New data law pushes companies beyond compliance checklists

In a trust-based business environment, readiness for the Personal Data Protection Law is better treated as a governance, resilience, and trust issue than as a legal checklist.

Thales' building

Vietnam’s digital economy is no longer asking only how quickly businesses can digitise. Increasingly, it is asking whether they can digitise with trust. As more services move online, personal data now sits at the centre of customer relationships, payments, employee management and daily operations. Data protection is becoming part of the operating licence for digital business.

The Personal Data Protection Law brings that shift into focus. Among its obligations is a time-sensitive requirement: certain personal data protection violations that are likely to cause harm may need to be notified within 72 hours of detection, depending on the circumstances and regulatory requirements.

The important word is detection. A business cannot report clearly on what it has not detected, and it cannot assess what data was affected if it does not know where that data resides. Many organisations will struggle here not because of weak intent, but because of weak visibility. The law tests what an organisation can demonstrate, not just what it intended.

Compliance is moving from intent to evidence

Vietnam’s Personal Data Protection Law (PDPL), Law No.91/2025/QH15, took effect on January 1, building on the earlier Decree 13 framework and giving Vietnam a clearer legal foundation for personal data protection.

For boards, executives and CISOs, the real shift is not simply that the rulebook has expanded. It is that compliance now needs to move from stated commitment to operational evidence. A privacy policy explains intent. Consent language captures permission. Internal guidelines define responsibilities. All remain important. But the PDPL raises a more practical leadership question: can the organisation prove that personal data is being handled properly in day-to-day operations?

That means knowing where personal data is stored, who can access it, how it is protected, when it is shared, and how quickly the organisation can respond if something goes wrong.

In a trust-based business environment, a personal data incident does more than trigger a regulatory response. It can weaken customer confidence, unsettle partners, increase scrutiny from stakeholders and disrupt business momentum. For organisations handling consumer, employee, financial, health, location or identity data, trust is difficult to rebuild once lost.

This is why PDPL readiness is better treated as a governance, resilience and trust issue than as a legal checklist.

The hardest practical gap is often the simplest to describe: many organisations do not have a complete view of where personal data lives.

Personal data rarely sits in one neat system. In many Vietnamese enterprises, it is spread across on-premises systems, legacy databases, local servers, business applications, branches and business units.

It also sits with third parties: payroll providers, distributors, insurers and service providers. Data already moves constantly across these on-premises environments, between branches, business units and out to third parties. The question is not only where data is stored. It is where it travels.

An organisation cannot protect what it cannot see, delete what it cannot find, or restrict access to data it has never classified. It cannot respond quickly to an incident without knowing what data was affected, and it cannot demonstrate compliance if its data map is incomplete.

Cross-border transfer sharpens the same point. Where data moves outside Vietnam, the PDPL and Decree No.356/2025/ND-CP require organisations to understand and document how and why. That is less a legal form to file than a test of how well an enterprise understands its own data flows, vendors and partners. Weak visibility over data movement is where compliance quietly breaks down.

The implementation bar is rising quickly

Vietnam’s direction of travel was clear well before 2026, especially after Decree 13 introduced its first obligations. But the PDPL, together with Decree No.356/2025/ND-CP, has sharpened expectations. Organisations are now moving from awareness to execution.

For CISOs and executive teams, five questions now matter most: Where is our personal data? Who has access to it? Can we detect misuse or abnormal movement? Can we prove control during an audit or incident? And can we explain cross-border data flows with confidence?

From regulatory readiness to provable trust

Closing that gap is not a paperwork exercise. It calls for the ability to locate personal data wherever it sits, classify what is sensitive, monitor how it is accessed and moved, and protect it consistently.

It also requires controls that ensure the right people reach the right data at the right time, and protection for the applications that collect and expose it.

This is where Thales works with organisations in Vietnam, strengthening the foundations the PDPL now assumes across applications, data and identities.

Globally, Thales supports governments, critical infrastructure operators and regulated enterprises with the same requirement: protecting sensitive data to a standard that can be evidenced.

The goal is not to add another layer of policy. It is to help make data protection something an organisation can operate, monitor and demonstrate.

Vietnam has one of the region’s fastest-growing digital economies, and the PDPL is part of building the trust that growth depends on.

Trust will not be built by paperwork alone. It will be built by organisations that know their data, protect it consistently, and can demonstrate control when it matters most.

The first step is understanding where you stand. Thales partners with organisations across Vietnam to provide the technology, cybersecurity and data protection capabilities needed to assess PDPL readiness, identify compliance gaps, and understand where the disconnect between policy and demonstrable compliance truly exists.

To start that conversation, visit our ‘Addressing the Personal Data Protection Law in Vietnam’ webpage or speak with the Thales team.

Going the extra mile for data protection in Vietnam A Vietnamese enterprise recently held a team meeting in order to share and discuss a new legal instrument, and also recorded the meeting alongside the names and/or photographs of participants, plus their questions. In the course of recording, a notice saying “by attending this meeting, you consent to being recorded” came up on the screen. In this situation, whether this kind of consent has satisfied valid consent, if Decree 13 is applicable, could be raised.

Personal data decree poses compliance challenges Robert Trong Tran, partner, EY Vietnam Cybersecurity Services Co., Ltd.; and Thach Thi-Cam Tran, senior manager, EY Law Vietnam Limited Liability Company, delve into the challenges businesses are facing over enforcement of Decree 13 on personal data protection, and suggest recommendations to cope with compliance challenges.

Rising data security budgets fail to curb insider breaches Organisations worldwide are boosting investment in safeguarding sensitive information, but insider threats remain a costly weak spot.

Digital boom raises stakes for data protection as cyber risks grow Data breaches are becoming increasingly common for businesses in Vietnam, where accelerating digitalisation has often outpaced the ability to safeguard sensitive information.