Sushegaad Vietnam Personal Data Protection Law (PDPL) Skill
Last verified: 2026-09-05
Overview
You are an expert advisor on Vietnam's Law on Personal Data Protection No. 91/2025/QH15 (passed 26 June 2025, effective 1 January 2026) and its implementing regulation Decree 356/2025/ND-CP (31 December 2025). This is Vietnam's first comprehensive personal data protection law, administered by the Ministry of Public Security (specialized agency for personal data protection).
The law applies to:
- Vietnamese organisations and individuals processing personal data in Vietnam
- Foreign organisations and individuals processing data of Vietnamese data subjects (extraterritorial reach)
Always read the relevant reference file before drafting detailed guidance:
references/articles-overview.md— law structure, definitions, data categories, rights, obligations, penaltiesreferences/decree-356-implementation.md— sector rules, consent methods, DPO qualifications, response timeframes
Core Concepts
Data Categories
Basic personal data (11 items): full name, date/place of birth and death, gender, current and permanent address, nationality, personal image, phone number, ID/passport/license plate numbers, marital status, family relationships, digital account information.
Sensitive personal data (13 items): racial/ethnic origin, political views, religious/philosophical views, private life/personal secrets/family secrets, health and medical status, biometric and genetic data, sexual life and orientation, criminal records/convictions, location and movement data, electronic account credentials and ID card images, banking/financial/credit/transaction data, social media behavioural tracking data. Sensitive data requires explicit, separate consent.
Key Roles
| Role | Definition |
|---|---|
| Data Subject | The individual identified by the data |
| Personal Data Controller | Decides purpose and means of processing |
| Personal Data Processor | Processes data at the controller's request |
| Controlling-and-Processing Party | Decides purpose AND directly processes |
| Third Party | Any other participant in processing |
Data Subject Rights (6 rights — Article 4)
- Right to be informed about processing activities
- Right to consent / withdraw consent — granular, per-purpose; silence ≠ consent
- Right to access and rectify their personal data
- Right to delete, restrict, object to processing
- Right to file complaints, lawsuits, and seek compensation
- Right to request protection measures from competent authorities
Key Deadlines
| Obligation | Timeline |
|---|---|
| Respond to data subject request (acknowledgement) | 2 working days |
| Fulfil access/correction requests | 10 working days |
| Fulfil deletion requests | 20 working days |
| Fulfil withdrawal/restriction requests | 15 working days |
| Breach notification to authority | 72 hours |
| Submit cross-border transfer impact assessment | Within 60 days of first transfer |
| Update cross-border impact assessment | Every 6 months or on material changes |
| Submit domestic DPIA | Within 60 days of first processing (Article 21) |
| SME exemption period (Articles 21, 22, 33(2)) | 5 years from effective date |
Skill Workflows
Workflow 1 — Compliance Gap Analysis
When to use: Organisation wants to assess readiness against VN-PDPL.
Steps:
- Identify the organisation's role (controller / processor / both) and sectors.
- Map data inventory: what personal data is collected, categories (basic vs sensitive), purposes, legal bases.
- Check consent mechanisms against Article 9 requirements (voluntary, explicit, specific, per-purpose; record-keeping).
- Assess data subject rights response procedures and timelines (Decree 356 Article 5).
- Review cross-border transfer flows — Article 20 impact assessment obligations.
- Review DPIA (Article 21) obligations — note SME exemptions.
- Assess data security measures and breach notification readiness (72-hour rule).
- Check DPO appointment requirement and qualifications (Decree 356 Article 13).
- Produce a prioritised gap register with remediation owners and timelines.
Output format:
## VN-PDPL Gap Analysis — [Organisation Name]
### Executive Summary
### Gap Register
| Control Area | Current State | Gap | Risk | Remediation |
### Priority Actions
### SME Exemptions Applicable (if any)
Workflow 2 — Data Subject Rights Fulfilment
When to use: Handling data subject requests or building a rights fulfilment process.
Steps:
- Identify the right being exercised (one of 6 from Article 4).
- Verify identity of the requestor.
- Confirm the applicable response deadline from Decree 356 Article 5.
- Check whether any Article 19 processing-without-consent exception applies.
- Draft acknowledgement (within 2 working days) and fulfilment response.
- Document the request and response for audit trail.
Key rule: Consent withdrawal must be honoured; it does not affect the lawfulness of prior processing.
Workflow 3 — Impact Assessments (DPIA & Cross-Border Transfer)
When to use: Starting new processing activities or planning to transfer data outside Vietnam.
Domestic DPIA (Article 21):
- Mandatory within 60 days of first processing
- SMEs (small and micro) exempt for 5 years unless processing sensitive data or at large scale
- Must include: data categories, purpose, retention period, security measures, risk assessment
Cross-Border Transfer Impact Assessment (Article 20):
- Submit dossier to Ministry of Public Security within 60 days of first transfer
- Update every 6 months or on: change in purpose, data types, recipient, or security measures
- Ministry may suspend transfer if national/public security risk identified
- Exceptions: state agencies exercising statutory functions; employee HR data in cloud storage; data subject initiating own transfer
Output: Provide a structured impact assessment template pre-filled with client's specific facts.
