Quick answer
Vietnam's Law on Personal Data Protection (Law No. 91/2025/QH15) took effect on 1 January 2026. If your website collects names, phone numbers or emails through a form, you should obtain clear consent for each purpose, publish a privacy policy, collect only what you need and know what to do if data leaks. This article is general information, not legal advice.
Key takeaways
- Law No. 91/2025/QH15 was passed by the National Assembly on 26 June 2025 and took effect on 1 January 2026.
- Consent is valid only if it is voluntary and the person knows the type of data, the purpose, who processes it and their rights; silence is not consent.
- Each purpose needs its own consent, and you cannot force people to agree to other purposes.
- When a violation likely to cause harm is detected, the data controller must notify the specialised authority within 72 hours.
- Business households and micro-enterprises are exempt from some duties (such as impact assessment dossiers), except in cases like handling sensitive data or data of many people.
Does a small website with a contact form fall under the Personal Data Protection Law?
It can, because the law applies to organisations and individuals in Vietnam that process personal data. When your website collects a name, phone number, email or a message typed into a form, you are collecting and processing personal data.
Law No. 91/2025/QH15 was passed on 26 June 2025 and took effect on 1 January 2026. Decree 356/2025/ND-CP provides detailed guidance. The extent of your duties depends on your size and the type of data you handle, but the basic principles apply to small websites too.
- Basic personal data: full name, phone number, email, address.
- Sensitive data needing extra care: health, finance, location, children's information.
- Every contact form, booking form and newsletter sign-up collects personal data.
What makes a customer's consent valid?
Under Article 9, consent is valid only when it is voluntary and the person clearly knows what data will be processed and why, who the controller is, and what their rights and obligations are. Consent must be explicit and specific, and capable of being printed or copied as text, including in electronic form.
The law also sets key principles: consent per purpose, no mandatory bundling of other purposes, and silence or non-response is not consent. That is why pre-ticked boxes or a line such as "by submitting you agree to everything" are best avoided.
- Add an unticked consent checkbox under the form, with a link to your privacy policy.
- Separate consent to be contacted about your enquiry from consent to receive marketing emails.
- State what the data is used for, who processes it and how to withdraw consent.
- Keep a record of when and what the person agreed to, so you can show it if asked.
What should a website have for a basic level of compliance?
For a service-presentation website, a minimum framework is a privacy policy, a consent box on forms, collecting only necessary data and a way to handle requests. The items below are practical suggestions based on the principles of the law, not a complete mandatory list for every case.
| Item | What to do | Main basis |
|---|---|---|
| Privacy policy | A dedicated page stating data collected, purposes, retention, customer rights and contact channel | Articles 3, 4, 9 |
| Consent on forms | Unticked checkbox, separated by purpose | Article 9 |
| Data minimisation | Ask only for fields you really need (often name and phone) | Article 3 |
| Customer rights | An email or form so people can view, correct, delete data or withdraw consent | Article 4 |
| Technical security | HTTPS, limited access to customer data, no customer data in public channels | Articles 3, 12 |
| Incident process | Know who is responsible and notify promptly if data leaks | Article 23 |
What to do if personal data is leaked or lost
Under Article 23, when a violation likely to harm national security or order, or the life, health, honour or property of data subjects is detected, the data controller must notify the specialised personal data protection authority within 72 hours. A data processor that detects a violation must promptly notify the controller.
You should also record the incident, remedy the consequences and cooperate with the authorities. For a small website, the practical step is to decide in advance who receives alerts, who changes passwords, who contacts customers and who documents what happened.
- Keep a list of accounts that can see customer data and use two-factor authentication.
- Do not store customer data in publicly shared spreadsheets.
- Use a website provider with clear backup and access-control practices.
Are business households and small companies exempt from any duties?
Partly, not entirely. Under Article 38, business households and micro-enterprises are not required to comply with Articles 21 and 22 (data processing impact assessment dossiers) or Article 33, clause 2 (appointing a data protection unit or staff). Small enterprises and startups may choose whether to implement these within 5 years of the law taking effect.
The exception: the relief does not apply if you provide personal data processing services, directly process sensitive data or process data of a large number of people. General duties such as consent, security and breach notification still apply. Ask a lawyer or the competent authority to confirm your own case.
Do cookies, Google Analytics and ad pixels need consent?
If you run behavioural or personalised advertising, the law has a specific rule. Under Article 28, clause 8, anyone using personal data for behavioural, targeted or personalised advertising may collect data by monitoring websites, portals and applications only with the data subject's consent, and must provide a way to refuse data sharing.
So if your website uses ad pixels or measurement tools, the careful approach is to show a cookie notice, allow refusal and load tracking tools only after consent. The duty to let users refuse cookies in Article 29 is set for social media platforms and online communication services. More detailed rules may be issued, so check regularly.
