Vietnam Data Protection Law: Your Rights as a Customer

Vietnam data protection law now sits in one statute, the Law on Personal Data Protection, No. 91/2025/QH15. The National Assembly passed it on 26 June 2025. It has been in force since 1 January 2026. It lets you say yes or no to how a company uses your data. This guide explains the parts that matter when you are a customer.

What the law is and when it started

Before this law, the main rules sat in a government decree. Now there is a full law passed by the National Assembly. A guiding decree, Decree 356/2025/ND-CP, was issued on 31 December 2025. It took effect the same day and replaced the earlier decree, No. 13/2023.

The law covers any company that collects, stores or uses personal data. That includes shops, banks, delivery apps and clinics. The law calls the company a controller. You are the data subject.

Sources: Law on Personal Data Protection No. 91/2025/QH15, passed 26 June 2025; DLA Piper, Data Protection Laws of the World, Vietnam.

Consent comes first

Consent is the main legal basis for using your data. It must be clear, specific and checkable. A company must ask for each purpose. A single pre-ticked box for everything does not meet that standard.

Silence does not count as consent. If you never reply to a message, the company cannot treat that as a yes.

There are exceptions. A company may use data without consent to protect a life, to carry out a contract with you, or to meet a state duty.

Sources: DLA Piper, Data Protection Laws of the World, Vietnam; Tilleke and Gibbins, article on Vietnam's new personal data protection law.

You can withdraw consent

You may withdraw consent at any time. The request should be in writing. An email or an app form can count if it can be verified.

Withdrawal is not backdated. It stops future use. It does not undo what the company did lawfully before you asked. Keep a copy of your request and the date you sent it.

The law also keeps the right to have your data corrected or updated when it is wrong. The summaries we read do not list every right or set a reply deadline for the company. Read the privacy notice you were given. If you want your data deleted, ask in writing and ask the company to confirm what it will do. One clear rule on deletion applies to hiring: a company must delete the details of job applicants it does not hire, unless the applicant agrees to keep them.

Sources: DLA Piper, Data Protection Laws of the World, Vietnam; Tilleke and Gibbins, article on Vietnam's new personal data protection law.

Sensitive data and children get extra care

Some data is sensitive. The law and its decree name health data, biometric and genetic data, religious and political views, sexual life, bank and financial data, and location data. Sensitive data gets stricter treatment than ordinary data.

For children, a parent generally must give consent. If the data touches a child's private life and the child is 7 or older, both the child and a parent must agree.

In practice, be careful with fingerprint or face scans, and with health or bank details. Ask why a company needs them and how long it will keep them.

Sources: DLA Piper, Data Protection Laws of the World, Vietnam; Tilleke and Gibbins, article on Vietnam's new personal data protection law.

Data breaches and penalties

If a leak could harm a person's life, health, honor, dignity or property, the company must report it to the specialized authority within 72 hours of finding it. A company that processes data for another firm must tell that firm without delay.

The law sets maximum fines. Buying or selling personal data can draw a fine of up to 10 times the revenue from the sale, or VND 3 billion, whichever is higher. Sending data out of Vietnam against the rules can cost a company as much as 5 percent of its revenue from the prior year. If VND 3 billion is the larger figure, that amount applies instead. Other breaches are capped at VND 3 billion. Detailed fine rules still needed a separate decree when these summaries were written.

Sources: DLA Piper, Data Protection Laws of the World, Vietnam.

What to do as a customer

• Read what you are agreeing to before you tick a box.
• Say no to extra uses, such as marketing, if you do not want them.
• Send withdrawal or correction requests in writing and keep a copy.
• Report a suspected leak to the company first, then ask what it told the authority.
• This is general information only. If a company mishandles your data, a Vietnamese lawyer who handles privacy cases can advise on your own situation.

Sources

• Law on Personal Data Protection No. 91/2025/QH15, National Assembly of Vietnam, 26 June 2025.
• DLA Piper, Data Protection Laws of the World, Vietnam: https://www.dlapiperdataprotection.com/index.html?t=law&c=VN
• Tilleke and Gibbins, Vietnam's new personal data protection law: https://www.tilleke.com/insights/vietnams-new-personal-data-protection-law/