Vietnam: Law on Personal Data Protection including cross-border data transfer regulation was introduced to National Assembly of Vietnam

On 5 May 2025, the Law on Personal Data Protection was introduced to the National Assembly of Vietnam. The Law delineates the circumstances under which personal data may be transferred abroad, including the sharing of data with recipients situated outside of Vietnam, participation in international conferences, and the fulfillment of legal obligations in foreign jurisdictions. It is obligatory for organisations to prepare and regularly update an Impact Assessment Report for such data transfers. The Personal Data Protection Authority is empowered to block data transfers in instances where they are deemed to contravene Vietnam's national security interests. Moreover, the Law stipulates that both the impact assessment report on personal data processing and the cross-border data transfer report must be updated on a biannual basis or immediately in the event of significant changes, such as corporate mergers or alterations to the data protection organisation. It is the responsibility of the relevant parties to submit updates to the national portal or the Personal Data Protection Authority via the designated channels.