Vietnam Personal Data Protection Law: What It Means for Offshore Teams and Sourcing Agents

Vietnam's Personal Data Protection Law took effect on January 1, 2026. It reaches foreign companies that process personal data of people in Vietnam, including staff and agents. If you run an offshore team there, review consent, employee data handling, cross-border transfers and your contracts, because fines can reach 5% of revenue for transfer violations.

Many Western importers now run sourcing agents, QC inspectors or customer support staff from Vietnam, often as contractors or through a local partner. Those teams handle names, phone numbers, supplier contacts and sometimes customer data. A new national data law now governs that information.

This guide is for small business owners and operations managers who hire or manage people in Vietnam. It explains in plain terms what the law covers, which parts matter for an offshore team and what to put in place now. Eastern Plays covers offshore teams, sourcing and shipping for Western firms working in Asia, and data rules are one of the quiet risks in that work. This is general information, not legal advice, and a Vietnamese lawyer should review your own setup.

What the Vietnam Personal Data Protection Law Covers

The Personal Data Protection Law, numbered 91/2025/QH15, became effective on January 1, 2026. Tilleke and Gibbins, a law firm in Vietnam, describes the law in its closer look at the new law. It applies to Vietnamese organizations and individuals, to foreign organizations in Vietnam and to foreign parties directly involved in processing personal data of people in Vietnam.

That last group is the one that matters to you. If your company sits in the United States or Europe but your team in Ho Chi Minh City or Hanoi handles personal data, you may fall within the scope. A foreign business does not escape the law just because it has no local office.

The law replaces the earlier decree on personal data. It keeps the idea that consent is the main basis for processing, and it adds exemptions, such as processing needed to meet a contract or to protect legal rights. Processing that began under the old decree can generally continue without fresh consent.

The U.S. International Trade Administration publishes a country commercial guide on Vietnam's digital economy that helps put these rules in context.

Which Data Does an Offshore Team Actually Handle?

Start by listing what your team touches. Most offshore operations hold more personal data than owners expect. A sourcing agent keeps supplier contact names, factory staff phone numbers and sometimes copies of business licenses. A QC inspector collects inspection photos that may show workers' faces. A support agent sees customer names, addresses and order histories.

Then list the data about the team itself. That includes ID numbers, bank details, performance notes and background check results. The law has specific protections for employment activities, covering recruitment and employee management.

Use this short inventory as a starting point:

Each category can raise a different question. Ask where it is stored, who can see it and whether it leaves Vietnam. Our guide on building a supplier file for CBP disclosures shows how much supplier information importers already collect, and the same files may now carry personal data.

Do You Need Approval to Send Data Out of Vietnam?

Sending personal data out of Vietnam is regulated, and many offshore setups do it daily. A shared cloud drive hosted outside Vietnam counts. A chat app that stores messages abroad can count too. The law defines cross-border transfer broadly.

The key requirement is a transfer impact assessment, a document that explains why the transfer happens, what protections are in place and what risks exist. Tilleke notes that the requirement carries over from the earlier decree, and that dossiers must be updated every six months if anything changes, and immediately after events such as a restructuring. Reports also say a copy goes to the Ministry of Public Security, so ask your counsel about filing timing.

The penalty for getting it wrong is real. The law allows fines for cross-border transfer violations of up to 5% of the violator's prior-year revenue. If there is no prior-year revenue, or the calculated fine is smaller than a fixed floor, a minimum of VND 3 billion applies, which Tilleke puts at roughly USD 114,500.

This does not mean you must stop using global tools. It means you should know where each tool stores data, document the reason for each transfer and keep the paperwork current. A local legal partner can tell you whether your tools need an assessment.

How Should You Handle Employee and Applicant Data?

Treat staff data with the same care as customer data. Collect only what you need, tell people what you collect and why, and keep it only as long as necessary. The law sets rules for recruitment: if you do not hire an applicant, you generally have to delete or destroy their information, unless the parties agree otherwise.

That affects a common practice. Many managers keep a folder of resumes from earlier hiring rounds, just in case. Under the new law, that folder becomes a liability. Set a retention period, such as 30 or 90 days after a decision, and delete resumes on schedule.

Check how you share staff data internally too. A payroll spreadsheet with bank details should not live in a group chat. Use access controls, so only the people who run payroll can open it. For pay timing and budget planning, see our guides on Vietnam minimum wage for 2027 and on 13th month pay and Tet bonuses.

The same caution applies to contractors. If a freelancer inspects factories for you, a written data clause is the cleanest way to set limits.

What to Put in Your Contracts and Tools

Contracts are where compliance becomes practical. Update your agreements with Vietnamese employees, contractors and agencies to cover data. Name who decides how data is used, who handles it on your behalf and what each side must do if there is a breach.

Add these terms to each agreement, with counsel's review:

The National Institute of Standards and Technology (NIST) offers a free Privacy Framework that helps small organizations organize this work, even though it is not Vietnamese law. Its steps for mapping data and managing risk are practical for any offshore team.

At Eastern Plays, our editors recommend an annual review of your data map. Teams change, tools change and a list that was right in January may be wrong by October.

Do Small Businesses Get Any Relief?

Some, but not as much as owners hope. According to Tilleke, small and startup enterprises have a five-year grace period to decide whether to comply with some requirements, and household businesses and micro-enterprises are exempt in some cases. There are carve-outs. The relief does not apply where the business processes personal data as a service, handles sensitive data directly or processes data for a large number of people.

Also note that the relief concerns certain obligations, not the whole law. Your consent duties, security duties and transfer rules may still apply. Do not assume that a five-person team in Da Nang is outside the law.

Implementing rules are still being clarified. The government is expected to issue detailed lists of sensitive and basic personal data, so check for updates with your local counsel. A short call with a Vietnamese lawyer now costs far less than a fine later.

A Starter Plan for Your Vietnam Team

Begin with a data map. List what personal data your Vietnam team handles, where it lives and who can see it. Add the tools you use, such as cloud storage, messaging apps and project software, and note where each stores data.

Next, fix the quick wins. Delete old applicant resumes. Move payroll files into an access-controlled folder. Turn on two-step sign-in for every shared account. Then update contracts with a data clause and ask your local counsel whether a transfer impact assessment is required for your setup.

Finally, assign a person who owns the topic. In a small company, that may be the operations manager. Give them a calendar reminder to review the data map every quarter. Compliance is not a one-time project. It is a habit that costs little when it starts early.