Legal News

Personal Data Protection Compliance Obligations for Enterprises in Vietnam

Posted on by VDPC
01
Jun

With the rapid development of the digital economy, personal data (PD) has become one of the most valuable assets for both individuals and businesses. Activities involving the collection, storage, use, and sharing of personal data are now commonplace across nearly every industry, including e-commerce, finance, banking, education, healthcare, and information technology. However, many organizations and individuals still do not fully understand the fundamental legal concepts relating to personal data protection, which may result in regulatory violations and potential legal liabilities.

From a personal data protection compliance perspective, understanding key concepts such as Data Subject, Personal Data, and Personal Data Processing is essential for businesses seeking to establish an effective data governance framework and comply with applicable legal requirements. Before examining the specific obligations and responsibilities imposed on enterprises, it is important to clarify the fundamental concepts prescribed under Vietnam’s personal data protection laws.

Data Subject (PD Subject): is the person to whom the personal data relates1

Personal data: is digital data or information in another form that identifies or helps identify a specific human being, including: First and last name, date of birth, address (permanent residence, temporary residence, contact address), image, Citizen Identity Card, health status, biometrics, etc.2

Processing of personal data: is one or more activities impacting personal data, such as: collection, analysis, synthesis, encryption, decryption, editing, deletion, destruction, de-identification, provision, disclosure, transfer of personal data and other activities impacting personal data.3

No. Enterprise’s responsibilities Scope of implementation Time of implementation Penalties for violations4
1. Develop processes, procedures, and forms to implement the rights of the personal data subject (“PD”)
(Article 5 Decree 356/2025/ND-CP)		 (i) Implementing subjects: PD Controller, PD Controller and Processor

(ii) Implementation contents: Processes and forms are developed clearly, consistent with PD processing activities and responsibilities of relevant departments; ensuring PD subjects know about the procedures for exercising PD subjects’ rights.

 Before processing PD Fine from 140,000,000 VND to 200,000,000 VND
Additional penalty: confiscation of exhibits and means of violation; suspension of PD processing for 1 to 3 months.
Remedial measure: forced return or remittance of illegal profits obtained.
(Clauses 2, 3, 4 Article 58 Draft Decree on sanctioning of administrative violations)
1 Clause 5 Article 2 Personal Data Protection Law
2 Clause 1 Article 2 Personal Data Protection Law; Article 3, Article 4 Decree 356/ND-CP
3 Clause 6 Article 2 Personal Data Protection Law
4 The decree on sanctioning administrative violations in the field of PD protection is not yet in effect, the penalties provided in this section are for reference purposes.
2. Designate a department or personnel to implement PD protection; or
Hire organizations or individuals providing PD protection services
(Clause 2 Article 33 PD Protection Law)		 (i) Implementing subjects: PD Controller, PD Controller and Processor, PD Processor.

(ii) Implementation contents:
(ii.1) In case of designating a department or personnel for PD protection:

  • -The designation of the PD protection department or personnel must be made in writing, showing the assignment, functions, duties, powers, and other requirements for PD protection work.
  • -Personnel designated for PD protection must meet capacity and experience requirements.
  • -The enterprise is responsible for training and fostering knowledge and skills in PD protection for PD protection personnel.
  • -The enterprise and PD protection personnel must sign a confidentiality responsibility agreement.

(Article 13 Decree 356/2025/ND-CP)
(ii.2) In case of hiring organizations or individuals providing PD protection services:

  • -The enterprise must enter into a service contract and a PD processing agreement with the organization or individual providing PD protection services.
  • -Organizations or individuals providing PD protection services must meet qualifications and experience conditions as prescribed.
 Before processing PD Fine from 140,000,000 VND to 180,000,000 VND.
Additional penalty: confiscation of exhibits and means of violation; suspension of PD processing for 1 to 3 months.
Remedial measure: forced deletion or destruction of PD; forced designation of PD protection personnel/hiring of PD protection organizations or individuals; public apology.
(Article 69 Draft Decree on sanctioning of administrative violations)
3. Obtain the consent of the personal data subject
(Article 9 PD Protection Law; Article 5, Article 6 Decree 356/2025/ND-CP)		 (i) Implementing subjects: PD Controller, PD Controller and Processor.