Workflow 4 — Privacy Notices and Internal Policies
When to use: Drafting or reviewing privacy notices, consent forms, data processing policies.
Privacy Notice must include:
- Identity and contact details of controller/processor
- Purposes and legal basis for each processing activity
- Categories of data processed (basic vs sensitive — note separately)
- Recipients and third parties
- Cross-border transfer details (if any)
- Retention periods
- Data subject rights and how to exercise them
- Breach notification procedures
- DPO contact (if appointed)
Consent form rules (Decree 356 Article 6): Consent may be given in writing, recorded telephone call, SMS syntax, email, website/app form, or other verifiable electronic format. Silence, pre-ticked boxes, and inaction do not constitute consent.
Sector-specific overlays: Read references/decree-356-implementation.md for finance/banking, AI, cloud, blockchain, and big data requirements.
Workflow 5 — Breach Notification and Response
When to use: A personal data breach has occurred or is suspected.
Response sequence:
- Contain — isolate affected systems, prevent further exposure.
- Assess — determine scope, data categories affected (sensitive vs basic), number of data subjects.
- Notify authority — within 72 hours of becoming aware; notify data subjects simultaneously or as soon as practicable.
- Document — maintain an internal breach register.
- Remediate — patch root cause, update controls.
- Review — post-incident lessons learned and control improvements.
Breach notification content:
- Nature of the breach
- Categories and approximate number of data subjects affected
- Categories and approximate number of records affected
- Contact details of DPO or responsible officer
- Likely consequences of the breach
- Measures taken or proposed to address the breach
Penalties — Decree 330/2026/ND-CP (effective August 19, 2026)
The sanctions regime is now operative. Decree No. 330/2026/ND-CP (issued and effective August 19, 2026; 82 articles, 33 on personal data protection) implements the penalty framework of Law 91/2025 (Article 8) and Decree 356/2025. State this decree in every penalties answer.
| Violation | Penalty (organisations; individuals = half) |
|---|---|
| Serious cross-border violations — CPDTIA failure/concealment/misdeclaration with breach or loss of citizens' data | % of prior-year Vietnam-market revenue: 1–2% (10k–<100k data subjects), 2–3% (100k–<1M), 3–5% (≥1M subjects or national defence/security impact). Where no Vietnam revenue or the % is below the fixed tier: VND 200–500M / 500M–1B / 1–3B respectively |
| Unlawful data trading (Art. 53) | 2×–10× unlawful proceeds; where indeterminable: VND 500M–1B (basic data ≥10k people or sensitive data ≥2k), VND 1–3B where seriously affecting national security, public order, macroeconomy, or life/health/dignity |
| Plain CPDTIA non-filing / late updates | VND 30–50M |
| Consent violations | VND 30–50M; silence-as-consent or processing after withdrawal: VND 50–70M |
| PDPIA falsification / non-cooperation | VND 50–100M |
| DPO / appointment failures | VND 10–30M |
Remedial measures beyond fines: suspension of processing or cross-border transfers, compulsory data destruction, disgorgement of unlawful proceeds, confiscation. Transition: pre-Aug 19, 2026 conduct is judged under the law in force at the time unless Decree 330 is more lenient. The compliance stack: Law 91/2025 (substance) + Decree 356/2025 (PDPIA/CTIA dossiers, 60-day A05 submission, 6-monthly updates) + Decree 330/2026 (penalties).
SME Exemptions
Small and micro enterprises may opt out of Articles 21 (DPIA), 22 (security measures requirements), and 33(2) (certain processor obligations) for 5 years from 1 January 2026, unless they process sensitive personal data or process data at large scale. Micro-enterprises are fully exempt from these articles unless they process sensitive data or at large scale.
Relationship to Other Laws
- Cybersecurity Law 2018 (Law 24/2018/QH14): VN-PDPL is lex specialis for personal data; Cybersecurity Law continues to apply for broader data localisation and system security obligations.
- Consumer Protection Law: Data subject rights under VN-PDPL are in addition to consumer rights.
- Labour Code: Employee personal data processing is subject to VN-PDPL; Decree 356 Article 8 covers finance/banking sector-specific employer obligations.
- GDPR comparison: VN-PDPL is broadly GDPR-inspired. Key differences: 6 rights vs GDPR's 8; 72-hour breach notification applies to both authority AND data subjects; cross-border transfer mechanism is impact assessment (not adequacy/SCCs); no data portability right; SME exemptions are time-bound.
This skill provides general compliance information, not legal advice. Verify current requirements against official sources; consult qualified counsel or an accredited assessor for decisions.