Law on Personal Data Protection 2025 is promulgated by the National Assembly on June 26, 2025 and taken effect from January 01, 2026, in which includes but not limited to the following content:
– Law provides a number of regulations on personal data protection during personal data processing, as well as the relevant procedures relating to personal data protection, including Personal Data Processing Impact Assessment, Cross-Border Personal Data Transfer Impact Assessment.
– Law stipulates further personal data protection in certain activities including:
• Protection of personal data of children, persons with lost or limited legal capacity, and persons with cognitive or behavioral difficulties;
• Personal data protection in recruitment, management, and use of employees;
• Personal data protection for health information and in insurance business activities;
• Personal data protection in finance, banking, and credit information activities;
• Personal data protection in advertising services;
• Personal data protection for social media platforms and online communication services;
• Personal data protection in processing of big data, artificial intelligence, blockchain, virtual space, and cloud computing;
• Personal data protection for personal location data and biometric data;
• Protection of personal data collected from audio and video recording activities in public places and public activities.
– Organizations and individuals committing violations against regulations concerning personal data protection shall, depending on the nature, severity, and consequences of such violations, be fined or criminally prosecuted and provide compensation if the violations cause damage as prescribed by regulations. Of which:
• An administrative violation concerning the trading of personal data shall be fined with maximum of 10 times the revenue gained from the violation.
• An administrative violation committed by an organization concerning the cross-border transfer of personal data shall be fined with maximum of 5% of its revenue in the previous year.
• The maximum fine for other administrative violations concerning personal data protection shall be 3 billion VND.