On June 26, 2025, Vietnam’s National Assembly adopted its first unified Personal Data Protection Law (PDPL)—a sweeping legislative move that reshapes how both local and foreign organizations handle data related to Vietnamese citizens.
The law takes effect on January 1, 2026, with a 30-month grace period for implementation—yet the stakes for non-compliance are immediate and significant.
Key compliance requirements include:
1. Stringent consent standards, especially for sensitive data
2. Parental authorization required for processing children’s data
3. Data localization: Core personal data of Vietnamese citizens must be stored on servers located in Vietnam
4. Cross-border data transfers must use government-approved Standard Contractual Clauses (SCCs)
5. Mandatory local data protection officers for foreign entities
Penalties are severe:
1. Up to 5% of annual domestic revenue for violations of cross-border rules
2. 10× revenue from illicit data trading
3. Criminal liability for mishandling sensitive or classified data
With these provisions, the PDPL not only mirrors but, in some areas, exceeds global standards like the GDPR—especially in enforcement power and localization requirements. Any organization processing data from Vietnam must now reassess their risk exposure, compliance architecture, and transfer mechanisms.
Source: https://lnkd.in/gAD6DbTH