Law on Personal Data Protection

Vietnam elevated its data-protection regime from a government decree to a full statute effective January 1, 2026. The PDPL applies to any agency, organization or individual processing personal data within Vietnamese territory regardless of nationality, and reaches foreign entities with no Vietnamese legal entity that collect data from Vietnamese users through an app, website, or service. Note the shape of that extraterritorial limb: it is anchored substantially on Vietnamese citizens and persons of Vietnamese origin residing in Vietnam rather than on a purely territorial 'people located in Vietnam' targeting test, making it narrower than GDPR Article 3 in some respects and broader in others — the triggers below are the closest honest fit, not a literal transcription. The law carries consent-centric processing rules, impact-assessment filings with the Ministry of Public Security, restrictions and filing duties around cross-border transfers, and turnover-linked penalties for certain violations. Implementing decrees continue to fill in detail; confirm the current decree set before finalizing a compliance program.