Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

Jurisdiction

Vietnam: data, AI and cyber laws

Part of APAC.

Regulations

Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics
In force
Vietnam AI LawVietnam's first standalone AI law (35 articles). It classifies AI systems as high, medium or low risk based on their impact on life, health, rights and public order, requires human oversight, and requires disclosure when users interact with AI and labeling of AI-generated audio, image and video content. It applies to domestic and foreign actors in AI activities in Vietnam, with transition periods for existing systems.Next: Mar 1, 2027 Transition ends for existing AI systems (general) · in 4 months
In force
Vietnam Cybersecurity Law 2025A single cybersecurity law that replaces both the Law on Network Information Security (2015) and the Cybersecurity Law (2018) from 1 July 2026. It covers cybersecurity protection, the security of information systems by classification level, cybersecurity products and services, and the duties of domestic and foreign organisations. Systems and products approved under the old laws have 12 months to meet the new requirements.Next: Jul 1, 2027 Transition ends for existing systems and products · in 8 months
In force
Vietnam Law on DataVietnam's framework law for digital data. It classifies data as core, important or other, with lists of core and important data set by the Prime Minister, and requires cross-border transfer and processing of core and important data to protect national defence, security and the public interest. It also sets up the National Data Center and national database, and governs data products, data services and data exchanges.In effect since Jul 1, 2025
In force
Vietnam PDPLVietnam's first statute on personal data protection, replacing Decree 13/2023. It covers consent, data subject rights, processing and transfer impact assessments filed with the regulator, cross-border transfers, breach reporting, and bans on buying and selling personal data. Decree 356/2025 took effect alongside it and details DPIA/TIA and DPO requirements.In effect since Jan 1, 2026

Upcoming deadlines

Transition endsMar 1, 2027 · in 4 months
Vietnam AI LawTransition ends for existing AI systems (general)Existing AI systems in most sectors must comply (12-month transition).Vietnam
Transition endsJul 1, 2027 · in 8 months
Vietnam Cybersecurity Law 2025Transition ends for existing systems and productsInformation systems classified under the 2015 law, and security products already in use, must meet the new law's conditions within 12 months of its effective date.Vietnam
Transition endsSep 1, 2027 · in 10 months
Vietnam AI LawTransition ends for existing AI systems in health, education and financeExisting AI systems in healthcare, education and finance must comply (18-month transition).Vietnam

Past deadlines

Takes effectJul 1 · 4 months ago
Vietnam Cybersecurity Law 2025Cybersecurity Law 2025 takes effectThe new law takes effect. Law 86/2015/QH13 and Law 24/2018/QH14 cease to have effect.Vietnam
Takes effectMar 1 · 8 months ago
Vietnam AI LawAI Law takes effectRisk classification, transparency and labeling obligations apply to new AI systems.Vietnam
Takes effectJan 1 · 10 months ago
Vietnam PDPLPDPL and Decree 356/2025 take effectPersonal data protection obligations, DPIA/TIA filing and penalty framework apply; Decree 13/2023 replaced.Vietnam
Takes effectJul 1, 2025 · 16 months ago
Vietnam Law on DataLaw on Data takes effectThe Law on Data enters into force.Vietnam