Vietnam’s National Assembly Passes Landmark Personal Data Protection Law

Written by Jeremy Werner

Jeremy is an experienced journalist, skilled communicator, and constant learner with a passion for storytelling and a track record of crafting compelling narratives. He has a diverse background in broadcast journalism, AI, public relations, data science, and social media management.
Posted on 07/08/2025
In News

Vietnam’s National Assembly has passed the country’s first comprehensive Personal Data Protection Law (PDP Law), marking a significant step toward strengthening data rights and aligning with global privacy standards.

 

Approved with 90.59% of lawmakers in favor, the law will come into force on January 1, 2026. It builds on the foundations of Decree No. 13/2023/ND-CP, expanding Vietnam’s legal framework for regulating the collection, storage, use, and transfer of personal data across both domestic and cross-border contexts.

 

According to VOVWORLD, the new law outlines strict compliance requirements and introduces substantial penalties for violations. These include fines of up to VND 3 billion (approx. $118,000) for general breaches, up to 5% of a company’s annual revenue for unlawful cross-border transfers, and penalties of up to 10 times the revenue gained from trading personal data without consent.

 

“This is a law that reflects the public’s input and global legal trends, while fitting within Vietnam’s constitutional framework,” said Le Tan Toi, Chair of the National Assembly’s Committee for National Defence, Security, and Foreign Affairs.

 

The legislation applies to a broad range of sectors—such as healthcare, finance, e-commerce, insurance, advertising, social media, artificial intelligence, blockchain, and cloud computing—and introduces heightened safeguards for sensitive data, including biometric and location information.

 

Startups and small businesses will benefit from exemptions during a five-year transition period, allowing them to delay appointing Data Protection Officers and conducting Data Protection Impact Assessments. Microenterprises and household businesses are fully exempt from these obligations.

 

The PDP Law introduces a unified definition for cross-border personal data transfers and aligns Vietnam with international privacy norms, potentially enhancing the country’s attractiveness to foreign investors concerned about data security.

 

Need Help?

 

If you’re wondering how Vietnam’s AI policy, or any other government’s policy, bill or regulations could impact you, don’t hesitate to reach out to BABL AI. Their Audit Experts are ready to provide valuable assistance while answering your questions and concerns.

 

Subscribe to our Newsletter

Keep up with the latest on BABL AI, AI Auditing and
AI Governance News by subscribing to our news letter