Vietnam issues new Decree on Personal Data Protection
Vietnam’s data protection regime has evolved rapidly over the past three years. In 2023, Decree 13/2023/ND‑CP introduced the country’s first comprehensive framework for personal data protection. Building on that foundation, the Government has now issued Decree 356/2025/ND‑CP, effective 1 January 2026, which replaces Decree 13. This marks a significant regulatory shift: Decree 356 expands the definition of sensitive personal data, strengthens consent requirements, and introduces sector‑specific compliance rules for emerging technologies such as AI, blockchain, and cloud computing. Together, these changes reflect Vietnam’s move toward a more robust, globally aligned privacy framework.
What’s New ?
- Expanded scope of sensitive data: now includes financial info, behavioral tracking, and access credentials.
- Stricter consent rules: no default settings; clear opt‑in/opt‑out required.
- Data subject rights: organizations must set up transparent processes and standardized forms.
- Mandatory transfer agreements: detailed obligations for cross‑border and third‑party data sharing.
- Sector‑specific safeguards: banking, finance, AI, blockchain, cloud, and metaverse now face tailored compliance standards.
- DPO requirement for all: every entity processing personal data must appoint a qualified Data Protection Officer.
- Regular impact assessments: DPIAs and CTIAs updated every six months or after major changes.
Why It Matters ?
Decree 356 significantly strengthens Vietnam’s data protection framework, raising the bar for transparency, accountability, and security. Businesses operating in Vietnam must act now to update policies, contracts, and technical measures to stay compliant.
Action Point for Organizations: Review your privacy framework, appoint a DPO, and prepare for stricter consent and transfer rules.
Disclaimer: This newsletter and its content are for informational purposes only and do not constitute legal advice. Readers should seek legal or professional advice before taking or refraining from any action.
