Vietnam
Tier 3 Comprehensive law Asia-PacificPrincipal framework: PDP Law 2025 (in force Jan 2026) (2025). Regulator: Ministry of Public Security (A05). The Personal Data Protection Law passed June 2025 and applies from 1 January 2026, replacing Decree 13/2023 and hardening the dossier-filing regime.
At a glance
- Principal law
- PDP Law 2025 (in force Jan 2026)
- Regulator
- Ministry of Public Security (A05)
- Breach notification
- 72 hours to the MPS (A05), carried over from Decree 13
- Maximum penalty
- The 2025 Law allows fines up to 5% of revenue for the gravest violations (e.g. unlawful data trading)
- DPO required
- Data-protection personnel and impact/transfer dossiers filed with the MPS
- Digital consent age
- From age 7, the child’s consent plus a guardian’s
- Extraterritorial reach
- Yes — foreign entities processing Vietnamese residents’ data
Structure
- Structural pattern
- Not assessed
- Sub-jurisdictions
- None — no sub-national axis
- ISO code
- VN
A Pattern 4 jurisdiction has no sub-national layer to model. Devolution elsewhere in the legal system does not imply it here — check each Act rather than reasoning from the country.
Transfers and adequacy
- EU member
- No
- EEA member
- No
Instruments
No instrument profiled yet.
Sources
No source recorded yet. This record cannot rise above Tier 3 until it has one — see depth tiers.
Never independently verified — seeded from the prototype.