VIETNAM Trends and Developments Contributed by: Thang Nguyen, Minh Nguyen and Nguyet Le, ACSV Legal
Personal Data Protection: Strengthening Compliance and Sector-Wide Responsibilities Vietnam is poised to enact its first comprehen - sive Personal Data Protection Law, marking a significant evolution from the current regulatory framework under Decree 13. Adopted by the National Assembly in June 2025, the Law on Personal Data Protection (PDPL) is scheduled to take effect in January 2026. This new legislation aims to provide clearer legal guidance for indi - viduals and businesses in managing personal data amid rapid digitalisation. Similar to Decree 13, the PDPL introduces and further strengthens foundational rights for data subjects, such as the rights to know, consent, access, rectify, and delete their personal data. These rights mirror global best practices and place individuals at the centre of data protec - tion efforts. Notably, the PDPL moves beyond general rules and introduces sector-specific obligations for high-risk industries, such as: • marketing and targeted advertising; • artificial intelligence and big data; • cloud services and online platforms; • labour recruitment and workplace surveil - lance; and • finance, insurance and healthcare. Each sector is subject to distinct safeguards, consent conditions, and transparency require - ments. This reflects a more practical and nuanced approach, requiring businesses to align privacy compliance with their operational reali - ties. Although the sanctioning decree in the area of data privacy has not yet been issued, it appears that the adoption of the sanctioning decree will
soon follow the enactment of the PDPL. Notably, the PDPL itself already provides a legal basis for penalties by expressly stating that violations of its provisions shall be subject to administrative, civil or criminal sanctions in accordance with relevant laws. Under the PDPL, administrative fines vary depending on the nature and severity of the breach. Specifically: • for the illegal sale or purchase of personal data, a fine of up to ten times the revenue from the sale, or VND3 billion (approximately USD150,000), whichever is higher; • for cross-border transfer violations, a fine of up to 5% of the violator’s revenue of the pre - ceding year, or VND3 billion (approximately USD150,000), whichever is higher; and • for other violations, a fine of up to VND3 bil - lion (approximately USD150,000). These general penalty thresholds are expected to be further elaborated in the forthcoming sanc - tioning decree. As Vietnam positions itself as a digitally driven nation, the PDPL, together with its upcoming enforcement framework, is set to reshape the business landscape and drive stronger data governance practices across sectors. Amended Law on Enterprises: enhancing transparency and corporate oversight Vietnam has committed to meeting internation - al anti-money laundering standards set by the Financial Action Task Force (FATF). However, in 2023, the FATF placed Vietnam on its “grey list” due to insufficient transparency regarding ben - eficial ownership. In response, the government issued an action plan in early 2024, requiring legal reforms to identify and monitor individuals
926 CHAMBERS.COM
Powered by FlippingBook