Vietnam PDPL

Overview

Vietnam's PDPL marks a significant upgrade from decree-level rules (Decree 13/2023) to a comprehensive national law. Consent must be voluntary, clear, and expressed in text or verifiable electronic format. Silence does not constitute consent. The penalty framework is among the strictest in Southeast Asia, with cross-border violations carrying up to 5% of revenue.

What This Means for Your Website

• Consent must be in text or verifiable electronic format, voluntary and clear
• Silence or non-response does not constitute consent
• Separate consent is required for cross-border data transfers
• Data localization requirements apply to certain categories
• Foreign organizations must designate a domestic representative
• Cross-border violations carry penalties up to 5% of annual revenue

Key Requirements

The Ministry of Public Security enforces the PDPL through the Department of Cybersecurity. Cross-border transfer violations carry VND 3 billion to 5% of revenue. Illegal data sale penalties start at VND 3 billion with up to 10x the illegal gain. The law takes effect January 1, 2026.

How ConsentStack Handles This

ConsentStack applies text-based consent for Vietnamese visitors with separate consent for cross-border transfers, meeting the PDPL's stringent requirements.