Página traducida y verificada automáticamente. Prevalece la versión en inglés. Algunas partes siguen en inglés mientras se verifica su traducción. Ver en inglés · Informar un error de traducción
Regulaciones › Resto del mundo › Vietnam
PDPL
Ley de Protección de Datos Personales (n.º 91/2025/QH15)
CuándoEn vigor desde el 1 de enero de 2026
Quién la aplicaMinisterio de Seguridad Pública, Departamento de Ciberseguridad y Prevención de Delitos de Alta Tecnología (A05)
A quién se aplicaOrganizaciones y personas en Vietnam, y entidades extranjeras que tratan directamente datos personales de ciudadanos y residentes vietnamitas.
Informar al reguladorNotificar al organismo especializado (A05) en un plazo de 72 horas desde la detección de una violación que probablemente cause gra…
DPO obligatorioDebe designarse personal o un departamento cualificado de protección de datos, o contratarse a un proveedor de servicios
RegistroSin registro de responsables
Transferencias al extranjeroEl expediente de evaluación de impacto de la transferencia debe presentarse ante el MPS en un plazo de 60 días desde la primera transferencia, ad…
Plazo de solicitudesAcusar recibo en un plazo de 2 días hábiles
Multa máximaHasta el 5% de los ingresos del año anterior por infracciones transfronterizas, 10 veces los ingresos por comercio ilegal de da…
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Alcance y base jurídica
Alcance extraterritorial
3
Applies to foreign entities in Vietnam and to foreign entities directly processing data of Vietnamese citizens and residents in Vietnam.Art. 1(2) · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial.
Base jurídica
3
Consent is the default basis; the Law adds listed exceptions such as contract performance, legal obligations and protecting legitimate rights.Art. 9 (exceptions in later articles) · secondary source · source ↗
Exception article number not confirmed.
Consentimiento
3
Consent must be voluntary, informed, per purpose and provable in writing or verifiable form; silence, defaults and pre-ticked boxes are invalid.Art. 9; Decree 356 Art. 6 · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial.
Datos sensibles
2
Sensitive data list set by Government (now includes banking, credit, location and behavioral data); extra safeguards and notice required.Arts. 2(3), 26, 27, 31 · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial.
Niños
2
Legal representative acts for children (under 16); child aged 7+ and representative must both consent for private-life data.Art. 24(2)-(3) · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial. Under-16 definition comes from the Law on Children.
Derechos de las personas
Derechos
2
Be informed, consent and withdraw, access, correction, deletion, restriction, objection, complaint and lawsuit.Arts. 4(1), 10 · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial. Counted 5 core rights (access, correction, deletion, restriction, objection); no portability right confirmed.
Plazo de solicitudes
3
Acknowledge within 2 working days; access or correction within 10 days, restriction or objection 15 days, deletion 20 days (longer if processors involved).Decree 356 Art. 5 · secondary source · source ↗
Decree 13 had 72 hours; Decree 356 replaced it on 1 Jan 2026.
Marketing
2
Consent required for behavioral and targeted advertising, with an opt-out mechanism, plus anti-spam rules.Arts. 28-29 · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial.
Gobernanza
DPO obligatorio
2
Must appoint qualified data protection personnel or department, or hire a service provider.Art. 33(1)-(2) · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial. Small businesses/startups have a 5-year grace period; household and micro businesses exempt unless processing sensitive data or many data subjects.
Requisitos del DPO
2
College degree or higher, at least 2 years relevant experience, and training in personal data protection law and skills.Decree 356 Art. 13(2) · secondary source · source ↗
Registro
1
No controller registration; impact assessment dossiers are filed with the Ministry of Public Security instead.Arts. 21-22 · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial. Filing counted under dpia.
DPIA
3
Impact assessment dossier must be filed with the A05 department within 60 days of starting processing and updated every 6 months.Arts. 21-22 · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial. MPS reviews within 15 days (PwC).
Registros
2
Controllers must keep evidence of consent and document processing in the filed impact assessment dossier.Decree 356 Art. 6(2); Art. 21 · secondary source · source ↗
No standalone ROPA article confirmed; scored on dossier documentation.
Conservación
2
Delete when purpose is complete, retention period ends, ordered by authorities, or on request.Art. 14 · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial.
Violaciones de datos
Informar al regulador
2
Notify the specialized agency (A05) within 72 hours of detecting a breach likely to cause serious harm.Art. 23(1)-(2) · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial.
Informar a las personas
1
Notify individuals only for biometric data incidents or financial-sector (bank) sensitive data incidents.Art. 23; Decree 356 Art. 8 · secondary source · source ↗
Narrow sectoral duty; no general individual notice confirmed.
Transferencias
Transferencias al extranjero
3
Transfer impact assessment dossier must be filed with MPS within 60 days of first transfer, plus a written agreement with the recipient.Art. 20 · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial. Filing rather than prior approval; some HR, hotel, visa and payment data exempt.
Localización
2
Certain domestic and foreign service providers must store specified user data in Vietnam under cybersecurity rules.Cybersecurity Law 2018 Art. 26; Decree 53/2022 · secondary source · source ↗
Outside Law 91; not re-verified this session. Check whether the 2025 Cybersecurity Law changes the rule.
Aplicación de la ley
Multa máxima
3
Up to 5% of prior-year revenue for cross-border violations, 10x revenue for illegal data trading, VND 3 billion for other violations.Art. 8(3)-(6) · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial.
Responsabilidad penal
2
Violations may be criminally prosecuted depending on severity under the Penal Code.Art. 8(1); Penal Code Art. 288 · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial. Penal Code article not verified this session.
Acción privada
2
Violators must compensate damage; controllers and processors liable for losses caused by their processing.Arts. 8(1), 37 · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Biblioteca de regulaciones
Todas las leyes estatales de privacidad de EE. UU., en un mapa
24 estados tienen una ley integral de privacidad en la biblioteca, junto con las leyes de la UE, del Reino Unido, federales de EE. UU. y globales: 102 en total, cada una explicada en palabras sencillas con sus fuentes. Seleccione un estado para ver qué se aplica allí.
- En vigor
- Entrada en vigor
- Leyes sectoriales