NATIONAL ASSEMBLY OF THE SOCIALIST REPUBLIC OF VIETNAM Law No.: 91/2025/QH15 Independence - Freedom - Happiness
LAW
PROTECTION OF PERSONAL DATA
Pursuant to the Constitution of the Socialist Republic of Vietnam as amended and supplemented by certain provisions according to Resolution No. 203/2025/QH15;
The National Assembly promulgates the Law on Protection of Personal Data.
Chapter I. GENERAL PROVISIONS
Article 1. Scope of regulation and subjects of application
1. This law stipulates personal data, protection of personal data, and the rights, obligations, and responsibilities of relevant agencies, organizations, and individuals.
2. This law applies to:
a) Vietnamese agencies, organizations, and individuals;
b) Foreign agencies, organizations, and individuals in Vietnam;
c) Foreign agencies, organizations, or individuals directly participating in or related to the processing of personal data of Vietnamese citizens and Vietnam-origin people with undetermined nationality residing in Vietnam who have been issued an identification card.
Article 2. Interpretation of terms
In this Law, the terms below are understood as follows:
1. Personal data is numerical data or information in another form that identifies or helps to identify a specific person, including: basic personal data and sensitive personal data. Personal data, once de-identified, is no longer personal data.
2. Basic personal data is personal data that reflects common identity and background factors, frequently used in transactions and social relations, included in the list issued by the Government.
3. Sensitive personal data is personal data associated with an individual's privacy, which, when violated, will directly affect the rights and legitimate interests of agencies, organizations, or individuals, and belongs to the list issued by the Government.
4. Personal data protection is the act of agencies, organizations, or individuals using forces, means, and measures to prevent and combat activities that infringe on personal data.
5. The subject of personal data is the person reflected by the personal data.
6. Personal data processing is the activity that affects personal data, including one or more of the following actions: collection, analysis, aggregation, encryption, decryption, editing, deletion, destruction, anonymization, provision, disclosure, transfer of personal data, and other activities that impact personal data.
7. The personal data controller is the agency, organization, or individual that determines the purposes and means of processing personal data.
8. The personal data processor is an agency, organization, or individual that processes personal data at the request of the personal data controller or the controller and processor of personal data through a contract.
9. The controller and processor of personal data is an agency, organization, or individual that decides the purpose, means, and directly processes personal data.
10. A third party is an organization or individual outside the personal data subject, the personal data controller, the controller and processor of personal data, and the personal data processor involved in processing personal data in accordance with the law.
11. Personal data de-identification is the process of modifying or deleting information to create new data that cannot be identified or cannot help identify a specific human being.
12. Personal data processing impact assessment is the analysis and evaluation of potential risks that may occur during the processing of personal data in order to apply risk mitigation measures and protect personal data.
Article 3. Principles of personal data protection
1. Comply with the provisions of the Constitution, the provisions of this Law, and other relevant legal regulations.
2. Personal data must only be collected and processed within the correct scope, specific and clear purposes, ensuring compliance with legal regulations.
3. Ensure the accuracy of personal data and update, correct, and supplement it when necessary; store it for a period appropriate to the purpose of processing personal data, except as otherwise provided by law.
4. Effectively implement coordinated measures and solutions regarding institutional, technical, and human factors suitable for personal data protection.
5. Proactively prevent, detect, stop, combat, and promptly and strictly handle all acts of violating the law on personal data protection.
6. Protect personal data in conjunction with protecting national and ethnic interests, serving socio-economic development, ensuring national defense, security, and foreign affairs; ensure harmony between personal data protection and protecting the legal rights and interests of agencies, organizations, and individuals.
Article 4. Rights and obligations of personal data subjects
1. The rights of personal data subjects include:
a) Being informed about personal data processing activities;
b) Agreeing or disagreeing, requesting to withdraw consent for allowing personal data processing;
c) Viewing, editing, or requesting the correction of personal data;
d) Requesting the provision, deletion, restriction of the processing of personal data; submitting requests to object to personal data processing;
đ) Filing complaints, denunciations, lawsuits, and requesting compensation for damages as prescribed by law;
e) Request competent authorities or agencies, organizations, and individuals involved in processing personal data to implement measures and solutions to protect their personal data as prescribed by law.
2. Obligations of personal data subjects include:
a) Protecting their own personal data;
b) Respecting and protecting the personal data of others;
c) Providing complete and accurate personal data in accordance with the law, in accordance with contracts, or when consenting to allow the processing of their personal data;
d) Complying with the law on personal data protection and participating in the prevention and combat of personal data infringement activities.
3. Personal data subjects, when exercising their rights and obligations, must fully comply with the following principles:
a) Comply with the provisions of the law; fulfill the obligations of the personal data subject under the contract. The exercise of the rights and obligations of the personal data subject must aim to protect the legal rights and interests of that personal data subject;
b) Must not create difficulties or obstruct the exercise of legal rights and obligations of the personal data controller, the personal data controller and processor, or the personal data processor;
c) Must not infringe upon the legal rights and interests of the State, agencies, organizations, or other individuals.
4. Agencies, organizations, and individuals are responsible for facilitating and must not create difficulties or obstruct the exercise of the rights and obligations of the personal data subject in accordance with the provisions of the law.
5. Upon receiving a request from the data subject to exercise the rights of the data subject as specified in Clause 1 of this Article, the personal data controller, and those who control and process personal data, must promptly act within the time limit prescribed by law.
