The Law on Personal Data Protection No. 91/2025/QH15 was adopted by the 15th National Assembly at its 9th session on 26 June 2025 and took effect on 1 January 2026. On 30 December 2025, the Government issued Decree No. 356/2025/ND-CP detailing a number of articles and implementation measures of the Law. The Decree took effect on 1 January 2026 and replaces Decree No. 13/2023/ND-CP.
Key provisions
- Consent must relate to specific purposes and be expressed clearly in writing, by voice or by ticking a consent box; pre-ticked consent is not allowed; the data controller or processor must keep and be able to prove consent in case of dispute (Article 5, Decree 356/2025/ND-CP).
- Requests from data subjects must be handled within set time limits; for example, a deletion request must be carried out within 20 days.
- A breach involving sensitive personal data must be notified to the specialized personal data protection agency and to the data subjects within 72 hours of discovery.
What it means for social and resettlement documents
Socio-economic surveys (SES), inventories of losses (IOL) and lists of affected households in resettlement plans (RP/RAP) and ethnic minority development plans (EMDP) hold a great deal of personal data: names, ID numbers, photos of household heads, GPS coordinates of homes, income and health. From 2026, consultants and PMUs should:
- Use consent forms that state the purpose of data use before interviews, photographs and GPS recording.
- Code household lists in publicly disclosed reports, keeping the key linking codes to names in a restricted file.
- Restrict access to survey data on tablets and servers, and encrypt devices.
- Agree in the contract on retention, handover and deletion of data at the end of the assignment, and have experts and enumerators sign confidentiality undertakings.
This article is for information only and is not legal advice for any specific case.