After a decade in SEO, content, and AI-assisted marketing, I have watched Vietnamese teams happily paste customer lists, survey exports, and CRM data into ChatGPT, Claude, and a dozen no-code tools — without realising that, as of 1 January 2026, much of that is now a regulated activity with real fines attached. Vietnam’s Personal Data Protection Law (PDPL) is live. This is the plain-English version of what every marketing team — Vietnamese or foreign — actually needs to do.
Vietnam’s Personal Data Protection Law (PDPL) took effect on 1 January 2026, with Decree 356/2025/NĐ-CP replacing the older Decree 13/2023. For marketers, three things now matter most: (1) you need a lawful basis (usually consent) to use personal data for marketing; (2) sending personal data to foreign AI tools like ChatGPT, Claude, or Gemini counts as a cross-border data transfer that must be documented; and (3) penalties are now severe — up to VND 3 billion for many violations, and up to 5% of prior-year revenue for cross-border breaches. Anonymise data before feeding it to AI, and keep a consent record for every contact.
What actually changed in 2026?
Vietnam already had data-protection rules under Decree 13/2023/NĐ-CP, effective 1 July 2023. The 2026 shift is bigger: personal data protection is now governed by a full Law (passed in 2025, effective 1 January 2026), and Decree 356/2025/NĐ-CP replaces Decree 13 to provide the operational detail. A law sits higher than a decree, carries heavier penalties, and signals that enforcement is no longer theoretical. For a marketing team, the practical message is simple: the data you collect, store, segment, and feed into tools is now a compliance asset, not a free-for-all.
“The teams that get hurt won’t be the ones doing something obviously shady. They’ll be the ones who pasted a full customer export into a foreign AI tool to ‘write better emails’ — and never recorded consent or thought of it as a cross-border transfer.”
The five concepts every marketer must understand
Consent (sự đồng ý)
Marketing use of personal data generally needs clear, specific, informed consent. Pre-ticked boxes and vague “we may contact you” lines don’t cut it. Consent must be as easy to withdraw as to give.
Cross-border transfer
Sending personal data outside Vietnam — including into US-hosted AI tools — is a regulated transfer requiring a documented impact assessment. This is the rule marketers break most often, by accident.
Impact assessment (DPIA)
Processing and cross-border transfers require a written assessment file documenting what data you handle, why, and how it’s protected. It must be ready for the authority on request.
Data subject rights
Customers can access, correct, delete, and object to processing of their data, and withdraw consent. Your unsubscribe and data-deletion process must actually work.
Sensitive data
Health, financial, location, and similar categories get extra protection. Avoid collecting them for marketing unless you truly need them — and never paste them into a public AI tool.
Why AI tools are the new privacy minefield
Here is the part most Vietnamese marketing teams miss. The moment you copy a customer’s name, phone number, email, or order history into ChatGPT, Claude, Gemini, or a foreign automation tool, you have likely done two regulated things at once: processed personal data and transferred it across the border. Most popular AI tools run on servers in the US or EU. “I was just asking it to clean up my spreadsheet” is not a defence.
- Anonymise/pseudonymise before pasting (replace names with “Customer A”)
- Use AI for ideas, drafts, and analysis on aggregate data
- Choose tools with a Vietnam data-residency or enterprise no-training option
- Get consent that explicitly covers AI-assisted processing
- Keep a written record of which tools touch personal data
- Pasting a full CRM/customer export into a public chatbot
- Uploading lead lists with names + phones for “enrichment”
- Feeding customer support transcripts into untracked tools
- Using AI on health, financial, or ID data for targeting
- No consent record, no cross-border transfer documentation
What are the penalties under the PDPL?
| Violation | Indicative penalty |
|---|---|
| Unlawful cross-border data transfer | From VND 3 billion up to 5% of prior-year revenue |
| Illegal sale or purchase of personal data | Minimum VND 3 billion, up to 10× the illegal gain |
| Other violations | Up to VND 3 billion |
| Individuals (vs. organisations) | Roughly half the organisational fine |
Figures are indicative and based on published summaries of the PDPL and Decree 356/2025. This article is practical guidance, not legal advice — confirm specifics with a Vietnamese data-protection lawyer before relying on them.
A 6-step compliance sprint for marketing teams
- The PDPL is live as of 1 January 2026; Decree 356/2025 replaced Decree 13/2023.
- Marketing use of personal data needs a lawful basis — usually explicit, logged consent.
- Putting personal data into foreign AI tools is a cross-border transfer that must be documented.
- Anonymise first — it’s the single easiest habit that removes most of the risk.
- Penalties reach VND 3 billion, or 5% of revenue for cross-border breaches.
Privacy doesn’t mean abandoning AI — it means using it deliberately. If you’re still building your toolkit, start with our complete AI marketing stack for Vietnam, and read our practical playbooks for Claude, ChatGPT, and Gemini — each has different data-handling settings worth checking.
About SMK Vietnam: SMK Vietnam is a marketing hub helping Vietnamese companies and foreign brands (US, Japan, Thailand, Korea, Europe) run effective, compliant marketing in Vietnam — combining AI tools with local market expertise.
Want privacy-safe AI marketing in Vietnam?
We’ll help you map your data, set guardrails for AI tools, and keep your marketing both effective and PDPL-compliant.
Talk to SMK Vietnam →
Frequently asked questions
Is it illegal to use ChatGPT or Claude for marketing in Vietnam?
No — using AI tools is legal. What’s regulated is putting personal data into them. Use AI freely for ideas, drafts, and analysis on anonymised or aggregate data. The risk comes from pasting identifiable customer data into a foreign tool without consent or transfer documentation.
When did Vietnam’s Personal Data Protection Law take effect?
The PDPL took effect on 1 January 2026. It was passed in 2025 and is supported by Decree 356/2025/NĐ-CP, which replaced the earlier Decree 13/2023/NĐ-CP (in force since 1 July 2023).
Does sending data to a US-based AI tool count as a cross-border transfer?
In most cases, yes. If personal data of people in Vietnam leaves the country — including by being processed on overseas servers run by ChatGPT, Claude, Gemini, or similar — it is treated as a cross-border transfer and requires a documented impact assessment. Anonymising the data before sending it greatly reduces this exposure.
What’s the fastest way to lower our privacy risk?
Adopt an “anonymise first” rule: strip names, phone numbers, emails, and ID numbers before any data touches a public AI tool. Combined with logged consent on your forms and a list of which tools handle personal data, this removes most everyday risk for a marketing team.
How big are the fines for breaking the PDPL?
Penalties are significant: up to VND 3 billion for many violations, unlawful cross-border transfers up to 5% of the previous year’s revenue, and illegal data sales up to 10 times the illegal gain. Individuals typically face about half the organisational amount.
Does this apply to foreign companies marketing in Vietnam?
Yes. The law protects the personal data of people in Vietnam, so foreign brands processing Vietnamese customers’ data are within scope — even if their headquarters and tools are abroad. International teams should treat Vietnam data with the same care they apply under GDPR-style regimes.
Leave a Reply