The Government shall provide detailed regulations on this clause.
Article 5. Application of Law on Personal Data Protection
1. Personal data protection activities on the territory of the Socialist Republic of Vietnam shall be implemented in accordance with the provisions of this Law and other relevant legal regulations.
2. In the case where laws or resolutions of the National Assembly issued before the effective date of this Law contain specific provisions on personal data protection that do not conflict with the principles of personal data protection under this Law, the provisions of such laws or resolutions shall apply.
3. In cases where laws or resolutions of the National Assembly issued after the effective date of this Law contain provisions on personal data protection that differ from the provisions of this Law, it is required to specifically stipulate the content to be implemented or not implemented according to the provisions of this Law, and the content to be implemented according to the provisions of that law or resolution.
4. In cases where agencies, organizations, or individuals conduct impact assessments on personal data processing or cross-border personal data transfer in accordance with this Law, they are not required to conduct risk assessments on personal data processing or impact assessments on cross-border personal data transfer in accordance with data legislation.
Article 6. International cooperation on personal data protection
1. Comply with the laws of Vietnam, international treaties to which the Socialist Republic of Vietnam is a member, and international agreements on personal data protection on the basis of equality, mutual benefit, and respect for independence, sovereignty, and territorial integrity.
2. The content of international cooperation on personal data protection includes:
a) Establishing mechanisms for international cooperation to facilitate the effective enforcement of personal data protection laws;
b) Participating in legal assistance regarding personal data protection of other countries;
c) Preventing and combating acts of personal data infringement;
d) Training human resources, conducting scientific research, and applying science and technology in personal data protection;
d) Exchanging experiences in developing and implementing personal data protection laws;
e) Transferring technology for the purpose of personal data protection.
3. The government stipulates the responsibility for performing international cooperation on personal data protection.
Article 7. Acts Prohibited
1. Processing personal data to act against the Socialist Republic of Vietnam, affecting national defense, national security, social order, public safety, and the legal rights and interests of agencies, organizations, and individuals.
2. Obstructing personal data protection activities.
3. Exploiting personal data protection activities to commit acts of law violation.
4. Processing personal data in violation of the provisions of law.
5. Using another person's personal data or allowing others to use one's personal data to commit acts in violation of the law.
6. Buying or selling personal data, except as otherwise provided by law.
7. Appropriating, intentionally disclosing, or causing the loss of personal data.
Article 8. Handling violations of the law on personal data protection
1. Organizations and individuals that violate the provisions of this Law and other relevant legal regulations on personal data protection, depending on the nature, severity, and consequences of the violation, may be subject to administrative sanctions or criminal liability; if damage is caused, compensation must be provided in accordance with legal regulations.
2. The handling of administrative violations in the field of personal data protection is carried out in accordance with the provisions of Clauses 3, 4, 5, 6, and 7 of this Article and the law on handling administrative violations.
3. The maximum monetary fine in administrative sanctions for the act of buying and selling personal data is 10 times the amount earned from the violation; in cases where there is no revenue from the violation or the fine calculated based on the revenue from the violation is lower than the maximum fine prescribed in Clause 5 of this Article, the monetary fine according to the provisions of Clause 5 of this Article shall be applied.
4. The maximum monetary fine in administrative sanctions for organizations that violate the regulations on cross-border transfer of personal data is 5% of the revenue of the preceding year of that organization; in cases where there is no revenue from the preceding year or the fine calculated based on the revenue is lower than the maximum fine prescribed in Clause 5 of this Article, the monetary fine according to the provisions of Clause 5 of this Article shall be applied.
5. The maximum monetary fine for administrative violations regarding other breaches in the field of personal data protection is 3 billion VND.
6. The maximum monetary fine stipulated in clauses 3, 4, and 5 of this Article applies to organizations; for individuals committing the same violation, the maximum fine is half of the fine applicable to organizations.
7. The Government shall regulate the method of calculating the amount of revenue obtained from committing violations of the law on personal data protection.
Chapter II. PERSONAL DATA PROTECTION
Section 1. PERSONAL DATA PROTECTION
DURING THE PROCESS OF PERSONAL DATA PROCESSING
Article 9. Consent of the personal data subject
1. The consent of the personal data subject is the action of the personal data subject allowing the processing of their personal data, except in cases where the law provides otherwise.
2. The consent of the personal data subject is only valid when based on voluntary agreement and full knowledge of the following information:
a) The type of personal data being processed, the purpose of processing personal data;
b) The personal data controller or the controller and processor of personal data;
c) The rights and obligations of the personal data subject.
3. The consent of the personal data subject must be expressed in a clear and specific manner, can be printed, copied in writing, including in electronic form or in a verifiable format.
4. The consent of the personal data subject must ensure the following principles:
a) Express consent for each purpose;
b) Must not be accompanied by the condition of mandatory agreement to purposes other than those agreed;
c) Consent is effective until the personal data subject changes that consent or as prescribed by law;
d) Silence or failure to respond shall not be considered consent.
5. The Government shall provide detailed regulations on Clause 3 of this Article.
Article 10. Requests for withdrawal of consent, requests to restrict the processing of personal data
1. A personal data subject has the right to request the withdrawal of consent for the processing of personal data and to request the restriction of the processing of their personal data when there are doubts about the scope, purpose of processing personal data, or the accuracy of personal data, except in cases prescribed in Article 19 of this Law or in cases where other legal provisions apply.
