When the Law on Personal Data Protection and its guiding regulations have been officially applied in practice, the identification and proper handling of incidents related to personal data is becoming an important compliance requirement for businesses. In particular, when a data breach occurs, enterprises not only need to determine the responsibilities of relevant parties but also promptly fulfill the obligation to notify, remedy and keep records as prescribed.
Following the professional cooperation with OneTrust DataGuidance, HM&P Law Firm ("HM&P") has coordinated to update and release the document "Vietnam – Data Breach", with the participation of Partner Nguyen Ngoc Tra My and Senior Associate Pham Thanh Huy. Previously, two lawyers were recognized by OneTrust DataGuidance in the Experts Directory on personal data protection in Vietnam. In the updated 2026 edition, the names of Lawyer My and Lawyer Huy continue to be directly recorded as contributing authors to the Guidance Note on Vietnam.
From the legal framework to the data incident response process
"Vietnam – Data Breach" provides a relatively comprehensive information system on the legal framework governing personal data breaches in Vietnam. The document updates the provisions of the Data Law, the Law on Personal Data Protection and Decree No. 356/2025/ND-CP, and clarifies the role of the Ministry of Public Security and the Department of Cyber Security and High-tech Crime Prevention and Control (A05) in the state management of personal data protection.
A focus of the document is the obligations that businesses should pay attention to when detecting violations of personal data protection. Accordingly, the controller of personal data, the controller and processor of personal data or relevant third parties must notify A05 in statutory cases; the notification period is 72 hours from the detection or occurrence of the violation. The notification content must show the main information about the nature of the incident, the affected data, the possible consequences and the expected measures to handle and minimize the damage.
The document also delves into the obligation to notify data subjects in some cases, especially for incidents related to location data or biometric data, as well as specific requirements in the fields of finance, banking and credit information. In addition, issues of record keeping, coordination between processors and data controllers, civil liability as well as administrative sanctions risks are systematized so that businesses can more fully identify obligations arising after incidents.
Partner Nguyen Ngoc Tra My
Bringing Vietnam's legal perspective to the international community
The update of "Vietnam – Data Breach" on OneTrust DataGuidance not only recognizes the participation of HM&P Lawyers but also contributes to codifying Vietnam's regulations in a way that is more accessible to businesses, experts and international organizations interested in the Vietnamese market. Thereby, changes in the law on personal data have an additional reference channel to be accessed and compared in the global legal environment.
For HM&P, the presence of lawyers on this platform also reflects the orientation of associating practice activities with the sharing of legal knowledge and connecting Vietnamese practice with the international professional community. This is the foundation for HM&P to leverage its experience in the fields of data, technology and compliance, while enhancing its ability to support businesses in the process of adapting to increasingly intensive legal requirements in Vietnam.
View the full document published on OneTrust: HERE
