Personal Data Protection Law 91/2025 and Decree 356/2025
Luật Bảo vệ dữ liệu cá nhân. Replaced Decree 13. Breach notification within 72 hours to A05.
← All jurisdictions
Jurisdiction record
Vietnam
Việt Nam
The most recently rewritten regime in the market set, and the one with a hard vendor-side prerequisite before anything can be sold.
Orientation only, not legal advice. Every fact carries its own review date.
Market-prerequisite record
Prerequisites recordedA cybersecurity product business licence and an import permit are required, issued by the Ministry of Public Security. Since 19 August 2026 the licensing regime is set by Decree 332/2026 — ten-year licences and per-shipment import permits. Domestic preference under “Make in Vietnam” also shapes go-to-market.
Sourced facts
Instruments and current record
Personal Data Protection Law 91/2025 and Decree 356/2025 Cybersecurity Law 116/2025 Data Law 60/2024 and Decision 20/2025 SBV Circulars 09/2020 and 50/2024
Separately labelled interpretation Bounded product mapping
This path describes content governance; it does not represent certified legal compliance.
Cybersecurity Law 116/2025
In force since 1 July 2026. Implementing Decree 333/2026 took effect 19 August 2026, superseding the Decree 53 regime and retaining data localization.
Data Law 60/2024 and Decision 20/2025
Core-data and important-data lists.
SBV Circulars 09/2020 and 50/2024
Banking information system safety and security.
Product mapping
Detector-pack direction
Số định danh cá nhân — 12 digits. Province code, a century-and-gender digit, birth year, then the individual sequence. CCCD and căn cước context labels are carried by the pack.
This maps deterministic detector content; it is not a claim of complete legal compliance.
Run browser demonstrationInterpretation
Classification mapping
Decision 20/2025 core-data and important-data lists are used directly as a detection taxonomy — a regulator-published data classification we can detect against rather than invent.
Customers should confirm applied policy with qualified counsel and security owners.
Watch items
Not treated as current fact
- Guiding circulars under Decrees 332/2026 and 333/2026
- Reported further data bill heading to an October 2026 vote
Validate the mapping in evaluation
Confirm current primary sources, applicability, and product maturity before selecting test cases.