2. Requests to withdraw consent or to restrict the processing of personal data by the data subject must be made in writing, including in electronic form or a verifiable format, and sent to the personal data controller, the controller, and the personal data processor. Requests to withdraw consent or to restrict the processing of personal data by the data subject are carried out in accordance with the provisions of the law and the agreement between the parties.
3. The personal data controller, the controller, and the personal data processor shall receive, implement, and request the personal data processor to implement the request to withdraw consent or restrict the processing of the personal data subject's personal data within the time frame prescribed by law.
4. The implementation of the request to withdraw consent, or the request to restrict the processing of personal data does not apply to the processing of personal data conducted before the personal data subject requests to withdraw consent or requests to restrict the processing of personal data.
Article 11. Collection, Analysis, and Aggregation of Personal Data
1. Personal data must be collected with the consent of the personal data subject prior to collection, except in cases where the law provides otherwise.
2. Authorized Party and State agencies may analyze and aggregate personal data from self-collected sources or from data that is shared, provided, transferred, exploited, or used to serve the leadership, direction, state management, and socio-economic development in accordance with the law.
3. Agencies, organizations, and individuals not specified in Clause 2 of this Article are allowed to analyze and aggregate personal data from sources of personal data that are permitted to be processed in accordance with the law.
Article 12. Encoding and decoding personal data
1. Encoding personal data is the process of transforming personal data into a form that cannot be recognized as personal data if not decoded; personal data after being encoded still constitutes personal data.
2. Personal data that is a state secret must be encoded and decoded in accordance with the laws on state secrets protection and cryptography law.
3. Agencies, organizations, and individuals decide on the encoding and decoding of personal data in accordance with personal data processing activities.
Article 13. Editing personal data
1. The personal data subject can self-edit their personal data for certain types of personal data according to an agreement with the personal data controller, the controller, and the personal data processor; they may request the personal data controller, the controller, and the personal data processor to edit their personal data.
2. The personal data controller, the controller, and the personal data processor edit personal data after the personal data subject requests it or edit personal data in accordance with the provisions of the law; they may request the personal data processor or a third party to edit the personal data of the personal data subject.
3. Editing personal data must ensure accuracy. In cases where personal data cannot be edited for legitimate reasons, the personal data controller, the controller, and the personal data processor must notify the requesting agencies, organizations, or individuals.
Article 14. Deletion, destruction, anonymization of personal data
1. The deletion or destruction of personal data is carried out in the following cases:
a) The personal data subject requests and accepts the risks and possible damages to themselves. The request of the personal data subject in this case must fully comply with the principles stipulated in Clause 3, Article 4 of this Law;
b) The purpose of processing personal data has been completed;
c) The storage period prescribed by law has expired;
d) Implemented according to the decision of a competent state agency;
đ) Implemented according to the agreement;
e) Other cases as prescribed by law.
2. The request of the personal data subject to delete or destroy personal data shall not be carried out in the cases prescribed in Article 19 of this Law or if the deletion or destruction of personal data violates the provisions in Clause 3, Article 4 of this Law.
3. The personal data controller, the personal data controller and processor shall delete or destroy personal data in the cases prescribed in Clause 1 of this Article or upon request of the personal data processor or a third party to delete or destroy the personal data of the data subject. The deletion or destruction of personal data must be carried out using secure measures; preventing unauthorized intrusion and recovery of deleted or destroyed personal data.
4. Agencies, organizations, and individuals are not allowed to intentionally restore personal data that has been deleted or destroyed without authorization.
5. The personal data controller, the personal data controller and processor, and the personal data processor are responsible for complying with the provisions of this Law. In cases where personal data cannot be deleted or destroyed for legitimate reasons after receiving a request from the data subject, the personal data controller, the personal data controller and processor must notify the data subject.
6. The de-identification of personal data is regulated as follows:
a) Agencies, organizations, and individuals that de-identify personal data are responsible for strictly controlling and supervising the process of de-identifying personal data; preventing unauthorized access, copying, appropriation, disclosure, or loss of personal data during the de-identification process;
b) Personal data must not be re-identified after it has been de-identified, except in cases where the law provides otherwise;
c) The de-identification of personal data must comply with the provisions of this Law and other relevant legal regulations.
Article 15. Provision of personal data
1. The personal data subject shall provide personal data to agencies, organizations, or individuals in accordance with the law or pursuant to an agreement with those agencies, organizations, or individuals.
2. The personal data controller, and the personal data controller and processor, shall provide personal data in the following cases:
a) Provide personal data to the data subject upon the request of the data subject in accordance with the provisions of law, and agreements with the data subject, except in cases where providing such data may cause harm to national defense, national security, public order, social safety, or infringe upon the life, health, or property of others;
b) Provide personal data to other agencies, organizations, or individuals when agreed upon by the data subject, except in cases where the law provides otherwise.
Article 16. Public disclosure of personal data
1. Personal data may only be disclosed for a specific purpose. The scope of disclosure and the type of personal data disclosed must be appropriate to the purpose of the disclosure. The disclosure of personal data must not infringe upon the rights and legitimate interests of the personal data subject.
2. Personal data may only be disclosed in the following cases:
a) When there is consent from the personal data subject;
b) In compliance with the provisions of the law;
c) In the case specified in point b, clause 1, Article 19 of this Law;
d) To perform obligations under a contract.
