On 16 March 2026, the Ministry of Public Security (MPS) issued the draft decree on administrative sanctions in the fields of cybersecurity and personal data protection (the Draft Decree) for public consultation. It is the first step to put concrete penalties behind the PDPL 2025, which took effect on 1 January 2026 but left the enforcement details to the Government. The Draft covers a wide range of sectors, such as cybersecurity, personal data, AI, telecommunications, and digital signatures. This post focuses on the personal data provisions (Articles 57 to 69 of the Draft Decree), which raise potential concerns for businesses.

When companies think about data protection, they usually focus on “visible” data like names, email addresses, or bank details. However, there is a hidden layer called metadata - essentially “data about data” - that often gets ignored.

Under Vietnam’s new personal data protection rules, overlooking metadata is a major risk. If metadata can be used to identify a specific person, it falls under the same strict rules as regular personal data.

What is Metadata? The “Digital Footprint”

Metadata is information that describes the context of a file or a message rather than the content itself. Even if you remove a person’s name from a file, the metadata can still point directly to them.

On 31 December 2025, the Government issued Decree 356/2025 guiding the implementation of the PDPL 2025, which took effect on 1 January 2026. Decree 356/2025 provides critical detailed guidance and, notably, resolves several ambiguities under the PDPL 2025 framework. This post highlights the key takeaways from this new regulation.

1.         Expansion of "sensitive personal data": ID Cards and login credentials

As compared to the Draft PDPL Decree, Decree 356/2025 expands the scope of sensitive personal data to explicitly include: