.

See also: Vietnam Personal Data Protection Law: Latest Developments and Insights

Expanded scope of application and data classification

Vietnam’s updated data protection regime significantly expands its scope by explicitly including foreign entities that process personal data of Vietnamese citizens, regardless of where the processing occurs.

It also sharpens the legal distinction between basic personal data and sensitive personal data, expanding and detailing the latter category. Specifically:

• Sensitive data now includes financial information, biometric identifiers, precise location data, behavioral tracking data, health records, and account credentials.
• Processing sensitive personal data triggers stricter requirements on consent, access control, security measures, and internal governance.
• Data mapping and classification become threshold compliance tasks rather than best practices, as incomplete data inventories immediately expose businesses to compliance gaps, particularly in cross-border transfers, automated processing, and third-party data sharing.

Core compliance obligations for data controllers and processors

The compliance obligations under Decree 356 signal a shift toward demonstrable, audit-ready compliance rather than informal or ad hoc privacy practices.

Exemptions for small-scale entities

Decree 356 balances statutory rules with practical realities by providing key exemptions, including:

• Exemption for micro-enterprises and household businesses: These businesses are not required to appoint Data Protection Officers (DPOs) or perform impact assessments; and
• Exemption for small enterprises and startups: These entities receive a five-year grace period starting January 1, 2026, during which they are not obligated to meet DPO appointment or operational standards, provided that they:
  • Do not process sensitive personal data directly;
  • Do not handle personal data at scale (more than 100,000 individuals); and
  • Do not serve as data processing service providers.

Strengthened consent requirements.

Decree 356 converts Vietnam’s PDP framework into a set of enforceable operational duties for data controllers and data processors. A central change lies in strengthened consent requirements.

Find Business Support

Scalable digital infrastructure tailored to local environments

Organizations must obtain consent through verifiable methods and maintain clear evidence of when, how, and for what purpose consent was granted. The decree expressly prohibits the following practices:

• Default consent settings;
• Pre-ticked boxes; or
• Interface designs that blur the distinction between consent and refusal.

This rule renders businesses fully responsible for providing proof.

Structured procedural timelines

The framework introduces structured procedural timelines for exercising data subject rights. Controllers must acknowledge requests within two working days and complete actions within strict statutory deadlines:

• 10 days for access/rectification;
• 15 days for withdrawing consent; and
• 20 days for deletion requests (extended if third parties are involved).

These fixed timelines replace the former 72-hour rule under Decree 13 and require formalized internal workflows and escalation mechanisms.

Mandatory comprehensive documentation

Organizations must now maintain comprehensive documentation, including internal data protection policies, consent records, processing logs, and impact assessment dossiers. For sensitive personal data, organizations must implement enhanced security measures, including strict access controls, encryption, anonymization, and continuous monitoring.

PDP personnel and governance requirements

Specified requirements for PDP personnels

Decree 356 prescribes the qualifications and responsibilities of individuals involved in PDP in Vietnam. It distinguishes between in-house personnel designated by agencies or organizations for PDP and individuals providing PDP services under contract.

Eligibility requirements for PDP service providers

When organizations delegate data protection responsibilities, service providers need to demonstrate sufficient staffing, relevant technical expertise, and prior experience. The requirements include:

• Involvement in functions, tasks, or business areas related to technology, legal services, or a combination of both, and hired by an agency or organization to offer advice on compliance with PDP laws and to carry out PDP duties as per agreements;
• Employing at least three personnel who meet the competency standards outlined in Decree 356;
• Providing products or services related to confidentiality, cybersecurity, information technology, standards assessment, or consulting on PDP.

New governance and accountability requirements inside organizations

Find Business Support

Identify Business Risks with Entity Health Checks and Partner Review Services

Responsibilities extend beyond policy drafting to include data processing and cross-border transfer impact assessments, breach coordination within statutory timelines, periodic staff training, and internal compliance audits.

HR must address employee data handling and training, IT must embed technical safeguards, and legal and compliance functions must oversee documentation, audits, and regulatory engagement, reshaping internal operating models around data governance.

Cross-border data transfers and impact assessment obligations

Scope of cross-border personal data transfers

Cross-border personal data transfers are defined broadly under the new rules, encompassing direct transfers, offshore storage, cloud-based processing, and onward processing of data collected in Vietnam. As a result, routine arrangements such as regional data hubs, global HR systems, centralized Customer Relationship Management (CRM) platforms, and overseas analytics environments now fall clearly within the scope of cross-border transfer regulation.

Data transfer impact assessment requirements

To manage these risks, the decree introduces mandatory data transfer impact assessment dossiers. Organizations engaging in cross-border transfers must prepare and submit a comprehensive assessment within 60 days from the start of the transfer via the Ministry of Public Security’s portal. The dossier must document transfer purposes, data categories, consent mechanisms, security safeguards, recipient protections, and risk mitigation measures.

Authorities review the filing within 15 days and may require revisions if documentation proves incomplete or insufficient.

Enforcement powers and compliance implications

Regulators now have explicit authority to suspend or halt cross-border transfers where data is used in ways that threaten national security or where serious violations of data protection obligations occur. For multinational enterprises, shared service centers, and cloud-dependent businesses, this framework raises practical challenges.

Organizations must reassess data localization assumptions, strengthen vendor controls, and align cross-border data architectures with Vietnam-specific compliance requirements to avoid operational disruption.

Sector and technology-specific rules

Sector-specific rules

Find Business Support

Navigating digital growth across Asian markets

Targeted compliance obligations now apply to sectors and technologies that process personal data at scale or pose elevated risk. In the finance, banking, and credit information sectors, organizations must apply approved technical standards, maintain end-to-end processing logs, conduct annual compliance assessments, and adhere to strict breach notification protocols specific to the financial sector.

Consent notices must also disclose scoring, profiling, and credit evaluation activities with clear retention periods.

Technology-specific rules

For AI systems, big data analytics, blockchain, cloud computing, and metaverse platforms, the decree establishes a forward-looking governance framework:

• Organizations must limit collection to defined purposes, implement strong encryption and access controls, and apply anonymization or de-identification where feasible.
• AI-driven processing that affects individuals requires transparency on automated decision logic, meaningful explanations of impact, and opt-out mechanisms.
• Blockchain deployments must avoid storing identifiable personal data on-chain, while cloud contracts must clearly allocate data protection responsibilities.

Recommendation for businesses

Enforcement powers expand significantly under the new regime, granting authorities broad inspection and supervisory authority, including routine and ad hoc compliance reviews. Organizations must maintain complete records of data processing activities, impact assessments, and breach incidents, with certain records retained for at least five years.

In the event of a breach involving sensitive personal data, businesses must notify regulators within 72 hours.

Notably, for the finance and banking sectors, as well as breaches involving biometric or location data, organizations must also notify the affected data subjects within this same 72-hour window.

Non-compliance exposes organizations to severe penalties, including administrative fines, suspension of cross-border data flows, and potential license revocation. Beyond legal exposure, forced remediation and system disruptions can severely undermine commercial partnerships and customer trust.

• Previous Article Vietnam Introduces Motorcycle Emission Standards amid Nationwide Air-Quality Reforms
• Next Article