Vietnam: Implementing Regulations of Law on Personal Data Protection including cross-border data transfer regulation entered into force

On 1 January 2026, the Implementing Regulations of the Law on Personal Data Protection including cross-border data transfer regulation entered into force. The Implementing Regulations further specify the regulatory requirements established by the framework of the Law on Personal Data Protection. Cross-border transfers of personal data are defined in Article 17 as (a) transfer of personal data collected and stored in Viet Nam to server systems outside of Viet Nam or cloud computing services of foreign providers; (b) transfers of personal data from Viet Nam to organisations or individuals located abroad; or (c) processing activities in which personal data collected in Viet Nam is transferred to a platform outside of Viet Nam for further processing. The data protection agency can order transfers to cease if they threaten national defence or security. The Implementing Regulations also specify a number of exceptions to the requirement to carry out impact assessments for cross-border transfers, including journalistic activities and in emergencies. For processors and controllers who are required to carry out such impact assessments, Article 18 sets out the necessary content of the impact assessment dossier, which must be submitted to the protection agency within 60 days, outlining the transfer's purpose, risks, and safeguards. Article 20 specifies that impact assessment records for data processing and cross-border transfers must be updated every six months for new purposes or changes in certain parties, and within 10 days for significant organisational or operational changes, with submissions made to the protection agency using prescribed forms.