Vietnam's personal data law: five things a data platform must be able to do
Law 91/2025 and Decree 356/2025 put obligations on the data platform itself. Five capabilities to have in place, with the article behind each.
Vietnam’s Law on Personal Data Protection, No. 91/2025/QH15, took effect on 1 January 2026, together with Decree 356/2025/ND-CP, which implements it. Most organisations have updated their privacy notices and consent forms. The part that is easy to miss sits elsewhere: several obligations in the law can only be met if the data platform is built to meet them, and the legal team cannot do that work on its own.
This article walks through five things a warehouse, lakehouse or analytics platform has to be able to do, and the provisions behind each.
1. Know where sensitive personal data sits
Article 4 of Decree 356 lists what counts as sensitive personal data, and the list is broader than many expect. Besides health, biometrics and location, it includes bank card details and account transaction history, customers’ financial, credit, securities and insurance information (point k), and data that tracks how people use telecoms, social media and online services (point l).
For banks, insurers, securities firms and telecoms operators, that means most of the core tables on the analytics platform hold sensitive data. Clause 2 of the same article requires restricted access rights, defined processing procedures and security measures specifically for it.
The first job is therefore classification: tagging every table and column that holds personal and sensitive data. On Databricks this is done with tags in Unity Catalog, so the label travels with the data instead of living in a spreadsheet that goes out of date.
2. Control and monitor every access
Clause 3 of Article 30 of Law 91 requires big data, AI and cloud systems to use appropriate authentication, identification and access control when processing personal data. Article 9 of Decree 356 is more specific for large-scale processing: multi-factor authentication at a minimum, access limited to authorised people, encryption or anonymisation when data is transferred, and continuous monitoring for unusual access. Article 12 requires personal data in the cloud to be encrypted at rest and in transit.
On a data platform these translate into three layers of control:
- Access granted to groups and roles, not scattered across individual users.
- Row filters and column masks, so one table shows different content to people with different rights, instead of a copy of the table for each audience.
- Access logs that are kept and can be queried, to answer who read which table and when.
Unity Catalog provides all three and writes audit logs to system tables, so monitoring becomes a query rather than a manual collection exercise.
3. Answer data subject requests on time
Article 5 of Decree 356 sets specific deadlines. On a deletion request, the organisation must respond within 2 working days and complete the deletion within 20 days, or 30 days where a processor or third party has to delete as well. Requests to view or correct data must be completed within 10 days. Withdrawal of consent or a request to restrict processing must be completed within 15 days.
Twenty days is only realistic if the organisation knows which tables hold a person’s data, and which aggregates, models and reports it has been copied into. That is a lineage question. Without lineage, every deletion request becomes a manual search across hundreds of tables.
One technical detail matters here. Clause 3 of Article 14 of Law 91 requires deletion to be done securely, preventing unauthorised recovery. In Delta format, DELETE removes rows from the current version, but the old data files remain until VACUUM runs after the retention period (7 days by default). A deletion procedure must therefore include cleaning up old files, with the retention period set so the whole procedure still fits inside 20 days.
4. Control transfers out of Vietnam
Point c of clause 1 of Article 20 of Law 91 treats using a platform located outside Vietnam to process personal data collected in Vietnam as a cross-border transfer. If an organisation’s Databricks workspace or cloud warehouse runs in a region outside Vietnam, such as Singapore, day-to-day analytics on that platform already falls into this case.
The consequence is a cross-border transfer impact assessment, which must be sent to the authority within 60 days of the first transfer (clause 2 of Article 20). This is also the breach with the highest fine in the law: up to 5% of the previous year’s revenue (clause 4 of Article 8).
The assessment requires a description of the data flows: what data, from which system, to which region, for what purpose. Article 12 of Decree 356 also requires contracts with cloud providers to state the personal data flows and each party’s role. A platform with a complete catalogue and lineage can answer these questions from the system itself, rather than from the memory of the engineering team.
5. Produce and update the impact assessment
Article 21 of Law 91 requires the data controller to prepare a personal data processing impact assessment and submit it within 60 days of starting processing. Article 22 requires updates every 6 months when things change. The assessment is therefore not a one-off: every new data source, new purpose or new AI model can be a change that needs recording.
Organisations that assemble the assessment by hand run into trouble at the second update. A more durable approach is to let the platform supply most of the content: the tables holding personal data, the groups with access, the data flows and usage logs, all queryable at the moment the assessment is due.
Who is exempt
Under clause 2 of Article 38 of Law 91 and Article 41 of Decree 356, small enterprises and start-ups may choose not to prepare the processing impact assessment for five years. Household businesses and micro-enterprises do not have to prepare it. The exemption does not apply to organisations that sell personal data processing services, process sensitive personal data directly, or have processed data on 100,000 or more individuals.
The exemption also covers only the processing impact assessment. The cross-border transfer obligations in Article 20 have no equivalent exemption. Banks, insurers and telecoms operators, which process sensitive data on millions of customers, are not exempt.
Where Sancire comes in
All five are platform capabilities: classification, access control, lineage, deletion procedures and evidence. Sancire’s Govern stage builds them on Databricks with Unity Catalog, and the Compliance Evidence package links each legal obligation to evidence already in the platform. If you are not sure how far your current platform goes, the 90-minute discovery workshop is the place to start.
Sources: Law on Personal Data Protection No. 91/2025/QH15, Official Gazette No. 971+972 of 24 July 2025, Articles 8, 14, 20, 21, 22, 30 and 38. Decree 356/2025/ND-CP, Articles 4, 5, 9, 12 and 41. Checked on 28 September 2026. Unity Catalog and Delta features: Databricks documentation on Unity Catalog. This article is an introduction and not legal advice for any specific case.