The framework
The PDPL keeps Decree 13's consent-first DNA: consent must be explicit, affirmative and purpose-specific, with silence never counting, and sensitive data processing carries extra notice duties. Marketing and advertising uses get called out specifically, requiring consent and honoring refusal. Data subject rights include access, deletion, restriction and objection on short statutory timelines.
Impact assessments are the first thing foreign companies notice. Both a processing impact assessment and a cross-border transfer assessment must be prepared and filed with the Ministry of Public Security's A05 department, a paperwork regime with no true GDPR analogue. The PDPL also sits inside a lattice of adjacent laws (the Data Law for core and important data, the 2025 Cybersecurity Law consolidating cyber rules from 1 July 2026), so classification questions decide which obligations stack.
Key instruments
Law on Personal Data Protection (91/2025/QH15)
Vietnam's first statute-level comprehensive privacy law: consent-centric bases, sensitive data rules, impact assessment filings, marketing restrictions, data subject rights.
Decree 356/2025/ND-CP
Implementing decree for the PDPL, replacing Decree 13/2023; details procedures, dossiers and responsibilities.
Marketing and advertising
Consent is the anchor basis with limited exceptions; marketing use requires consent and data subjects must be able to refuse. Most channel decisions here follow from that consent rule.
Cross-border transfers
Transfer impact assessment dossiers filed with the Ministry of Public Security; the Data Law adds controls for core and important data.
Enforcement and penalties
Administrative penalties with turnover-based elements introduced through the new framework; criminal exposure for data trafficking.