Law on Personal Data Protection — notification of personal data protection violations

Vietnam's first comprehensive personal data statute took effect January 1, 2026, replacing Decree 13/2023. Controllers, controller-processors, and third parties must notify the specialised personal data protection authority within 72 hours of DETECTING a violation likely to harm national defence or security or public order, or to affect an individual's life, health, honour, dignity, or property. The change from Decree 13 matters operationally: the clock now runs from detection rather than from occurrence, which is the first time Vietnam gave organisations room to confirm an incident before reporting. Where an attack on an information system creates a consumer-information cybersecurity risk, a separate 24-hour deadline applies. Marked 'check': the Law and its implementing decree are very recent, the primary text is Vietnamese-language, and enforcement practice is not yet established.