3. Disclosed personal data must accurately reflect the personal data from the original data source and facilitate agencies, organizations, and individuals in accessing, exploiting, and using it.
4. Forms of personal data disclosure include: posting data on electronic information sites, electronic portals, mass media, and other forms as prescribed by law.
5. Agencies, organizations, and individuals disclosing personal data must strictly control and supervise the disclosure of personal data to ensure compliance with the purpose, scope, and provisions of the law; prevent access, use, disclosure, copying, modification, deletion, destruction, or other unauthorized processing acts on disclosed personal data within their capability and conditions.
Article 17. Transfer of personal data
1. The transfer of personal data shall be carried out in the following cases:
a) Transfer of personal data with the consent of the personal data subject;
b) Sharing personal data between departments within the same agency or organization to process personal data in accordance with the established processing purposes;
c) Transferring personal data to continue processing personal data in cases of splitting, separating, merging agencies, organizations, administrative units, and reorganizing, converting the form of state-owned enterprise ownership; splitting, separating, merging, consolidating, terminating the operation of units or organizations; units or organizations established based on the termination of other units or organizations;
d) The personal data controller, the controller and processor of personal data transferring personal data to the personal data processor or a third party to process personal data in accordance with regulations;
d) Transfer of personal data at the request of competent state authorities;
e) Transfer of personal data in cases specified in Clause 1, Article 19 of this Law.
2. The transfer of personal data in the cases specified in clause 1 of this Article, whether for a fee or free of charge, shall not be considered as buying or selling personal data.
3. The government shall provide detailed regulations on this Article.
Article 18. Other activities in personal data processing
1. The personal data controller, the personal data controller and processor, the personal data processor, and the third party storing personal data shall do so in a manner suitable for their activities and have measures to protect personal data during storage in accordance with the provisions of law.
2. The storage, access, retrieval, connection, coordination, verification, authentication of personal data, and other activities affecting personal data shall be carried out in accordance with the provisions of this Law, data-related laws, other relevant legal regulations, and the agreements between the parties.
3. Prioritize exploiting and using personal data for activities serving state management and the operations of public service units in order to pilot certain special mechanisms and policies that create breakthroughs in the development of science, technology, innovation, and national digital transformation.
Article 19. Processing personal data without the consent of the personal data subject
1. Cases of processing personal data without the consent of the personal data subject include:
a) To protect the life, health, honor, dignity, rights, and legitimate interests of the personal data subject or others in urgent cases; protect
to protect their own legitimate rights or interests, those of others, or the interests of the State or an agency/organization as necessary against acts infringing upon the aforementioned interests. The personal data controller, personal data processor, personal data controller and processor, or a third party bears the responsibility to prove this case;
(b) To resolve an emergency situation; a risk threatening national security that has not reached the level of declaring a state of emergency; to prevent and combat riots, terrorism, crime, and violations of the law;
(c) To serve the activities of state agencies and state management operations as prescribed by law;
(d) To implement the agreement of the personal data subject with the relevant agency, organization, or individual in accordance with the law;
(e) Other cases as prescribed by law.
2. Agencies, organizations, and individuals involved must establish a monitoring mechanism when processing personal data in cases where the consent of the personal data subject is not required, including:
a) Establishing procedures and regulations for processing personal data and determining the responsibilities of agencies, organizations, and individuals in the process of personal data processing;
b) Implementing appropriate personal data protection measures; regularly assessing potential risks in the process of personal data processing;
c) Conducting periodic inspections and evaluations of compliance with legal regulations, procedures, and regulations on personal data processing;
d) Having a mechanism to receive and handle feedback and recommendations from relevant agencies, organizations, and individuals.
Article 20. Cross-border transfer of personal data
1. Cases of cross-border transfer of personal data include:
a) Transferring personal data stored in Vietnam to a data storage system located outside the territory of the Socialist Republic of Vietnam;
b) Agencies, organizations, or individuals in Vietnam transferring personal data to organizations or individuals abroad;
c) Agencies, organizations, or individuals in Vietnam or abroad using a platform outside the territory of the Socialist Republic of Vietnam to process personal data collected in Vietnam.
2. Agencies, organizations, and individuals transferring personal data across borders to carry out the activities specified in Clause 1 of this Article must prepare an impact assessment file.
2. Agencies, organizations, or individuals transferring personal data across borders must carry out the activities specified in Clause 1 of this Article, establish a cross-border personal data transfer impact assessment file, and send one official copy to the specialized personal data protection authority within 60 days from the first day of cross-border personal data transfer, except in cases specified in Clause 6 of this Article.
3. The cross-border personal data transfer impact assessment is conducted once for the entire duration of the activities of that agency, organization, or individual and is updated in accordance with the provisions of Article 22 of this Law.
4. The specialized agency for personal data protection decides to conduct periodic checks on cross-border personal data transfers no more than once a year or ad hoc inspections when detecting violations of the personal data protection law or when personal data leaks or losses occur.
5. The specialized agency for personal data protection decides to request the suspension of cross-border personal data transfers by agencies, organizations, or individuals when it is discovered that personal data is being transferred for use in activities that may harm national defense or national security.
