Página traduzida e verificada automaticamente. Prevalece a versão em inglês. Algumas partes ainda estão em inglês enquanto a tradução é verificada. Ver em inglês · Informar um erro de tradução
Regulamentações › Resto do mundo › Vietnã
PDPL
Lei de Proteção de Dados Pessoais (nº 91/2025/QH15)
QuandoEm vigor desde 1º de janeiro de 2026
Quem fiscalizaMinistério da Segurança Pública, Departamento de Cibersegurança e Prevenção de Crimes de Alta Tecnologia (A05)
A quem se aplicaOrganizações e indivíduos no Vietnã e entidades estrangeiras que tratam diretamente dados pessoais de cidadãos e residentes vietnamitas.
Avisar o reguladorNotificar o órgão especializado (A05) em até 72 horas após detectar uma violação que possa causar gra…
DPO obrigatórioDeve nomear pessoal ou departamento qualificado de proteção de dados, ou contratar um prestador de serviços
RegistroSem registro de controladores
Transferências para o exteriorO dossiê de avaliação de impacto da transferência deve ser apresentado ao MPS em até 60 dias após a primeira transferência, al…
Prazo para solicitaçõesConfirmar o recebimento em até 2 dias úteis
Multa máximaAté 5% da receita do ano anterior por violações transfronteiriças, 10x a receita por comércio ilegal de da…
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Alcance e base legal
Alcance extraterritorial
3
Applies to foreign entities in Vietnam and to foreign entities directly processing data of Vietnamese citizens and residents in Vietnam.Art. 1(2) · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial.
Base legal
3
Consent is the default basis; the Law adds listed exceptions such as contract performance, legal obligations and protecting legitimate rights.Art. 9 (exceptions in later articles) · secondary source · source ↗
Exception article number not confirmed.
Consentimento
3
Consent must be voluntary, informed, per purpose and provable in writing or verifiable form; silence, defaults and pre-ticked boxes are invalid.Art. 9; Decree 356 Art. 6 · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial.
Dados sensíveis
2
Sensitive data list set by Government (now includes banking, credit, location and behavioral data); extra safeguards and notice required.Arts. 2(3), 26, 27, 31 · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial.
Crianças
2
Legal representative acts for children (under 16); child aged 7+ and representative must both consent for private-life data.Art. 24(2)-(3) · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial. Under-16 definition comes from the Law on Children.
Direitos das pessoas
Direitos
2
Be informed, consent and withdraw, access, correction, deletion, restriction, objection, complaint and lawsuit.Arts. 4(1), 10 · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial. Counted 5 core rights (access, correction, deletion, restriction, objection); no portability right confirmed.
Prazo para solicitações
3
Acknowledge within 2 working days; access or correction within 10 days, restriction or objection 15 days, deletion 20 days (longer if processors involved).Decree 356 Art. 5 · secondary source · source ↗
Decree 13 had 72 hours; Decree 356 replaced it on 1 Jan 2026.
Marketing
2
Consent required for behavioral and targeted advertising, with an opt-out mechanism, plus anti-spam rules.Arts. 28-29 · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial.
Governança
DPO obrigatório
2
Must appoint qualified data protection personnel or department, or hire a service provider.Art. 33(1)-(2) · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial. Small businesses/startups have a 5-year grace period; household and micro businesses exempt unless processing sensitive data or many data subjects.
Qualificações do DPO
2
College degree or higher, at least 2 years relevant experience, and training in personal data protection law and skills.Decree 356 Art. 13(2) · secondary source · source ↗
Registro
1
No controller registration; impact assessment dossiers are filed with the Ministry of Public Security instead.Arts. 21-22 · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial. Filing counted under dpia.
DPIA
3
Impact assessment dossier must be filed with the A05 department within 60 days of starting processing and updated every 6 months.Arts. 21-22 · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial. MPS reviews within 15 days (PwC).
Registros
2
Controllers must keep evidence of consent and document processing in the filed impact assessment dossier.Decree 356 Art. 6(2); Art. 21 · secondary source · source ↗
No standalone ROPA article confirmed; scored on dossier documentation.
Retenção
2
Delete when purpose is complete, retention period ends, ordered by authorities, or on request.Art. 14 · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial.
Violações
Avisar o regulador
2
Notify the specialized agency (A05) within 72 hours of detecting a breach likely to cause serious harm.Art. 23(1)-(2) · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial.
Informar as pessoas
1
Notify individuals only for biometric data incidents or financial-sector (bank) sensitive data incidents.Art. 23; Decree 356 Art. 8 · secondary source · source ↗
Narrow sectoral duty; no general individual notice confirmed.
Transferências
Transferências para o exterior
3
Transfer impact assessment dossier must be filed with MPS within 60 days of first transfer, plus a written agreement with the recipient.Art. 20 · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial. Filing rather than prior approval; some HR, hotel, visa and payment data exempt.
Localização de dados
2
Certain domestic and foreign service providers must store specified user data in Vietnam under cybersecurity rules.Cybersecurity Law 2018 Art. 26; Decree 53/2022 · secondary source · source ↗
Outside Law 91; not re-verified this session. Check whether the 2025 Cybersecurity Law changes the rule.
Fiscalização
Multa máxima
3
Up to 5% of prior-year revenue for cross-border violations, 10x revenue for illegal data trading, VND 3 billion for other violations.Art. 8(3)-(6) · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial.
Responsabilidade criminal
2
Violations may be criminally prosecuted depending on severity under the Penal Code.Art. 8(1); Penal Code Art. 288 · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial. Penal Code article not verified this session.
Ação privada
2
Violators must compensate damage; controllers and processors liable for losses caused by their processing.Arts. 8(1), 37 · source ↗
Law text read on Thu Vien Phap Luat (private legal database, Vietnamese text); translation unofficial.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Biblioteca de regulamentações
Todas as leis estaduais de privacidade dos EUA em um só mapa
24 estados têm uma lei abrangente de privacidade na biblioteca, ao lado das leis da UE, do Reino Unido, federais dos EUA e globais: 102 no total, cada uma explicada em linguagem simples com suas fontes. Selecione um estado para ver o que se aplica lá.
- Em vigor
- Entrando em vigor
- Leis setoriais