In brief
Vietnam recently passed Law No. 91/2025/QH15 on Personal Data Protection (“PDP Law”) on 26 June 2025. The law advances beyond the existing privacy framework under Decree No. 13/2023/ND-CP on Personal Data Protection (“PDP Decree”) by layering in heightened obligations across various contexts. The PDP Law echoes the EU General Data Protection Regulation's (GDPR) architecture yet embeds unique Vietnamese priorities like national security. Effective from 1 January 2026, the PDP Law demands attention from various stakeholders from a global perspective.
This analysis dissects the PDP Law’s fundamentals such as scope, lawful bases, cross-border transfer rules, breach reporting, drawing parallels and contrasts with the EU GDPR. It highlights operational implications for multinational operations and closes with insights for practitioners.
*****
Manh Hung Tran, Managing Partner, Thu Minh Le, Senior Associate, and Thanh (Alex) Do, IP Executive, have co-authored this legal update.
© 2025 BMVN International LLC. All rights reserved. BMVN International LLC is in strategic alliance with Baker & McKenzie (Vietnam) Ltd., a member firm of Baker & McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a “partner” means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an “office” means an office of any such law firm. This may qualify as “Attorney Advertising” requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.