6. Cases that are not required to comply with the regulations on assessing the impact of cross-border personal data transfers include:
a) Cross-border personal data transfers of competent state agencies;
b) Agencies or organizations storing employees' personal data of that agency or organization on cloud computing services;
c) The data subject transfers their personal data across borders themselves;
d) Other cases as prescribed by the Government.
7. The Government shall provide detailed regulations on Clauses 1, 5, and 6 of this Article; prescribe the components of the dossier, conditions, procedures, and processes for assessing the impact of cross-border personal data transfer.
Article 21. Personal Data Processing Impact Assessment
1. The personal data controller, the controller and processor of personal data shall prepare and store a record of the personal data processing impact assessment and submit 01 original copy to the specialized agency for personal data protection within 60 days from the first day of processing personal data, except for the cases specified in Clause 6 of this Article.
2. The personal data processing impact assessment shall be conducted once for the entire operating period of the personal data controller, the controller and processor of personal data and shall be updated as prescribed in Article 22 of this Law.
3. The personal data processor shall prepare and store the personal data processing impact assessment file in accordance with the agreement with the personal data controller, the controller and processor of personal data, except in the cases specified in clause 6 of this Article.
4. The specialized agency for personal data protection shall assess and request the personal data controller, the controller and processor of personal data, and the personal data processor to complete the personal data processing impact assessment file in cases where the file is incomplete or not in compliance with regulations.
5. The personal data controller, the controller and processor of personal data, and the personal data processor shall update and supplement the personal data processing impact assessment file when there are changes to the content of the file previously submitted to the specialized agency for personal data protection.
6. The competent state agencies are not required to comply with the regulations on the personal data processing impact assessment stipulated in this Article.
7. The government shall stipulate the components of the dossier, conditions, order, and procedures for assessing the impact of personal data processing.
Article 22. Updating the dossier for assessing the impact of personal data processing and the dossier for assessing the impact of cross-border personal data transfer
1. The dossier for assessing the impact of personal data processing and the dossier for assessing the impact of cross-border personal data transfer shall be updated every 6 months when there are changes, or updated immediately in the cases stipulated in Clause 2 of this Article.
2. Cases that require immediate updates include:
a) When an agency, organization, or unit is reorganized, ceases operations, is dissolved, or goes bankrupt according to the provisions of law;
b) When there is a change in information about the organization or individual providing personal data protection services;
c) When there arises or changes in the industry, profession, or business services related to the processing of personal data that has been registered in the personal data processing impact assessment file or the cross-border personal data transfer impact assessment file.
3. The updating of the personal data processing impact assessment file and the cross-border personal data transfer impact assessment file is carried out on the National Personal Data Protection Information Portal or at the agency specialized in personal data protection.
4. The Government shall provide detailed regulations on this Article.
Article 23. Notification of violations of personal data protection regulations
1. The personal data controller, the personal data controller and processor, and any third party detecting violations of personal data protection regulations that may cause harm to national defense, national security, social order, public safety, or infringe upon the life, health, honor, dignity, or property of the data subject must notify the specialized personal data protection authority no later than 72 hours from the time the violation is detected. In the case where the personal data processor detects a violation, it must promptly notify the personal data controller or the personal data controller and processor.
2. The personal data controller, the personal data controller and processor must prepare a written record confirming the occurrence of a violation of personal data protection regulations and cooperate with the specialized personal data protection authority in handling the violation.
3. Agencies, organizations, and individuals shall notify the specialized agency for personal data protection in the following cases:
a) Detecting acts of violation of regulations on personal data protection;
b) Personal data is processed for the wrong purpose, not in accordance with the agreement between the personal data subject and the personal data controller, the controller, and the personal data processor;
c) Failing to ensure the rights or improperly exercising the rights of the personal data subject;
d) Other cases as prescribed by law.
4. The specialized agency for personal data protection is responsible for receiving notifications and handling acts that violate personal data protection regulations. The personal data controller, the personal data processor, third parties, and related agencies, organizations, and individuals are responsible for preventing violations, remedying the consequences, and coordinating with the specialized personal data protection agency in handling acts that violate personal data protection regulations.
5. The Government shall specify the contents of the notification of violations of personal data protection regulations.
Section 2. PERSONAL DATA PROTECTION IN CERTAIN ACTIVITIES
Article 24. Protection of personal data of children, persons who have lost or have limited civil act capacity, and persons with difficulties in cognition or self-control of conduct
1. Protect the personal data of children, persons who have lost or are limited in their civil act capacity, and persons with cognitive difficulties, managing behavior in accordance with the provisions of this Law.
2. For children, persons who have lost or have limited civil act capacity, or persons who have difficulties in cognition or controlling behavior, their legal representatives shall exercise the rights of the personal data subject on their behalf, except in cases specified in clause 1, Article 19 of this Law. The processing of children's personal data for the purpose of publishing or disclosing information about the private life or personal secrets of children from 7 years of age onwards must have the consent of both the child and the legal representative.
3. Stop processing the personal data of children, persons who have lost or have limited civil act capacity, or persons who have difficulties in cognition or controlling behavior in the following cases:
a) The person who has agreed to the provisions in Clause 2 of this Article withdraws their consent to allow the processing of personal data of children, persons who have lost or have limited civil act capacity, persons with difficulties in cognition or behavior control, except where the law provides otherwise;
b) At the request of a competent authority when there is sufficient evidence proving that the processing of personal data may infringe upon the rights and legitimate interests of children, persons who have lost or have limited civil act capacity, persons with difficulties in cognition or behavior control, except where the law provides otherwise.
