Vietnam's New Personal Data Protection Law: A Closer Look

Vietnam officially enacted Law No. 91/2025/QH15 on Personal Data Protection ("PDPL") on June 26, 2025, marking a major milestone in the country's legal landscape. While the PDPL retains many provisions from its predecessor, Decree No. 13/2023/ND-CP on Personal Data Protection ("PDPD"), it adds new concepts, exemptions, and compliance obligations. Notably, it sets out a framework regulation for penalties for violations, including monetary fines of up to 5% of the corporate violator's annual revenue in the previous year for cross-border data transfer breaches.

With an effective date of January 1, 2026, the PDPL will apply to (i) Vietnamese agencies, organizations, and individuals; (ii) foreign agencies, organizations, and individuals in Vietnam; and (iii) foreign agencies, organizations, and individuals directly involved in or related to the processing of personal data of Vietnamese citizens and persons of Vietnamese origin without a determined nationality, currently