On June 26, 2025, Vietnam enacted the LPDP1, a milestone that upgrades and consolidates the country’s privacy regime. It builds on Decree 132, which has guided personal data protection since July 1, 2023. The LPDP creates a single, strong framework to protect privacy. And Vietnam has not stopped there. In September 2025, the Ministry of Public Security released a draft decree to implement the LPDP (“Draft Decree”). It provides guidance for key LPDP provisions. Enterprises and individuals that process personal data in Vietnam should stay alert to the country’s privacy regime. Rules are being created and implemented quickly, and enforcement is catching up. WHAT ARE THE KEY OBLIGATIONS AND COMPLIANCE CHALLENGES UNDER THE LPDP? The LPDP becomes effective on January 1, 2026 and will co-exist with Decree 13. It consolidates most of the existing rules under Decree 13, adds further requirements and provides guidance on implementation. If a company is already compliant with Decree 13, significant changes to core data governance is not required. However, changes in certain fields such as marketing and AI may be necessary. One of the key obligations that carries on from Decree 13 is the obligation to prepare, submit and maintain a data processing impact assessment (“DPIA”) and an offshore data transfer impact assessment (“DTIA”). These impact assessments, once submitted to the authorities, must be updated every 6 months if there is any change or immediately upon the occurrence of (i) a corporate restructuring or cessation of business, (ii) a change of the personal data protection service provider, or (iii) expansion or amendment of the business scope, that concerns the processing of personal data....