Article 25. Protection of personal data in recruitment, management, and use of employees
1. The responsibilities for protecting personal data of agencies, organizations, and individuals in labor recruitment are regulated as follows:
a) Only be required to provide information serving the recruitment purposes of agencies, organizations, or recruiting individuals in accordance with the provisions of law; the information provided may only be used for recruitment purposes and other purposes as agreed in accordance with the provisions of law;
b) The information provided must be processed in accordance with the provisions of law and with the consent of the applicant;
c) Must delete or destroy the information provided by the applicant in the case of non-recruitment, except in cases where there is a different agreement with the applicant;
2. Responsibilities for protecting personal data of agencies, organizations, and individuals in the management and use of employees are regulated as follows:
a) Comply with the provisions of this Law, labor and employment laws, data laws, and other relevant legal regulations;
b) Personal data of employees must be stored within the time frame prescribed by law or according to an agreement;
c) Personal data of employees must be deleted or destroyed when the contract is terminated, except in cases specified by agreement or law.
3. The processing of employees' personal data collected through technological and technical means in employee management is regulated as follows:
a) Technological and technical measures may only be applied in accordance with legal regulations and ensuring the rights and interests of the personal data subject, on the basis that the employee is fully aware of such measures;
b) Personal data collected through technological and technical measures that violate legal regulations must not be processed or used.
Article 26. Protection of personal data regarding health information and in insurance business activities
1. The protection of personal data regarding health information and in insurance business activities is regulated as follows:
a) Must have the consent of the personal data subject in the process of collecting and processing personal data, except in the cases prescribed in Clause 1, Article 19 of this Law;
b) Fully apply the provisions on personal data protection and other relevant legal regulations.
2. Agencies, organizations, and individuals operating in the health sector do not provide personal data to third parties that are organizations providing healthcare services or health insurance, life insurance services, except in cases where there is a written request from the personal data subject or cases prescribed in Clause 1, Article 19 of this Law.
3. Organizations and individuals developing medical applications or insurance business applications must fully comply with the provisions on personal data protection.
4. In the case of businesses operating in reinsurance, retrocession, and transferring personal data to partners, this must be clearly stated in the contract with the customer.
Article 27. Protection of personal data in financial, banking, and credit information activities
1. Organizations and individuals operating in the fields of finance, banking, and credit information activities have the following responsibilities:
a) Fully comply with regulations on the protection of sensitive personal data, safety, and security standards in financial and banking activities according to the provisions of law;
b) Not use the credit information of a personal data subject to score, rank credit, evaluate credit information, or assess the creditworthiness of the personal data subject without the consent of the personal data subject;
c) Only collect the personal data necessary for credit information activities from sources that are in accordance with the provisions of this Law and other relevant legal regulations;
d) Notify the data subject in case of disclosure or loss of information about bank accounts, financial accounts, credit, and credit information.
2. Organizations and individuals conducting credit information activities are responsible for complying with the provisions of this Law; applying measures to prevent, combat unauthorized access, use, disclosure, and modification of customers' personal data; having solutions to recover customers' personal data in case of loss; ensuring confidentiality during the collection, provision, and processing of customers' personal data for credit information assessment.
3. The government shall provide detailed regulations on this Article.
Article 28. Protection of personal data in advertising service business
1. Organizations and individuals conducting advertising services are only allowed to use customers' personal data that is provided by the personal data controller, transferred by the controller and processor of personal data according to an agreement, or collected through their own business activities in order to conduct advertising services. The collection, use, and transfer of personal data must ensure the rights of personal data subjects as prescribed in Article 4 of this Law.
2. The personal data controller, and the controller and processor of personal data, may only transfer personal data to organizations and individuals conducting advertising services in accordance with the provisions of the law.
3. The processing of customers' personal data for advertising services must have the customer's consent, based on the customer being fully informed about the content, methods, forms, and frequency of product introductions; and providing customers with a way to refuse receiving advertising information.
4. The use of personal data for advertising must comply with the provisions of the law on preventing spam messages, spam emails, spam calls, and the provisions of the law on advertising.
5. Personal data subjects have the right to request to stop receiving information from advertising services. Organizations and individuals conducting advertising services must provide mechanisms and stop advertising upon the request of the personal data subject.
6. Organizations and individuals conducting advertising services are not allowed to subcontract or agree for other organizations or individuals to perform the entire advertising service using personal data on their behalf.
7. Organizations and individuals conducting advertising services are responsible for proving the use of customers' personal data for advertising; complying with the provisions in Clauses 1, 2, 3, 4 of this Article and the provisions of the law on advertising.
8. Organizations and individuals when using personal data for behavioral advertising or with specific targeting or personalized advertising must comply with the provisions of this Article and the following regulations:
a) Personal data may only be collected through monitoring websites, electronic portals, or applications with the consent of the personal data subject;
b) Must establish a method that allows the personal data subject to refuse to share data; determine the storage time; delete or destroy data when it is no longer necessary.
