What are the key data privacy laws and regulations?
Last review date: 16 January 2026
- Civil Code No. 91/2015/QH13, adopted by the National Assembly on 24 November 2015 ("Civil Code")
- Criminal Code No. 100/2015/QH13, adopted by the National Assembly on 27 November 2015 ("Criminal Code")
- Labor Code No. 45/2019/QH14, adopted by the National Assembly on 20 November 2019 ("Labor Code")
- Law No. 91/2025/QH15, adopted by the National Assembly on 26 June 2025, on Personal Data Protection ("PDPL")
- Law No. 116/2025/QH15, adopted by the National Assembly on 10 December 2025, on Cybersecurity ("2025 Cybersecurity Law")
- Law No. 67/2006/QH11, adopted by the National Assembly on 29 June 2006, on Information Technology ("IT Law")
- Law No. 86/2015/QH13, adopted by the National Assembly on 19 November 2015, on Cyber Information Security ("LOCIS")
- Law No. 10/2016/QH13, adopted by the National Assembly on 24 November 2015, on Children ("Law on Children")
- Law No. 24/2018/QH14, adopted by the National Assembly on 12 June 2018, on Cybersecurity ("LOCS")
- Law No. 19/2023/QH15, adopted by the National Assembly on 20 June 2023, on Protection of Consumers' Rights ("Consumer Protection Law")
- Decree No. 356/2025/ND-CP, dated 31 December 2025, detailing a number of articles and measures to implement the Personal Data Protection Law ("Decree 356")
- Decree No. 52/2013/ND-CP, dated 16 May 2013, on e-commerce, as amended and supplemented by Decree No. 85/2021/ND-CP ("Decree No. 52")
- Decree No. 15/2020/ND-CP, dated 03 February 2020, providing penalties for administrative violations pertaining to postal, telecommunication, information technology, radio frequency areas and e-transactions as amended and supplemented by Decree No. 14/2022/ND-CP ("Decree No. 15")
- Decree No. 91/2020/ND-CP, dated 14 August 2020, on spam messages, spam emails and spam calls ("Decree No. 91")
- Decree No. 147/2024/ND-CP, dated 9 November 2024, on the management, provision, and use of Internet services and online information ("Decree No. 147")
What are the key cybersecurity laws and regulations?
Last review date: 16 January 2026
- Law No. 116/2025/QH15, adopted by the National Assembly on 10 December 2025, on Cybersecurity ("2025 Cybersecurity Law")
- Law No. 24/2018/QH14, adopted by the National Assembly on 12 June 2018, on Cybersecurity ("LOCS")
- Law No. 67/2006/QH11, adopted by the National Assembly on 29 June 2006, on Information Technology ("IT Law")
- Decree No. 53/2022/ND-CP, dated 15 August 2022, detailing the implementation of the Law on Cybersecurity ("Decree No. 53")
- Decree No. 91/2020/ND-CP, dated 14 August 2020, on spam messages, spam emails and spam calls ("Decree No. 91")
What are the key laws and regulations relating to non-personal data?
Last review date: 16 January 2026
- Law No. 116/2025/QH15, adopted by the National Assembly on 10 December 2025, on Cybersecurity ("2025 Cybersecurity Law")
- Law No. 86/2015/QH13, adopted by the National Assembly on 19 November 2015, on Cyber Information Security ("LOCIS")
- Law No. 104/2016/QH13, adopted by the National Assembly on 6 April 2016, on Access to Information ("Information Access Law")
- Law No. 19/2023/QH15, adopted by the National Assembly on 20 June 2023, on Protection of Consumers' Rights ("Consumer Protection Law")
- Law No. 20/2023/QH15, adopted by the National Assembly on 22 June 2023, on E-transactions ("E-transactions Law")
- Law No. 60/2024/QH15, adopted by the National Assembly on 30 November 2024, on Data ("Data Law")
- Decree No. 169/2025/ND-CP, dated 30 June 2025, regulating scientific, technological and innovative activities and data products and services ("Decree 169")
- Decree No. 165/2025/ND-CP, dated 30 June 2025, detailing a number of articles and measures to implement the Data Law ("Decree 165")
- Decision No. 20/2025/QD-TTg, dated 1 July 2025, promulgating the lists of important data and core data ("Decision 20")
- Circular No. 10/2022/TT-BNV, dated 19 December 2022, prescribing document retention periods