Legal Alert – Obligations of Vietnam Domiciled Entities When Collecting & Processing Personal Data

On 26 June 2025, the National Assembly passed the Personal Data Protection Law (“PDPL”), which will come into effect on 01 January 2026. This law imposes heightened legal responsibilities on organizations and individuals involved in the collection, processing, and transfer of personal data. It also introduces stricter penalties compared to existing regulations to ensure deterrence and effective enforcement. Accordingly, organizations and individuals who violate the provisions of the PDPL and related laws on personal data protection may face administrative penalties or criminal liability, depending on the nature, extent, and consequences of the violation. If the violation causes damage for other individuals and organizations, the violators must provide compensation in accordance with the law.

Administrative Fines

Notably, under the PDPL, organizations and individuals may be subject to administrative penalties as follows, depending on the nature and extent of the violation[1]:

• For the illegal trading of personal data, the maximum monetary fine shall be up to 10 times the revenue generated from the violation. In cases where the violation does not generate any revenue, or where the fine calculated based on such revenue is less than VND 3 billion, then a maximum fine up to VND 3 billion may be imposed.
• For violations involving the cross-border transfer of personal data, the maximum fine shall be 5% of the violating organization’s total revenue from the most recent financial year. If there is no revenue in the preceding year, or the fine based on such revenue is less than VND 3 billion, then a maximum fine up to VND 3 billion may be imposed.
• For other violations relating to personal data protection, the maximum monetary penalty is set at VND 3 billion.

Please note that the fines mentioned above apply to organizations. The fines imposed on individuals for the same violation shall be a half of the amount applicable to organizations.

Obligations of organizations when collecting and processing personal data

The PDPL inherits and further enhances the provisions currently in effect under Decree No. 13/2023/ND-CP on personal data protection (“Decree 13”), in addition to the obligations and responsibilities already stipulated in Decree 13 and the PDPL, organizations and individuals involved in the collection and processing of personal data are required to take the following actions:

• Clearly notify the data subjects about the collection and processing of their personal data and obtain valid consent from the data subjects prior to collecting or processing their personal data;
• Establish internal policies for personal data protection, including a general Policy for managing and processing personal data, and Decision on appointment of department in charge of personal data processing;
• Conduct a data impact assessment for the personal data processing activities and submit the report within 60 days from the start date of processing the personal data;
• Conduct an assessment of the impact of cross-border data transfer and submit the report within 60 days from the first date of transferring personal data across borders; and
• Enter into agreements and commitments with relevant parties when participating in personal data processing or transfer activities.

Please refer to our legal update on this matter at the attached https://bit.ly/4ljyDOP.

Our Recommendations

Based on DIMAC’s experience in advising and assisting numerous clients over the past period, in order to comply with the legal provisions on personal data protection and mitigate legal risks, businesses involving in the collection and processing of personal data from employees, suppliers, and third parties are recommended to take the following actions:

• Draft and issue internal compliance documentation on personal data protection, including key documents such as: (i) Notice of Personal Data Processing; Personal Data Management and Processing Policy; (ii) Personal Data Processing Agreement; and (iii) Decision on appointment of department in charge of personal data processing;
• Draft and standardize templates for Personal Data Transferring Agreements and Cross-border Personal Data Transferring Agreements in order to sign with relevant parties, if applicable; and
• Draft and submit (i) Personal data processing impact assessment; and (ii) Cross-border Data transferring impact assessment (if any) to the Cyber Security and High-Tech Crime Prevention Department under the Ministry of Public Security.

Should you have any question or require further assistance from DIMAC to carry out the above work, please feel free to contact us.

Best regards

Than Trong Ly (Mr.)
Partner
LL.B, LL.M (UK)
Mob: (+84-0) 909 507 570
E-mail: ly.than@dimac-law.com
DIMAC LAW FIRM
www.dimac-law.com
[1] Article 8 PDPL