Article 29. Protection of personal data for social networking platforms, online media services
Organizations and individuals providing social network services and online communication services have the following responsibilities:
1. Clearly notify the content of personal data collected when the data subject installs and uses social networks and online media services; do not collect personal data illegally or beyond the scope agreed with customers;
2. Do not request images or videos containing full or partial identity documents as account verification factors;
3. Provide options allowing users to refuse the collection and sharing of data files (called cookies);
4. Provide a "do not track" option or only track social network and online media service activities with the user's consent;
5. Do not eavesdrop, wiretap, or record calls and read text messages without the consent of the personal data subject, except as otherwise provided by law;
6. Publicly disclose the privacy policy, clearly explain how personal data is collected, used, and shared; provide users with mechanisms to access, edit, delete data, and set privacy settings for personal data, report violations of security and privacy; protect the personal data of Vietnamese citizens when transferring data across borders; establish procedures to handle violations of personal data protection quickly and effectively.
data and set privacy rights for personal data, report violations of security and privacy; protect the personal data of Vietnamese citizens when transferring data across borders; develop a process to handle violations of personal data protection quickly and effectively.
Article 30. Protection of personal data in big data processing, artificial intelligence, blockchain, virtual reality, cloud computing
1. Personal data in big data, artificial intelligence, blockchain, virtual reality, and cloud computing environments must be processed for legitimate purposes and limited to the necessary scope, ensuring the rights and lawful interests of the personal data subject.
2. The processing of personal data in big data environments, artificial intelligence, blockchain, virtual reality, and cloud computing must comply with the provisions of this Law and other relevant legal regulations; it must be consistent with the ethical standards and customs of Vietnam.
3. Systems and services using big data, artificial intelligence, blockchain, virtual reality, and cloud computing must integrate appropriate personal data security measures; they must use suitable authentication and identification methods and access rights management to process personal data.
4. The processing of personal data by artificial intelligence must be classified according to risk levels to implement appropriate personal data protection measures.
5. Do not use or develop big data processing systems, artificial intelligence, blockchain, virtual reality, or cloud computing using personal data to cause harm to national defense, national security, public order, social safety, or infringe upon the life, health, honor, dignity, or property of others.
6. The Government shall regulate the details of this Article.
Article 31. Protection of personal data regarding personal location data and biometric data
1. Personal location data is data determined through positioning technology to know the location and help identify a specific person.
2. Biometric data is data about the physical attributes and unique, stable biological characteristics of a person to identify that person.
3. The protection of personal data regarding personal location data is regulated as follows:
a) The use of location tracking via radio frequency identification (RFID) and other technologies shall not be applied, except in cases where the personal data subject gives consent, or in cases required by competent authorities as prescribed by law, or in cases where the law provides otherwise;
b) Organizations and individuals providing mobile application platforms must notify users about the use of personal location data; take measures to prevent the collection of personal location data by unrelated organizations or individuals; provide users with options for personal location tracking.
4. The protection of biometric data is prescribed as follows:
a) Agencies, organizations, and individuals that collect and process biometric data must have physical security measures for the storage and transmission devices of their biometric data; restrict access to biometric data; have a monitoring system to prevent and detect violations of biometric data; comply with the provisions of the law and relevant international standards;
b) In case the processing of biometric data causes damage to the personal data subject, the organization or individual collecting and processing the biometric data must notify that personal data subject in accordance with Government regulations.
Article 32. Protection of personal data obtained from recording, filming activities in public places, public activities
1. Agencies, organizations, and individuals are allowed to record audio, video, and process personal data obtained from recording activities in public places or public activities without the consent of the personal data subject in the following cases:
a) To carry out the mission of national defense, protect national security, ensure social order and safety, and protect the legitimate rights and interests of agencies, organizations, and individuals;
b) Sounds, images, and other identifying information obtained from public activities including conferences, seminars, sports competitions, artistic performances, and other public activities without harming the honor, dignity, or reputation of the personal data subject;
c) Other cases as prescribed by law.
2. In the case of audio or video recording as prescribed in Clause 1 of this Article, agencies, organizations, and individuals are responsible for notifying or using other forms of information so that the personal data subject knows that they are being recorded, except in cases where the law provides otherwise.
3. Personal data obtained may only be processed and used in accordance with the processing purpose and must not be used for unlawful purposes or to infringe upon the rights and legitimate interests of the personal data subject.
4. Personal data obtained from audio and video recording activities in public places, public activities shall only be stored for the period necessary to serve
The purpose of collection, except in cases where the law provides otherwise. When the storage period expires, personal data must be deleted or destroyed in accordance with the provisions of this Law.
5. Agencies, organizations, and individuals that carry out audio recording, video recording, and process personal data obtained from audio and video recordings in the cases prescribed in Clause 1 of this Article are responsible for protecting personal data in accordance with this Law and other relevant provisions of the law.
Chapter III. FORCES AND CONDITIONS TO ENSURE PERSONAL DATA PROTECTION
Article 33. Personal Data Protection Force
1. The personal data protection force includes:
a) The specialized agency for personal data protection under the Ministry of Public Security;
b) Departments and personnel responsible for personal data protection within agencies and organizations;
c) Organizations and individuals providing personal data protection services;
d) Organizations and individuals mobilized to participate in personal data protection.
2. Agencies and organizations are responsible for appointing departments and personnel with sufficient capacity to protect personal data or hiring organizations and individuals to provide personal data protection services.
3. The Government stipulates the conditions and duties of departments and personnel protecting personal data within agencies and organizations; organizations and individuals providing personal data protection services; personal data processing services.
