Vietnam's Personal Data Protection Law: what it means for cookies

What are Vietnam's data protection rules?

Vietnam first set general data protection rules in Decree 13/2023/ND-CP of 17 April 2023, which applied from 1 July 2023. The National Assembly then passed the Law on Personal Data Protection, No. 91/2025/QH15, on 26 June 2025. It has 39 articles and has been in force since 1 January 2026. Decree 356/2025/ND-CP, issued on 31 December 2025, details the law from the same date and replaces Decree 13. The Ministry of Public Security is responsible for personal data protection, and its specialized agency, the Department of Cybersecurity and High-Tech Crime Prevention (known as A05), receives impact assessment dossiers and breach notifications and carries out inspections.

Processing that a data subject consented to under Decree 13 before 2026 can continue without asking again, and impact assessment dossiers already filed under Decree 13 remain valid.

Who does the law apply to?

The law applies to Vietnamese agencies, organizations and individuals; to foreign agencies, organizations and individuals in Vietnam; and to foreign agencies, organizations and individuals that directly take part in or are related to processing the personal data of Vietnamese citizens and of people of Vietnamese origin living in Vietnam. A foreign website or app that collects data from users in Vietnam should assume it is in scope. Personal data covers information in digital or other form that identifies a specific person or helps identify one when combined with other data.

Small businesses and startups get relief: for five years from 1 January 2026 they may choose not to prepare a processing impact assessment or designate a data protection officer or department. The relief does not apply to those that provide data processing services, process sensitive data directly, or process the data of a large number of people.

Do cookies need consent in Vietnam?

Consent is the default basis. Under the law, processing needs the data subject's consent except in four cases: urgent protection of life, health, dignity or lawful rights; emergencies, national security and crime prevention; the activities of state agencies; and performing an agreement between the data subject and the organization, in accordance with the law. There is no general legitimate interest basis. Cookies that collect personal data for analytics or advertising therefore need consent, while cookies needed to deliver a service the person signed up for may rest on the agreement.

The law also addresses tracking directly.

• Advertising. Businesses providing advertising services may use only personal data transferred to them lawfully by a controller or collected through their own business. Using customers' data for advertising requires their consent, with a way to refuse advertising and to stop it on request. For behavioral, targeted or personalized advertising, personal data may be collected by tracking websites, portals and apps only with the data subject's consent, and there must be a way to refuse sharing, a set retention period and deletion when the data is no longer needed.
• Social networks and online communication services. Providers must give users an option to refuse the collection and sharing of cookies used to record their activity, track behavior, personalize the experience and advertise, and an option of not being tracked, or track them only with consent.
• Location data. Location tracking through RFID and similar technologies needs consent unless the law provides otherwise, and mobile app platforms must tell users about the use of location data.

What must consent look like?

Consent is valid only if the person gives it voluntarily after being told the type of data processed and the purpose, who the controller is, and their own rights and obligations. It must be expressed clearly and specifically, in a form that can be printed or copied in writing, including electronically or in another verifiable format. Consent must be requested for each purpose and may not be made conditional on agreeing to other purposes. Silence or no response is not consent. Decree 356 adds, according to published summaries, that pre-selected options and wording that blurs the difference between agreeing and refusing are not allowed, and that controllers must be able to prove when and to what the person agreed. People can withdraw consent, which does not affect processing done before.

How are transfers abroad regulated?

The law treats three situations as cross-border transfers: moving data stored in Vietnam to storage abroad, a party in Vietnam sending personal data to a party abroad, and using a platform located abroad to process personal data collected in Vietnam. The last case covers most foreign analytics and advertising tools. The transferring party must prepare a cross-border transfer impact assessment dossier and send the original to the specialized agency within 60 days of the first transfer, then keep it updated. Some transfers are exempt, such as those by state authorities. The agency can inspect transfers and order them to stop when data is used in ways that could harm national defense or security.

What are the penalties?

The law sets the maximum administrative fines. For violations of the cross-border transfer rules, an organization can be fined up to 5% of its revenue in the previous year, or VND 3 billion if it had no revenue or that amount would be lower. Buying or selling personal data, which the law prohibits, can be fined up to 10 times the proceeds, or VND 3 billion where there were no proceeds or the amount would be lower. Other violations carry fines of up to VND 3 billion for organizations, and individuals face half the amount for each violation. Serious cases can also lead to criminal liability under other laws.

What should a website serving Vietnam do?

• List the cookies and tags that collect personal data; the cookie scanner gives a first inventory.
• Ask for consent per purpose before analytics and advertising cookies run, with nothing pre-selected, and keep a record of each consent.
• Give a clear way to refuse tracking and to withdraw consent later.
• Prepare the cross-border transfer dossier if your analytics or ad tools process data abroad.

Vietnam is not in Cookiequiet's default list of regulated countries, but geo-targeting is free on every plan, so you can add Vietnam to a custom list. Visitors there then see the opt-in banner with Reject all and categories off by default, and the consent log records when and to what each visitor agreed. The banner's 24 languages do not yet include Vietnamese, and every string is editable per language. Compare with Thailand, China and the GDPR.