Vietnam Data Compliance in 2026: Why Personal Information and Business Data Need Separate Controls

12 November 2026

Mr. Bao N. LÊ — Chief Executive Officer, PCA Group & Chief Legal Officer – Attorney-at-law, Ms. Trương M. Đ. Thư

Most businesses know where their employee and customer information is stored. Fewer can explain who can access it, why it is transferred overseas, how long it is retained, or which legal framework applies when the same file contains both personal and business information.

In Vietnam’s 2026 data environment, the question is no longer whether a company has a privacy policy. The more important question is whether management can explain how significant information moves through the business and whether the controls reflect its actual use.

Article Outline

I. The Problem: One Policy Does Not Cover Every Data Flow
II. Who Is Concerned?
III. What Changed in 2026: Distinguish the Rule Before Assessing the Risk
IV. The Solution: Map the Information and Its Permitted Use
V. The Impact of Leaving the Gaps Unresolved
How PCA Can Help

I. The Problem: One Policy Does Not Cover Every Data Flow

A company may believe that a privacy policy and a consent checkbox are enough to manage its data obligations. That belief becomes difficult to defend when Human Resources stores employee files, Sales exports customer lists, Accounting shares transaction records, and an overseas service provider receives operational data.

These activities do not all raise the same legal question. Vietnam now has a personal-data protection framework, a broader data-law framework and distinct administrative-sanctions instruments. Treating them as one undifferentiated “data compliance” obligation risks overlooking both practical controls and important legal boundaries.

The immediate reason to revisit the topic is Decree 363/2026/ND-CP, issued on 19 September 2026 and scheduled to take effect on 11 November 2026. It concerns administrative violations in the field of data. It should not, however, be described as a new blanket penalty regime for every personal-information incident.

II. Who Is Concerned?

Businesses handling employee, applicant, customer or other identifiable-person information should review their personal-data obligations.
Businesses creating, holding, sharing or transferring other datasets should separately assess whether and to what extent the broader data-law framework applies to their activities.
A business dataset can contain personal information. The two labels are not mutually exclusive, and a company's internal file name does not determine the law.
Being small does not create a blanket exemption. Specific relief, sensitive-data processing, processing services and the number of people whose data is processed require checking.

III. What Changed in 2026: Distinguish the Rule Before Assessing the Risk

The Law on Data, 60/2024/QH15, and the Law on Personal Data Protection, 91/2025/QH15, provide distinct but interacting frameworks. Decree 356/2025/ND-CP implements the personal-data law and took effect on 1 January 2026, replacing Decree 13/2023.

The distinction matters. Information may concern an identifiable individual, an organisation, a business process or a dataset containing several categories. Before applying a rule, the company needs to know what data it holds, why it processes the information, its role in that processing and which legal framework governs the specific action. Where the same information falls within both frameworks, the applicable obligations should be determined in accordance with the relevant statutory coordination provisions, including those addressing overlapping assessment requirements.

The sanctions instruments also differ. Decree 330/2026/ND-CP, effective from 19 August 2026, addresses administrative violations in cybersecurity and personal-data protection. Decree 363/2026/ND-CP, effective from 11 November 2026, addresses sanctions in the broader data field. Its scope expressly separates conduct governed by the relevant cybersecurity and personal-data protection sanctions framework.

That is why combining every headline fine into a single table would be misleading. The legal characterisation of conduct comes before the assessment of a potential sanction. Actual consequences depend on the violated provision, responsible person or organisation, any applicable exceptions and the facts established by the competent authority.

An old article about Decree 13/2023 may still explain the history of Vietnam's privacy regulation, but it cannot substitute for a current review of the 2026 framework. Management should ask whether its internal procedures were updated along with the law.

IV. The Solution: Map the Information and Its Permitted Use

A useful compliance exercise starts with a data flow, not a policy template.

Take a hypothetical growing company. Recruitment receives applicants' CVs and identification documents. HR keeps contracts, salary details and dependent information. Sales maintains contacts and order histories. Accounting holds invoices and payment records. IT operates access controls and backups. Some systems may be hosted or supported outside Vietnam.

At first glance, each team handles “its own” information. In reality, the same person or transaction may appear in several systems, each with different purposes, retention needs and access rights.

For every significant dataset, management should be able to identify its owner, source, purpose, legal basis where required, users, storage location, service providers, sharing recipients, retention approach and deletion or archival process. The degree of detail should reflect the activity and risk, rather than pretending that all records require identical controls.

This map can reveal ordinary but consequential gaps: a former employee still has access to a shared drive; a recruitment folder contains obsolete files; a sales export circulates without defined recipients; an external vendor can download information beyond what its service requires.

The solution is not necessarily expensive technology. It may begin with documented authorisation, separation of duties, retention decisions, vendor instructions, controlled transfers and a clear escalation route when an incident occurs.

V. The Impact of Leaving the Gaps Unresolved

Uncontrolled access can expose salary records, customer information or commercially sensitive data. Missing ownership and retention decisions can also slow an incident response or prevent the business from explaining a transfer.

These operational risks exist separately from any established statutory violation. Any potential fine, remedial measure or other legal consequence must be assessed against the applicable provision and the conduct established in the particular case, rather than assumed from a headline penalty.

For management, the practical response is therefore not to apply the same solution to every dataset. It is to understand how material information moves through the business, determine which obligations apply and address priority gaps in a manner proportional to the company’s actual operations and risks.

How PCA Can Help

Where the relevant review, filing or ongoing compliance service forms part of your PCA package or contract, PCA will manage the matter within the agreed scope of services. If the required work falls outside that scope and you would like further assistance, please contact the PCA Team so that we can assess the requirements and discuss the appropriate support.

If you are uncertain whether the relevant rules apply to your business, or whether the required work is covered by your current engagement with PCA, we encourage you to contact us for clarification before implementing any changes.

Legal Basis

Law on Data No. 60/2024/QH15, dated 30 November 2024.
Law on Personal Data Protection No. 91/2025/QH15, dated 26 June 2025, particularly Article 5(4) concerning the coordination of applicable legal frameworks.
Decree No. 165/2025/NĐ-CP, dated 30 June 2025, providing detailed regulations and measures for implementing the Law on Data, particularly Article 16(2), as subsequently amended.
Decree No. 356/2025/NĐ-CP, dated 31 December 2025, providing detailed regulations and measures for implementing the Law on Personal Data Protection, particularly Articles 17–20, 41 and 42.
Decree No. 330/2026/NĐ-CP, dated 19 August 2026, on administrative penalties in cybersecurity and personal-data protection.
Decree No. 363/2026/NĐ-CP, dated 19 September 2026 and effective from 11 November 2026, on administrative penalties in the field of data.