← Global Privacy Laws Research Library
Law No. 91/2025/QH15
Vietnam Personal Data Protection Law No. 91/2025/QH15
Prepared by Shubhank Suman · Last reviewed
In force from 1 January 2026 as stated in supplied law; later implementation not verified
- Legal character
- National statute
- Region
- Asia-Pacific
- Adopted
- 26 June 2025
- Entry into force
- 1 January 2026
What it covers
Data-subject rights and processing principles, consent and exceptions, collection, encryption, correction, deletion/de-identification, disclosure, transfers, impact dossiers, notifications, vulnerable persons and sectoral safeguards. Articles 30-32 specifically address AI/big data, location/biometrics and recording/filming.
Why it matters
A national privacy law with express AI-data provisions, not a general AI framework. Transitional recognition of Decree 13 consents and dossiers does not mean the two instruments are duplicates or that every earlier duty is unchanged.
Refer to it when
Research Vietnamese personal data, AI/big-data processing, location/biometrics, employee/health/financial data, overseas transfers, impact dossiers or breach notifications.
AI, privacy and cybersecurity relevance
- AI: High
- Privacy: Very High
- Cyber: High
AI
HIGH
Express AI/big-data protections in article 30 and location/biometric safeguards in article 31; still a privacy law.
Privacy
VERY HIGH
National rights, processing and sectoral safeguards.
Cybersecurity
HIGH
Security, incident notification and assessment controls.
Applicability
Article 1 domestic and specified foreign processing connections. Article 38 exceptions concern only named provisions and do not remove general rights, consent, security or sectoral duties.
Read first
Articles 1-4 → 7-10 and 19 → 20-23 → relevant sector 24-32 → 38-39.
Provisions / sections covered
Articles 1-10 - Scope, rights and consent
Includes specified foreign processing connections involving Vietnamese citizens and Vietnamese-origin residents; rights, prohibited acts, consent, withdrawal and restriction.
Articles 11-19 - Processing activities
Collection, encryption, correction, deletion/destruction/de-identification, provision, disclosure and transfer; article 19 specifies consent exceptions rather than a universal consent rule.
Articles 20-23 - Transfers, assessments and incidents
Cross-border transfers, processing impact assessment dossiers, updates and notification of qualifying violations. Read triggers and exceptions, not a blanket filing rule for all businesses.
Articles 24-32 - Special and sectoral protection
Children/capacity, employment, health/insurance, finance, advertising and platforms; article 30 AI/big data, article 31 location/biometrics and article 32 recording/filming.
Articles 38-39 - Commencement and transition
Effective 1 January 2026. Small/start-up five-year choice and household/micro exclusions apply only to articles 21, 22 and article 33(2), with processing-service, sensitive-data and large-number carve-outs. Decree 13 consents and received dossiers have specified continuity; later updates follow this law.
Subject-matter tags
- Consent
- Children's data
- Data subject rights
- Erasure and deletion
- Impact assessment
- Data breach
- Cross-border transfers
- Biometrics
- Employment data
- Anonymisation
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.