On June 26, 2025, Vietnam’s National Assembly passed Law No. 91/2025/QH15 on Personal Data Protection (“PDPL”), which will take effect on January 1, 2026. The PDPL elevates Vietnam’s data protection framework from decree-level regulation to statutory law, introducing stricter compliance requirements and more severe penalties while building upon the foundation of Decree No. 13/2023/ND-CP (“Decree 13“).

While the PDPL consolidates and strengthens Vietnam’s data protection regime, some of its terms remain unclear or may not be fully practical. In particular, further legislative refinement and scholarly input are required to ensure that the PDPL is not only enforceable in practice but also aligned with business realities.

The law must strike a balance between safeguarding individual privacy rights and facilitating enterprise activities, so that data protection becomes an integrated part of business operations rather than an obstacle to economic growth. In this Legal Insights, we would like to share our observations on certain limitations of the Law, drawn from our practical experience.

Please read more below or View and Download the full PDF file here.