Law note · Vietnam

Law on Personal Data Protection, enforcement and data subject rights

cite Law No. 91/2025/QH15, enforcement and data subject rights provisions stage RECENT in force 8 months effective 2026-01-01 kind Enforcement supervision binds private bodies reviewed 2026-08-29

What it requires

An app processing the personal data of an individual in Vietnam must be prepared to answer to the agency in charge of personal data protection, facing a fine of up to 5 percent of prior-year revenue for a cross-border transfer violation, and an individual harmed by the app's processing may file a complaint, initiate a lawsuit, and request compensation for damage.

When LexLint raises it

crawls_web
trains_models
generates_content
deploys_chatbot
automated_outreach
high_risk_decisions
processes_voice
processes_biometrics

Private right of action: Yes

What we found

The Law names an agency in charge of personal data protection as the enforcement authority, without independently confirming the specific body's name this pass, though the Ministry of Public Security's role publicizing the Law's commencement suggests it sits under that ministry.

Administrative fines confirmed directly reach up to 5 percent of the prior year's organizational revenue for cross-border transfer violations specifically, with a separate, lower general fine tier referenced elsewhere in the same penalties article and not read in full.

A data-subject-rights clause confirms individuals may request the provision and deletion of their personal data, restriction of processing, and may object to processing, and separately may file complaints and denunciations, initiate lawsuits, and request compensation for damage in accordance with law, arming a private plaintiff.

Primary source

Government Portal (chinhphu.vn) citation
substantive text read via a private secondary translation (LuatVietnam)

← Back to the example · Lint your app →