(ii) Implementation contents:

  • -The enterprise must obtain and store the consent of the personal data subject. In case a dispute arises, the enterprise has the obligation to prove the data subject’s consent.
  • -Obtaining the consent of the PD subject must not be established by default consent or creating unclear instructions, causing confusion between consent and non-consent for the PD subject.
  • -Methods of obtaining consent: in writing, recorded call, message, email…
 Before processing PD
(Clause 1 Article 11 PD Protection Law)		 Fine from 100,000,000 VND to 140,000,000 VND; or from 140,000,000 VND to 200,000,000 VND, depending on the case.
Additional penalty: deprivation of the right to use the business license; confiscation of exhibits and means; suspension of PD processing for 1 to 3 months.
Remedial measure: forced deletion or destruction of PD; forced return or remittance of illegal profits obtained; public apology.
(Article 59 Draft Decree on sanctioning of administrative violations)
4. Prepare and submit a dossier on PD processing impact assessment (“DPIA”)
(Article 21, 22 PD Protection Law; Article 19, 20 Decree 356/2025/ND-CP)		 (i) Implementing subjects: PD Controller, PD Controller and Processor, PD Processor.

(ii) Implementation contents:

  • -The enterprise must prepare and store the DPIA dossier;
  • -The enterprise must send 01 original DPIA dossier to the Department of Cybersecurity and High-Tech Crime Prevention (A05).
  • -The enterprise must update the DPIA dossier periodically every 06 months when there is a change, or update immediately when:
    • The enterprise reorganizes, terminates operations, dissolves, goes bankrupt;
    • There is a change in information about the organization or individual providing PD protection services;
    • When arising or changing business lines or services related to PD processing registered in the DPIA dossier.
 Within 60 days from the first day of processing PD Fine from 100,000,000 VND to 140,000,000 VND.
Additional penalty: deprivation of the right to use the business license; confiscation of exhibits and means of violation; suspension of PD processing for 1 to 3 months.
Remedial measure: forced preparation or storage of the DPIA dossier; forced deletion or destruction of PD; forced return or remittance of illegal profits obtained; public apology.
(Article 67 draft Decree on sanctioning of administrative violations).
5. Prepare and submit a dossier on cross-border personal data transfer impact assessment (“TIA”)
(Article 20, Article 22 PD Protection Law; Article 17, 18 Decree 356/2025/ND-CP)		 (i) Implementing subjects: PD Controller, PD Controller and Processor, PD Processor.

(ii) Implementation contents:

  • -The enterprise must prepare and store the TIA dossier;
  • -The enterprise must send 01 original TIA dossier to A05.
  • -The enterprise must update the TIA dossier periodically every 06 months when there is a change, or update immediately when:
    • The enterprise reorganizes, terminates operations, dissolves, goes bankrupt;
    • There is a change in information about the organization or individual providing PD protection services;
    • When arising or changing business lines or services related to PD processing registered in the TIA dossier.
 Within 60 days from the first day of cross-border PD transfer. Fine from 100,000,000 VND to 140,000,000 VND.
In case of transferring PD of 100,000 citizens or more, the fine is doubled; 1,000,000 citizens or more, the fine is 5 times; 5,000,000 citizens, the fine is 3%-5% of the annual revenue.
Additional penalty: deprivation of the right to use the business license; confiscation of exhibits and means of violation; suspension of PD processing for 1 to 3 months; expulsion from Vietnam for foreigners.
Remedial measure: forced preparation or storage of the TIA dossier; forced deletion or destruction of PD; forced return or remittance of illegal profits obtained; public apology.
(Article 67 draft Decree on sanctioning of administrative violations).

This document is provided for reference purposes only and is not advisory opinion for a specific case, enterprises need expert consultation before application.

Contact for Personal Data Protection Compliance Advisory

VDPC DATA PROTECTION

VDPC DATA PROTECTION provides legal and compliance advisory services relating to personal data protection, Data Protection Impact Assessments (DPIA), cross-border data transfers, outsourced Data Protection Officer (DPO) services, and enterprise data governance frameworks.

📍 Hanoi Office: No. 7, Alley 1, Tu Hiep Street, Thanh Tri District, Hanoi, Vietnam

📞 Hotline: +84 98 159 5243

✉️ Email: info@vdpc.vn

🌐 Website: VDPC.vn

The above is a summary and analysis of legal regulations based on the Advisor’s perspective for reference purposes only. This content does not apply to any specific real-world case, and VDPC shall not be held liable for any application by readers based on the aforementioned information without obtaining professional consultation from experts. Readers are kindly requested to contact us for precise advice tailored to your specific case of interest. Sincerely!

DATA PROTECTION:

Quảng cáo
Quảng cáo