vn-pdpl

A VN-PDPL gap analysis maps your data inventory against basic and sensitive data categories, checks consent mechanisms against Article 9, reviews rights response procedures against Decree 356 deadlines, and assesses DPIA, cross-border transfer, and breach notification readiness. The output is a prioritized gap register with remediation owners.

Vietnam PDPL grants 6 data subject rights under Article 4: to be informed, to consent or withdraw consent, to access and rectify, to delete, restrict, or object, to file complaints and seek compensation, and to request protection measures. Unlike GDPR, there is no data portability right.

Cross-border transfers require an impact assessment dossier submitted to the Ministry of Public Security within 60 days of the first transfer, updated every 6 months. Exemptions apply for state agencies, employee HR data in cloud systems, and data subjects transferring their own data.

Controllers must notify the personal data protection authority within 72 hours of becoming aware of a breach, and notify affected data subjects simultaneously or as soon as practicable. The notification must describe the breach nature, affected data subjects and records, likely consequences, and remediation measures.

Small and micro enterprises may opt out of Articles 21 (DPIA), 22 (security measures), and 33(2) for 5 years from 1 January 2026. The exemption does not apply if they process sensitive personal data or process data at large scale.

VN-PDPL is broadly GDPR-inspired but has 6 rights instead of 8, no data portability right, and no legitimate interests legal basis. Cross-border transfers use an impact assessment mechanism rather than adequacy decisions or SCCs, and SME exemptions are time-bound to 5 years.