Skip to content
safelaunch
← All markets

Asia-Pacific · 1 law · 10 requirements

Vietnam: the laws your website or app must follow

If your customers are in Vietnam, these are the privacy, consumer, security, accessibility and AI laws SafeLaunch checks your site against, with what each one requires and where in the law it says so.

How a SafeLaunch audit checks each one
  • CheckedChecked automatically on every scan
  • AI reviewLooked for by the AI analysis, reported only with evidence
  • Your answersDecided from your answers to the audit questions
  • PreparedPrepared for you in the report's compliance pack
  • You confirmA scan can't see this; you need to confirm it

Vietnam Personal Data Protection Law (91/2025)

In force since 1 January 2026, replacing Decree 13/2023.

Who it covers: Anyone processing personal data of Vietnamese citizens or of people in Vietnam, including from abroad.

What it requires of a website or app (10)

  • A privacy notice at collection: purposes, the data collected, who receives it, how long it's kept, people's rights, transfers abroadCheckedLaw 91/2025/QH15 (notice and consent before processing)
  • A lawful basis, often consent, for each use of personal dataAI reviewLaw 91/2025/QH15 (consent of the data subject)
  • Consent before non-essential cookies and trackingCheckedLaw 91/2025/QH15 (consent for tracking that processes personal data)
  • People can access, correct and delete their data, and know how to askCheckedLaw 91/2025/QH15 (rights of the data subject)
  • Reasonable securityCheckedLaw 91/2025/QH15; Decree 356/2025
  • Transfers abroad only with the safeguards the law setsCheckedLaw 91/2025/QH15 (transfer impact assessment filed within 60 days)
  • Breach notification: Ministry of Public Security (A05) within 72 hoursPreparedLaw 91/2025/QH15; Decree 356/2025
  • Extra protection, usually explicit consent, for sensitive data (if if you handle sensitive data)Your answersLaw 91/2025/QH15 (sensitive personal data)
  • A parent's consent for children's data (if if children use the product)Your answersLaw 91/2025/QH15 (children's data: parental consent)
  • File a processing impact assessment, and a transfer impact assessment for data sent abroad, with the Ministry of Public Security within 60 daysPreparedLaw 91/2025/QH15; Decree 356/2025

Sources:DLA Piper: Data protection laws of the world: Vietnam

Check your site against Vietnam's rules

A free scan checks your website or app against these rules in about a minute and shows what applies, with evidence from your pages. The full report gives the exact fix for each finding.

Check my site free

One free fix in your inbox each week

A new copy-paste prompt for Lovable, Cursor or Claude Code every week, with the rule behind it and how to check it worked, plus the Monday briefing on new laws and deadlines. No spam, unsubscribe in one click.

By signing up you agree to get these weekly emails. We send it with Kit, and you can unsubscribe at any time. What we share with Kit is in our privacy notice.

A plain-language summary of what each law requires of a website or app, from the SafeLaunch rulebook, with the provision and official sources. It is not legal advice and not every duty in each law is listed.