Edgecraft Digital
News and insights

Vietnam’s new data protection rules: what clinics need to know in 2026

By Robyn Kirk, 20 October 2026

Article title, Vietnam’s new data protection rules: what clinics need to know in 2026, beside a patient consent form with three ticked boxes and a padlock

Since 1 January 2026, every clinic, home nursing service and hospital in Vietnam that holds patient records has new legal duties, and since 19 August 2026 the fines are being enforced. Here is what changed, what it could cost, and what to do next.

What changed in 2026

Four new laws and decrees now govern how patient data is collected, stored and protected in Vietnam. Together they replace the 2023 decree most businesses had been working to.

DateWhat happened
21 July 2025Circular 13/2025/TT-BYT on electronic medical records takes effect [5]
1 January 2026The Law on Personal Data Protection (Law No. 91/2025/QH15) takes effect, with detailed rules in Decree 356/2025/NĐ-CP, replacing Decree 13/2023/NĐ-CP [1], [2]
1 July 2026The new Law on Cybersecurity (Law No. 116/2025/QH15) takes effect, replacing the 2018 Cybersecurity Law and the 2015 Law on Network Information Security [4]
19 August 2026Decree 330/2026/NĐ-CP sets the fines for breaches and takes effect immediately; the Ministry of Public Security enforces [3]

The big shift is that data protection is now a law passed by the National Assembly, not just a government decree. With Decree 330 in force, the rules now come with real penalties.

Why patient data is different

Health information is classed as sensitive personal data, which carries the strictest rules in the law [1], [2]. For a clinic or care business, three rules matter most:

  • Consent comes first. You need the patient’s consent to process their health data, with only limited exceptions [1]. Consent must be clear and separate for each purpose; pre-ticked boxes or treating silence as agreement can be fined [3], [8].
  • Tell patients what you hold. Patients must be told when their sensitive data is being processed [3].
  • Don’t share without a written request. Health providers must not pass patient data to other healthcare providers or to health or life insurers unless the patient asks in writing, or an exception applies [1], [7].

Most organisations must also name a person or team responsible for data protection and assess the risks of how they process data. Some small businesses can defer the first of these, but not those processing sensitive data at scale [7].

What a breach can cost

A single consent mistake can cost a clinic up to VND 70 million, and sharing patient data without permission up to VND 100 million [9], [10]. These examples from Decree 330/2026/NĐ-CP show the scale:

ViolationFine (VND)
Sharing patient data with another healthcare provider or an insurer without the patient’s written request70–100 million [9]
Treating a patient’s silence as consent50–70 million [10]
Processing personal data without consent30–50 million [10]
Default (pre-ticked) consent, or not telling patients their sensitive data is processed30–50 million [13]
Failing to notify a data breach correctlyup to 80 million [8]
Not appointing data protection staffup to 30 million [8]

The ceiling for most data protection violations is VND 3 billion. Breaking the rules on sending personal data overseas can cost up to 5% of annual revenue, and buying or selling personal data up to ten times the gains [6]. Beyond the fines, a breach can mean public apologies to patients and lasting damage to trust [3].

The electronic medical records deadline

Clinics and other non-hospital facilities treating inpatients, day patients or outpatients are due to move to electronic medical records by 31 December 2026 [5], [11]. Hospitals had to switch by 30 September 2025.

That leaves little time. Moving to electronic records also brings your systems under the data protection rules above, so the two jobs are best done together: choose a records system that is secure from the start, rather than securing it afterwards. If your facility has been given an extension, check its terms and plan for it now.

Five practical steps for your clinic

You don’t need to solve everything at once. Start here:

  1. Map your patient data. List what you collect, where it is stored (including phones, spreadsheets and messaging apps), and who can see it.
  2. Fix your consent forms. Ask for consent separately for each purpose, with no pre-ticked boxes, and keep a record of every patient’s choice.
  3. Know where your data lives. If records sit on servers outside Vietnam, find out what that means for you under the transfer and data localisation rules [4], [12].
  4. Name who is responsible. Choose a person or team for data protection and agree what happens if there is a breach.
  5. Plan your move to electronic records. Pick a system that meets Circular 13 and keeps patient data secure, and set a date before 31 December 2026.

How Edgecraft Digital can help

We design secure patient record systems for hospitals, medical and allied health clinics, home nursing and emergency services, with sensitive patient data stored in Vietnam. We supervise the build and the move of any existing software, then actively monitor and report on storage and security compliance. We can also work through your obligations with you in plain language.

Book a compliance chat

This article is general information, not legal advice. For advice on your situation, speak with a lawyer in Vietnam.

Share on LinkedIn More news and insights

Sources

  1. [1] National Assembly of Vietnam, “Law on Personal Data Protection,” Law No. 91/2025/QH15, 26 June 2025. [Online]. Available: thuvienphapluat.vn. Accessed: 20 October 2026.
  2. [2] Government of Vietnam, “Decree detailing the Law on Personal Data Protection,” Decree No. 356/2025/NĐ-CP, 31 December 2025. [Online]. Available: vbpl.moj.gov.vn. Accessed: 20 October 2026.
  3. [3] Government of Vietnam, “Decree on administrative penalties in cybersecurity and personal data protection,” Decree No. 330/2026/NĐ-CP, 19 August 2026. [Online]. Available: pbgdpl.cantho.gov.vn. Accessed: 20 October 2026.
  4. [4] National Assembly of Vietnam, “Law on Cybersecurity,” Law No. 116/2025/QH15, 10 December 2025. [Online]. Available: thuvienphapluat.vn. Accessed: 20 October 2026.
  5. [5] Ministry of Health of Vietnam, “Circular providing guidance on the implementation of electronic medical records,” Circular No. 13/2025/TT-BYT, 6 June 2025. [Online]. Available: LuatVietnam. Accessed: 20 October 2026.
  6. [6] Conventus Law, “Vietnam’s new Personal Data Protection Law imposes administrative fines up to 5% of annual revenue for non-compliance,” n.d. [Online]. Available: conventuslaw.com. Accessed: 20 October 2026.
  7. [7] Conventus Law, “Vietnam’s new Personal Data Protection Law: what businesses need to know,” n.d. [Online]. Available: conventuslaw.com. Accessed: 20 October 2026.
  8. [8] Tilleke & Gibbins, “Vietnam issues cybersecurity and personal data protection sanctions decree,” 2026. [Online]. Available: tilleke.com. Accessed: 20 October 2026.
  9. [9] Luật sư Việt Nam (LSVN), “Phạt đến 100.000.000 đồng với hành vi cung cấp, chia sẻ dữ liệu cá nhân của bệnh nhân cho bên thứ ba khi chưa có sự đồng ý,” 2026. [Online]. Available: lsvn.vn. Accessed: 20 October 2026.
  10. [10] Luật sư Việt Nam (LSVN), “Phạt đến 70 triệu đồng với các vi phạm về xử lý dữ liệu cá nhân,” 13 September 2026. [Online]. Available: lsvn.vn. Accessed: 20 October 2026.
  11. [11] VnEconomy, “Các bệnh viện triển khai hồ sơ bệnh án điện tử chậm nhất vào ngày 30/9/2025,” 2025. [Online]. Available: vneconomy.vn. Accessed: 20 October 2026.
  12. [12] Le & Tran Law, “Data localization rules for tech companies operating in Vietnam,” 2026. [Online]. Available: letranlaw.com. Accessed: 20 October 2026.
  13. [13] Conventus Law, “Vietnam – no longer a draft: Decree 330 officially brings personal data protection into the enforcement phase,” 2026. [Online]. Available: conventuslaw.com. Accessed: 20 October 2026.