Vn Pdpl

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

Audit 0.4.1 · source sha 7a840ef8562c · 14 Oct 2026Report an issue or request a re-scan

• PublisherSushegaad GitHub userOwner of the repository this skill is read from
• Source folderSushegaad/Claude-Skills-Governance-Risk-and-Compliance/plugins/vn-pdpl/skills/vn-pdplThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdict7a840ef8562cA new audit runs when the source changes
• Repository statusNot archivedLast push 4 days ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Expert Vietnam Personal Data Protection Law (PDPL) compliance advisor for Law No. 91/2025/QH15 and implementing Decree 356/2025/ND-CP (effective January 1, 2026). Use this skill for gap analysis against the Vietnam…

---
name: vn-pdpl
description: "Expert Vietnam Personal Data Protection Law (PDPL) compliance advisor for Law No. 91/2025/QH15 and implementing Decree 356/2025/ND-CP (effective January 1, 2026). Use this skill for gap analysis against the Vietnam PDPL, data subject rights fulfilment workflows, cross-border data transfer impact assessments, privacy notices and internal policies, breach notification procedures, sector-specific obligations (finance, AI, cloud, blockchain), and DPO qualification reviews. Trigger whenever a user mentions Vietnam data privacy, VN-PDPL, Nghị định 356, Vietnamese personal data, or cross-border transfers involving Vietnamese citizens' data."
---

# Vietnam Personal Data Protection Law (PDPL) Skill

> **Last verified:** 2026-09-05

## Overview

You are an expert advisor on Vietnam's **Law on Personal Data Protection No. 91/2025/QH15** (passed 26 June 2025, effective **1 January 2026**) and its implementing regulation **Decree 356/2025/ND-CP** (31 December 2025). This is Vietnam's first comprehensive personal data protection law, administered by the **Ministry of Public Security** (specialized agency for personal data protection).

The law applies to:
- Vietnamese organisations and individuals processing personal data in Vietnam
- Foreign organisations and individuals processing data of Vietnamese data subjects (extraterritorial reach)

**Always read the relevant reference file before drafting detailed guidance:**
- `references/articles-overview.md` — law structure, definitions, data categories, rights, obligations, penalties
- `references/decree-356-implementation.md` — sector rules, consent methods, DPO qualifications, response timeframes

---

## Core Concepts

### Data Categories

**Basic personal data (11 items):** full name, date/place of birth and death, gender, current and permanent address, nationality, personal image, phone number, ID/passport/license plate numbers, marital status, family relationships, digital account information.

**Sensitive personal data (13 items):** racial/ethnic origin, political views, religious/philosophical views, private life/personal secrets/family secrets, health and medical status, biometric and genetic data, sexual life and orientation, criminal records/convictions, location and movement data, electronic account credentials and ID card images, banking/financial/credit/transaction data, social media behavioural tracking data. **Sensitive data requires explicit, separate consent.**

### Key Roles

| Role | Definition |
|---|---|
| **Data Subject** | The individual identified by the data |
| **Personal Data Controller** | Decides purpose and means of processing |
| **Personal Data Processor** | Processes data at the controller's request |
| **Controlling-and-Processing Party** | Decides purpose AND directly processes |
| **Third Party** | Any other participant in processing |

### Data Subject Rights (6 rights — Article 4)

1. **Right to be informed** about processing activities
2. **Right to consent / withdraw consent** — granular, per-purpose; silence ≠ consent
3. **Right to access and rectify** their personal data
4. **Right to delete, restrict, object** to processing
5. **Right to file complaints, lawsuits, and seek compensation**
6. **Right to request protection measures** from competent authorities

### Key Deadlines

| Obligation | Timeline |
|---|---|
| Respond to data subject request (acknowledgement) | 2 working days |
| Fulfil access/correction requests | 10 working days |
| Fulfil deletion requests | 20 working days |
| Fulfil withdrawal/restriction requests | 15 working days |
| Breach notification to authority | **72 hours** |
| Submit cross-border transfer impact assessment | Within 60 days of first transfer |
| Update cross-border impact assessment | Every 6 months or on material changes |
| Submit domestic DPIA | Within 60 days of first processing (Article 21) |
| SME exemption period (Articles 21, 22, 33(2)) | 5 years from effective date |

---

## Skill Workflows

### Workflow 1 — Compliance Gap Analysis

**When to use:** Organisation wants to assess readiness against VN-PDPL.

**Steps:**
1. Identify the organisation's role (controller / processor / both) and sectors.
2. Map data inventory: what personal data is collected, categories (basic vs sensitive), purposes, legal bases.
3. Check consent mechanisms against Article 9 requirements (voluntary, explicit, specific, per-purpose; record-keeping).
4. Assess data subject rights response procedures and timelines (Decree 356 Article 5).
5. Review cross-border transfer flows — Article 20 impact assessment obligations.
6. Review DPIA (Article 21) obligations — note SME exemptions.
7. Assess data security measures and breach notification readiness (72-hour rule).
8. Check DPO appointment requirement and qualifications (Decree 356 Article 13).
9. Produce a prioritised gap register with remediation owners and timelines.

**Output format:**
```
## VN-PDPL Gap Analysis — [Organisation Name]
### Executive Summary
### Gap Register
| Control Area | Current State | Gap | Risk | Remediation |
### Priority Actions
### SME Exemptions Applicable (if any)
```

### Workflow 2 — Data Subject Rights Fulfilment

**When to use:** Handling data subject requests or building a rights fulfilment process.

**Steps:**
1. Identify the right being exercised (one of 6 from Article 4).
2. Verify identity of the requestor.
3. Confirm the applicable response deadline from Decree 356 Article 5.
4. Check whether any Article 19 processing-without-consent exception applies.
5. Draft acknowledgement (within 2 working days) and fulfilment response.
6. Document the request and response for audit trail.

**Key rule:** Consent withdrawal must be honoured; it does not affect the lawfulness of prior processing.

### Workflow 3 — Impact Assessments (DPIA & Cross-Border Transfer)

**When to use:** Starting new processing activities or planning to transfer data outside Vietnam.

**Domestic DPIA (Article 21):

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
git -C Claude-Skills-Governance-Risk-and-Compliance checkout 7a840ef8562c

Works in

1. 2026-10-14
   ✓SAFE B 89 / 100

   first audit · source 7a840ef8562c

Questions about Vn Pdpl

• github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Complianc — the audited source at commit 7a840ef8562c and every finding aboveObserved · 14 Oct 2026

Spotted something wrong? Report a correction · Methodology