Vietnam Personal Data Protection Law 2026: Decree 356 DPO requirements
Vietnam's PDPL (Law 91/2025) and Decree 356/2025 have applied since 1 January 2026.
What you need to know
- Decree 356/2025 replaces Decree 13/2023 from 1 Jan 2026.
- Designate the DPO person or unit in a formal written decision.
- DPO: college degree or higher, 2+ years relevant experience, personal-data-protection training.
- Old Decree 13 consents and filed dossiers stay valid; updates must follow the new law.
- Small enterprises and startups may defer some articles for 5 years (Law Art. 38) - check if you qualify.
First step: list your AI systems and the data they use
Every one of these laws is easier with a written inventory. Our free AI register template gives you one in minutes.
Get the free register
Free edition. Paid plans are optional. Built originally for the EU AI Act; the Southeast Asia mapping is in this guide, not yet inside the app.
Official sources
Checked 13 Oct 2026. General information, not legal advice. Team Unadhi.