Key Facts
Overview
Vietnam's PDPL marks a significant upgrade from decree-level rules (Decree 13/2023) to a comprehensive national law. Consent must be voluntary, clear, and expressed in text or verifiable electronic format — silence does not constitute consent. The penalty framework is among the strictest in Southeast Asia, with cross-border violations carrying up to 5% of revenue.
What This Means for Your Website
- Consent must be in text or verifiable electronic format — voluntary and clear
- Silence or non-response does not constitute consent
- Separate consent is required for cross-border data transfers
- Data localization requirements apply to certain categories
- Foreign organizations must designate a domestic representative
- Cross-border violations carry penalties up to 5% of annual revenue
Key Requirements
The Ministry of Public Security enforces the PDPL through the Department of Cybersecurity. Cross-border transfer violations carry VND 3 billion to 5% of revenue. Illegal data sale penalties start at VND 3 billion with up to 10x the illegal gain. The law takes effect January 1, 2026.
How ConsentStack Handles This
ConsentStack applies text-based consent for Vietnamese visitors with separate consent for cross-border transfers, meeting the PDPL's stringent requirements.
Penalties
Cross-border violations: VND 3B to 5% of revenue. Illegal data sale: VND 3B minimum, up to 10x illegal gain. Other: up to VND 3B.
Key Requirements
- Consent must be voluntary, clear, and in text or verifiable electronic format
- Silence or non-response does not constitute consent
- Consent withdrawal must be as easy as providing consent
- Separate consent for cross-border data transfers
- Data localization for certain data categories
- Foreign organizations must designate domestic representative
Notable Provisions
- Elevated from decree to comprehensive national law (2025)
- Cross-border violations carry up to 5% of revenue penalties
- Covers AI and blockchain technologies
- Among strictest penalty frameworks in Southeast Asia
Other Asia Pacific Regulations
Frequently Asked Questions
When does Vietnam's PDPL take effect?
January 1, 2026. It supersedes Decree 13/2023 and elevates data protection from a government decree to a comprehensive national law.
What are Vietnam's cross-border transfer penalties?
VND 3 billion to 5% of annual revenue — among the strictest in Southeast Asia.
Does silence count as consent in Vietnam?
No. The PDPL explicitly states that silence or non-response does not constitute consent. Consent must be in text or verifiable electronic format.
Stay compliant with Vietnam PDPL
ConsentStack helps you implement Opt-in consent for Vietnam automatically.