Article 34. Standards and technical regulations on personal data protection
1. Standards on personal data protection include standards for information systems, hardware, software, management, operation, processing, and protection of personal data that are publicly announced and recognized for application in Vietnam.
2. Technical standards on personal data protection include technical standards for information systems, hardware, software, management, operation, processing, and protection of personal data that are developed, promulgated, and applied in Vietnam.
3. The promulgation of standards and technical regulations on personal data protection is carried out in accordance with the provisions of the law on standards and technical regulations.
Article 35. Inspection of personal data protection activities
The inspection of personal data protection activities is conducted in accordance with the provisions of this Law and the regulations of the Government.
Chapter IV. RESPONSIBILITIES OF AGENCIES, ORGANIZATIONS, AND INDIVIDUALS
REGARDING PERSONAL DATA PROTECTION
Article 36. State management responsibilities for personal data protection
1. The Government uniformly implements state management of personal data protection.
2. The Ministry of Public Security is the primary agency responsible to the Government for implementing state management of personal data protection, except for content under the management scope of the Ministry of National Defense.
3. The Ministry of National Defense is responsible to the Government for implementing state management of personal data protection within its management scope.
4. Ministries, ministerial-level agencies, and agencies under the Government implement state management of personal data protection for sectors and fields within their management scope in accordance with the law and their assigned functions and tasks.
5. Provincial-level People's Committees implement state management of personal data protection in accordance with the law and their assigned functions and tasks.
Article 37. Responsibilities of personal data controllers, personal data processors, and personal data controllers and processors
1. Responsibilities of personal data controllers are as follows:
a) Clearly state the responsibilities, rights, and obligations that must be complied with by the parties in agreements or contracts related to personal data processing in accordance with the provisions of this Law and other relevant legal regulations;
b) Decide the purposes and means of personal data processing in documents and agreements with the data subjects, ensuring compliance with the principles and content stipulated in this Law;
c) Implement appropriate management and technical measures to protect personal data in accordance with legal regulations, and review and update these measures when necessary;
d) Notify violations of personal data protection regulations as prescribed in Article 23 of this Law;
e) Select appropriate personal data processors to process personal data;
f) Ensure the rights of data subjects in accordance with the provisions of Article 4 of this Law;
g) Be responsible to the personal data subjects for damages caused by the process of personal data processing;
h) Prevent unauthorized collection of personal data from their systems, equipment, and services;
i) Cooperate with the Ministry of Public Security and competent state agencies in personal data protection, providing information to serve investigations and handling of violations of the law on personal data protection;
k) Perform other responsibilities as prescribed by this Law and other relevant legal provisions.
2. The responsibilities of the personal data processor are as follows:
a) May only receive personal data after having an agreement or contract on personal data processing with the personal data controller, or the data controller and processor;
b) Process personal data in accordance with the agreement or contract signed with the personal data controller, or the data controller and processor;
c) Fully implement measures to protect personal data in accordance with the provisions of this Law and other relevant legal regulations;
d) Be responsible before the personal data controller, the personal data controller and processor for damages caused by the process of personal data processing;
đ) Prevent unauthorized personal data collection activities from your systems, equipment, and services;
e) Cooperate with the Ministry of Public Security and competent state agencies in protecting personal data, providing information for investigating and handling violations of the law on personal data protection;
g) Fulfill other responsibilities as prescribed by this Law and other relevant legal regulations.
3. The party controlling and processing personal data is responsible for fully implementing the provisions in clauses 1 and 2 of this Article.
Chapter V. IMPLEMENTATION PROVISIONS
Chapter V. IMPLEMENTING PROVISIONS
Article 38. Effective Date
1. This Law shall take effect on January 1, 2026.
2. Small enterprises and start-up enterprises have the right to choose whether or not to comply with the provisions of Articles 21, 22 and clause 2 of Article 33 of this Law for a period of 5 years from the effective date of this Law, except for small enterprises and start-up enterprises that operate personal data processing services, directly process sensitive personal data, or process personal data of a large number of personal data subjects.
3. Household businesses and ultra-small enterprises are not required to comply with the provisions of Article 21, Article 22, and Clause 2, Article 33 of this Law, except for household businesses and ultra-small enterprises that provide personal data processing services, directly process sensitive personal data, or process personal data of a large number of personal data subjects.
4. The Government shall provide detailed regulations on clauses 2 and 3 of this Article.
Article 39. Transitional provisions
1. Personal data processing activities that have been carried out with the consent of the personal data subjects or under agreements in accordance with the provisions of Decree No. 13/2023/NĐ-CP dated April 17, 2023, of the Government before the effective date of this Law shall continue to be carried out without the need to obtain consent again or enter into a new agreement.
2. Records of personal data processing impact assessments and records of personal data transfer impact assessments abroad in accordance with the provisions of Decree No. 13/2023/NĐ-CP dated April 17, 2023, of the Government, which were received by the competent authority for personal data protection before the effective date of this Law, shall continue to be used and there is no need to prepare personal data processing impact assessment records or cross-border personal data transfer impact assessment records in accordance with the provisions of this Law; updating the aforementioned records after the effective date of this Law shall be carried out in accordance with the provisions of this Law./.
This Law was passed by the 15th National Assembly of the Socialist Republic of Vietnam, 9th session, on June 26, 2025.
CHAIRMAN OF THE NATIONAL ASSEMBLY
Tran Thanh Man