Vietnam´s New Draft Personal Data Protection Law: Key updates and what businesses need to know

Vietnam’s draft Personal Data Protection Law (PDPL), released for public consultation in March 2025 and expected to reach the National Assembly, marks a significant step towards strengthening Vietnam’s data protection framework.

Key updates under the new draft PDPL are as follows:

Redefinition of Personal Data Categories: Under the new draft, an individual’s image has been removed from the basic personal data category, and bank account details are no longer classified as sensitive personal data. Meanwhile, two new types of sensitive personal data (i) salary and other income sources and (ii) land‐use and land data have been introduced.
Enhanced Encryption Requirements: Encryption is now mandatory for all sensitive personal data during storage, transmission, reception, or sharing. While organizations enjoy flexibility in choosing their encryption solutions, the draft does not specify technical standards or strengthen thresholds, leaving some ambiguity around acceptable measures.
Tighter Controls on Biometric Data: Biometric identifiers now trigger stricter obligations: organizations must deploy physical security controls around storage/transmission devices, implement “strong” encryption for data at rest and in transit, restrict access, and set up early‐detection monitoring.
Grace Period: The draft PDPL offers a one‐year transition window for appointing Personal Data Protection Organizations (PDPOs) and Experts (PDPEs). Small enterprises and startups (not directly operating any data processing businesses) are granted a five-year grace period from their establishment to comply with PDPOs and PDPEs requirements.

Next steps for businesses

Even as the PDPL undergoes revisions, proactive companies should track the legislative progress, review internal policies and documents (privacy notices, consent forms, employment agreements), as well as update existing impact assessments. Early action will safeguard compliance upon enactment and enhance organizational resilience in Vietnam’s evolving data‐protection landscape.

From The Newsletter

Newsflash ASEAN

Contact

Contact Person Picture

Michael Wekezer

Partner

+84 28 7307 2788

Send inquiry

Vietnam´s New Draft Personal Data Protection Law: Key updates and what businesses need to know

​Key updates under the new draft PDPL are as follows:

Next steps for businesses

From The Newsletter

Contact

How We Can Help

Key updates under the new draft PDPL are as follows: