Vietnam’s Personal Data Protection Law took effect on January 1, 2026. As a result, not only Vietnamese entities but also foreign companies that process information relating to Vietnamese customers or employees must review their data protection obligations.
Even where a company’s headquarters and servers are located in Korea, the Vietnamese Personal Data Protection Law may still apply if the company processes:
- account registration data;
- payment information;
- delivery information;
- employee data; or
- customer data
relating to individuals in Vietnam.
In particular, where a Korean headquarters operates the HR system of a Vietnamese subsidiary, or where Vietnamese customer information is processed through Korean servers, overseas cloud services, CRM systems, or AI solutions, companies should review the relevant roles of each party, cross-border data transfers, outsourcing arrangements, and data protection impact assessment obligations.
Key Takeaways
For Korean companies preparing to comply with Vietnam’s Personal Data Protection Law, the following issues should be reviewed first.
First, even where the company has no legal entity in Vietnam, it may still fall within the scope of the law if it directly participates in or is connected with the processing of personal data relating to Vietnamese individuals.
Second, a personal data processing impact assessment should generally be prepared after data processing begins, and the required documentation should be submitted to the competent data protection authority within 60 days. Where cross-border transfers are involved, a separate cross-border transfer impact assessment may also be required.
Third, agreements among the Korean headquarters, Vietnamese subsidiary, cloud providers, and other outsourcing vendors should clearly address the purpose of processing, categories of data, retention period, sub-processing, deletion, and responsibilities for responding to data breaches.
1. Korean Companies May Also Be Subject to the Law
Vietnam’s Personal Data Protection Law may apply not only to domestic Vietnamese agencies, companies, and individuals, but also to foreign organizations, companies, and individuals that are located in Vietnam or conduct activities in Vietnam.
Foreign entities that directly participate in or are otherwise involved in the processing of personal data relating to Vietnamese nationals may also fall within the law’s scope.
Accordingly, Korean companies should review whether the law applies in situations such as the following:
- providing e-commerce or platform services to Vietnamese consumers;
- storing Vietnamese users’ account, payment, or delivery data on Korean servers;
- managing employee information of a Vietnamese subsidiary from the Korean headquarters;
- operating payroll, performance evaluation, or HR systems for a Vietnamese subsidiary from Korea;
- processing Vietnamese user data through overseas CRM, marketing, or AI solutions; or
- allowing a Vietnamese subsidiary to use cloud or business systems operated by the Korean headquarters.
In these situations, the roles of each company should first be clearly distinguished.
Vietnam’s personal data regime classifies relevant parties into categories such as:
- Personal Data Controller;
- Personal Data Processor;
- Personal Data Controller and Processor; and
- Third Party.
Even companies belonging to the same corporate group do not automatically become a single data-processing entity.
Responsibility may differ depending on:
- who determines the purpose and means of processing; and
- who actually performs the processing.
2. Consent and Data Subject Rights Procedures Must Be Established
Under Vietnam’s Personal Data Protection Law, consent to personal data processing should be obtained in a clear and specific manner.
When obtaining consent, data subjects should be informed of matters such as:
- categories of personal data being processed;
- purposes of processing;
- identity of the controller or controller-processor; and
- rights and obligations of the data subject.
Consent should remain verifiable after it is given, whether in writing or electronic form.
Silence or inaction is generally difficult to treat as valid consent.
For websites and applications, particular caution is required with practices such as:
- pre-selecting marketing consent;
- making advertising consent that is unnecessary for the service a mandatory condition;
- designing accept and reject buttons in a misleading or imbalanced manner; or
- making withdrawal of consent excessively difficult.
Where the validity of consent is disputed, the data controller may be required to demonstrate that valid consent was obtained.
Accordingly, companies should maintain records showing:
- who consented;
- when consent was given;
- which version of the consent language applied; and
- the scope of the consent.
Procedures for exercising data subject rights must also be established.
Data subjects may have rights relating to:
- access to information about processing;
- withdrawal of consent;
- access;
- correction;
- deletion;
- restriction of processing;
- reporting of violations; and
- compensation for damages.
When a request is received, companies should establish internal personnel and procedures to respond within the legally prescribed period.
Merely listing rights in a privacy policy is not sufficient. A practical system should exist for:
- receiving requests;
- reviewing them;
- responding;
- and retaining records.
3. Personal Data Processing Impact Assessment Documentation Must Be Prepared
Vietnam’s Personal Data Protection Law requires personal data controllers, controller-processors, and processors to prepare a Personal Data Processing Impact Assessment.
The relevant assessment documentation should generally be prepared and retained from the time processing begins and submitted to the competent data protection authority within 60 days from the commencement of processing.
The assessment documentation generally includes matters such as:
- information on the controller, controller-processor, processor, and third parties;
- the responsible personal data protection unit and contact details;
- purposes of processing and categories of personal data processed;
- a data flow diagram showing how personal data moves;
- method of obtaining consent and retention/deletion policies;
- administrative and technical safeguards;
- system architecture, anticipated risks, and response measures.
In practice, the most important document is often the data flow map.
Companies should identify how personal data collected from Vietnamese users or employees moves among:
- the Vietnamese entity;
- Korean headquarters;
- overseas cloud providers;
- external service providers; and
- sub-processors.
If an impact assessment is prepared only after the service has already launched, discrepancies may be discovered between:
- actual data flows;
- privacy policies; and
- contractual terms.
For this reason, it is safer to map the actual processing structure before entering Vietnam or launching the relevant service.
The assessment documentation should also be updated when the business model changes.
For example, updates may be required where:
- a new processing purpose is added;
- the controller or processor changes;
- a new third party is introduced; or
- the data flow is materially altered.
4. Cross-Border Transfers and Overseas Cloud Use Must Be Reviewed
Under Vietnam’s Personal Data Protection Law, a cross-border transfer is not limited to situations where personal data files are directly sent abroad.
A cross-border transfer may also arise where personal data collected in Vietnam is processed through:
- Korean servers;
- overseas cloud platforms;
- global CRM systems;
- analytics tools; or
- AI solutions.
Korean companies should review structures such as:
- storing Vietnamese customer data on servers operated by the Korean headquarters;
- allowing the Korean headquarters to access and manage employee data of a Vietnamese subsidiary;
- processing Vietnamese user data through overseas cloud or SaaS platforms;
- synchronizing Vietnamese customer information with overseas marketing or analytics tools; or
- sharing Vietnamese personal data among the Korean headquarters, affiliates, and external vendors.
Where cross-border transfers occur, companies should review whether a Cross-Border Transfer Impact Assessment must be prepared and submitted.
Such documentation may include:
- purpose of the transfer;
- categories of personal data;
- information on the sender and recipient;
- data flow;
- method of obtaining consent;
- retention and deletion policies;
- level of protection at the overseas recipient;
- onward-transfer procedures; and
- measures to mitigate identified risks.
In certain cases, an exception from the filing requirement for the transfer impact assessment may apply.
For example, depending on the specific structure, exceptions may potentially be considered for:
- storing employee personal data in an overseas cloud environment; or
- conducting cross-border HR administration.
However, such exceptions generally relate only to the obligation to submit the transfer impact assessment.
They do not automatically exempt the company from all other obligations relating to:
- lawful processing;
- consent;
- safeguards;
- outsourcing contracts; or
- protection of data subject rights.
5. Outsourcing Agreements and the Data Protection Function Must Be Structured Properly
A personal data processor should process personal data in accordance with an agreement or arrangement entered into with the relevant controller or controller-processor.
Where personal data is transferred or processed among:
- the Korean headquarters;
- Vietnamese subsidiary;
- cloud provider;
- CRM vendor;
- payroll vendor;
- customer service provider; or
- marketing agency,
the roles and responsibilities of the parties should be clearly documented by contract.
An outsourcing or data processing agreement should address matters such as:
- purposes of processing and transfer;
- scope of data subjects and categories of personal data;
- duration of processing, retention, deletion, and destruction;
- roles and responsibilities of controllers and processors;
- technical and administrative safeguards;
- cooperation in responding to data subject requests;
- third-party disclosure and sub-processing;
- onward-transfer conditions;
- breach notification and incident response;
- cooperation with regulatory investigations and inspections; and
- allocation of damages and liability.
Sharing personal data between affiliated companies is not automatically exempt from regulation.
The Korean headquarters and Vietnamese subsidiary are separate legal entities, and the contract structure should reflect:
- the actual data flow; and
- the real role performed by each company.
Companies may also designate:
- an internal department responsible for personal data protection;
- dedicated personnel; or
- external specialists.
The responsible function should perform duties such as:
- establishing privacy policies and procedures;
- responding to data subject requests;
- conducting impact assessments;
- reporting data breaches;
- providing internal training; and
- maintaining compliance documentation.
Certain exemptions may be available to qualifying small companies and startups.
However, companies may be excluded from such exemptions where they:
- commercially provide personal data processing services;
- directly handle sensitive personal data; or
- process personal data at a large scale.
6. Violations May Result in Administrative Fines and Civil Liability
Violations of Vietnam’s Personal Data Protection Law may lead to:
- administrative sanctions;
- criminal liability; and
- civil damages,
depending on the nature of the violation.
The maximum administrative fine applicable to an organization depends on the type of violation.
For example:
- violations involving the trading of personal data may be subject to fines of up to 10 times the benefit obtained from the violation;
- violations of cross-border transfer requirements may result in fines of up to 5% of the preceding year’s revenue; and
- other personal data protection violations may be subject to fines of up to VND 3 billion.
Where an individual commits the same violation, the maximum fine may generally be set at half the amount applicable to an organization.
Cross-border transfer penalties may be calculated by reference to revenue.
Accordingly, companies should review the entire data transfer structure in advance, including:
- the Vietnamese entity;
- Korean headquarters;
- cloud infrastructure; and
- overseas service providers.
Vietnam Data Protection Compliance Should Start with Mapping the Data Flow
Compliance with Vietnam’s Personal Data Protection Law cannot be achieved merely by publishing a privacy policy or obtaining consent forms.
Korean companies should first identify:
- what personal data is collected in relation to Vietnamese customers, employees, and business partners;
- which systems process that data; and
- to which countries the data is transferred.
They should then review, in sequence:
- the respective roles of the Korean headquarters and Vietnamese subsidiary;
- whether a personal data processing impact assessment is required;
- whether a cross-border transfer impact assessment is required;
- outsourcing agreements; and
- the incident response framework.
DECENT Law Firm’s Global Business Practice Team supports companies entering Vietnam with:
- assessments of current personal data processing structures;
- cross-border transfer and impact assessment reviews;
- privacy policy and consent documentation;
- data processing and outsourcing agreements; and
- data breach response advice.
This content is provided for general informational purposes only and does not constitute legal advice for any specific matter.