On 1 January 2026, the Vietnam Personal Data Protection Law took effect, and it quietly changed the rules for every website that collects customer information. If your site has a contact form, a booking form, a checkout, or even Google Analytics, you are now processing personal data under a national law with real penalties. This guide explains, in plain terms, what the law expects and the practical steps to make your website compliant.
The short answer: you need valid consent before you collect or track, a clear privacy notice on every form, a cookie banner that holds trackers back until people agree, and a record you can show if anyone asks. Small businesses get a five year grace period on some duties, but not on the basics.
What changed on 1 January 2026
The law is formally Law No. 91/2025/QH15, passed on 26 June 2025 and effective from 1 January 2026, according to Rouse and Acclime. It replaces Decree 13/2023, the earlier rule many businesses never fully followed, and raises the bar considerably.
A guiding decree, Decree 356/2025, was issued at the very end of 2025 to spell out how consent must be recorded, how impact assessments are filed, and who can serve as a data protection officer, per bewiseapps. A separate penalties decree sets the fines. The headline is simple: personal data is now treated as something you hold in trust, not something you own.
Personal data here is broad. It covers names, phone numbers, email addresses, home addresses, and payment details. It also treats behaviour tracking and usage data from online services, biometric data, and copies of identity documents as sensitive data that needs extra care.
Why this is a website issue, not just a legal one
Most owners file this under legal and move on. That is a mistake, because the law lands squarely on the website. Your site is usually the single biggest collector of personal data in the business, and it does so automatically, every hour, without anyone watching.
Think about what a typical SME site already does. A contact form captures a name and a phone number. A booking form captures an appointment time and sometimes health or financial context. A checkout captures an address and payment details. Analytics and advertising tags quietly track behaviour from the first second a visitor lands. Every one of those is now a regulated activity.
That is why compliance is not something your lawyer can finish alone. It has to be built into the site itself: the forms, the cookie layer, the privacy notice, and the back end that stores it all. This is where a web partner matters as much as a legal one.
Six things your website must get right
Here is what the law expects in practice, translated into website terms.
1. Consent that actually counts. Consent must be explicit, specific to each purpose, and freely given. Boxes ticked by default do not count, and silence is not consent, as both bewiseapps and Acclime stress. If you collect an email for a booking and also want to send marketing, that is two separate purposes and needs two separate agreements.
2. A cookie layer that waits for a yes. Cookies and tags that track behaviour, such as analytics and advertising, should load only after the visitor agrees, while cookies strictly needed to run the site can be exempt, per CookieHub. A banner that sets trackers before anyone clicks is the common failure.
3. A clear privacy notice on every form. Before someone submits, they should be told what you collect, why, how long you keep it, and whether it goes to any third party or abroad.
4. Proof you can reproduce. Decree 356/2025 requires that consent be recorded so its timing and content can be verified later. A tick with no log is not enough.
5. A way for people to use their rights. People can ask to see, correct, or delete their data and to withdraw consent, and the rules set response deadlines measured in days. Your site and inbox need a path for that.
6. A breach plan. A reportable data breach must be notified to the Ministry of Public Security cybersecurity authority within 72 hours of discovery, so you need to know who acts and how, before anything goes wrong.
Your website compliance checklist
Use this as a fast self audit. If any row is red in your head, that is your starting point.
| Website element | What the law expects | Quick fix |
|---|---|---|
| Contact and booking forms | Purpose stated, consent not assumed | Add a short notice and an unticked consent line |
| Newsletter and marketing | Separate, explicit opt in | Split marketing consent from the main form |
| Cookies and analytics | Prior consent for tracking | Install a consent tool that blocks tags until agreement |
| Privacy policy | Clear, current, easy to find | Rewrite to match what you actually collect in 2026 |
| Customer database | Access, correction, deletion possible | Document where data lives and who can act on a request |
| Breach response | 72 hour notification ready | Write a one page response plan and assign an owner |
Webie’s take, from Duy Tran
In my work rebuilding and maintaining SME sites this year, the pattern is almost always the same. When I take over an older site, two things are usually missing: there is no real consent box anywhere, and the data the forms collect is not stored properly or kept the way it should be. My fix is practical, not a rebuild. I add consent checkboxes in two places, a popup when someone first lands on the site and a line at the end of every form, then I rewrite the privacy policy so it actually matches what the site collects. Through 2026 I have watched a lot of Vietnamese businesses get nervous about this law, and the fear is simple: they do not want to be fined. Closing these gaps early is what settles that worry.
Good news for small businesses: a five year grace period
The law is strict, but it is not blind to size. Startups and small businesses get a five year window, from 1 January 2026 to the end of 2030, in which they can postpone appointing a data protection officer and filing data protection impact assessments, according to Rouse and bewiseapps. Household businesses and micro enterprises are largely exempt from those heavier duties.
Read the limits carefully, though. The relief does not apply if you process sensitive personal data, if you handle data of 100,000 or more people, or if providing data processing is your actual business. And the grace period covers the paperwork duties, not the basics. Consent, notice, and honest handling are expected from day one, whatever your size.
What it costs to ignore the law
The penalties are built to get attention. General violations, such as collecting without proper consent or missing a breach notice, can draw fines up to VND 3 billion for organisations, with individuals facing half, per Rouse and Acclime. Moving data abroad without meeting the rules can reach 5 percent of the prior year revenue. Selling personal data can cost up to ten times the gain.
For an SME, a single fine at these levels is not a line item, it is an existential event. The reputational hit, in a market where trust is already hard to win, can last far longer than the fine itself.
Your first move this month
You do not need to solve everything at once. Start with the three items that carry the most legal weight and the least effort: fix the cookie layer so trackers wait for consent, add a plain notice and an unticked consent line to your main forms, and refresh the privacy policy so it matches what you actually collect. Those three close the most common gaps and show clear good faith.
From there, map where customer data lives and write a short breach plan. If your site runs on WordPress or WooCommerce, most of this is a configuration and content job, not a rebuild. The point is to start now, on the record, rather than wait for a complaint.
At Webie, we build and maintain SME websites with this baked in, from compliant forms to the cookie layer to the privacy content. If you want a second pair of eyes on your site, see our website and digital services or reach us directly. Call +84 969 838 467 or email huyen.dang@webie.com.vn for a free review.
Frequently asked questions
Does the law apply to my small website if I only have a contact form?
Yes. The moment a form collects a name, phone number, or email, you are processing personal data under the law. Size does not exempt you from the basics of consent and notice, even though small businesses get more time on the heavier paperwork.
Do I need a cookie banner in Vietnam now?
If your site uses cookies or tags that track behaviour, such as analytics or advertising, you need consent before they run, which in practice means a proper consent banner. Cookies strictly needed to operate the site can be exempt.
What is the 72 hour rule?
A reportable personal data breach must be notified to the Ministry of Public Security cybersecurity authority within 72 hours of discovery, and in some cases the affected people must be told too. Having a short written plan and a named owner before anything happens is what makes 72 hours workable.
