Law note · Vietnam
Law on Personal Data Protection, breach notification
cite Law No. 91/2025/QH15, Article 23
stage RECENT in force 8 months
effective 2026-01-01
kind Breach notification
binds private bodies
reviewed 2026-08-29
What it requires
- An app that detects a violation of Vietnam's personal data protection rules likely to cause harm to national defense and security, social order, or an individual's life, health, honor, dignity, or property must notify the agency in charge of personal data protection within 72 hours.
When LexLint raises it
processes_biometricsprocesses_voicecrawls_web
What we found
Article 23 requires the personal data controller, the personal data controlling and processing party, or a third party to notify the agency in charge of personal data protection within 72 hours after detecting a violation likely to cause harm to national defense and security and social order and safety, or to infringe upon the life, health, honor, dignity, or property of the personal data subject.
Where a personal data processor detects a violation, it must promptly notify the controller or the controlling and processing party.
Primary source
Government Portal (chinhphu.vn) citation
substantive text read via a private secondary translation (LuatVietnam)