Vietnam

Summary

Vietnam presents a moderately restrictive crawling environment driven by a maturing, fast-moving data-protection and cybersecurity framework. The Cybersecurity Law 2018 (Law No. 24/2018/QH14) imposes broad data-localisation obligations on domestic and foreign online service providers, requires content removal, and restricts cross-border data transfers. The Personal Data Protection Law (PDPL, Law No. 91/2025/QH15, enacted 26 June 2025, in force 1 January 2026) replaced Decree 13/2023/ND-CP; it elevates personal data protection to statutory level with comprehensive processing obligations, aggressive penalty tiers (fines up to VND 3 billion / ~$115,000 or 5% of Vietnam revenue for cross-border violations), and Decree 356/2025/ND-CP as the implementing instrument. Penal Code 2015 Art. 289 criminalises illegal access to computer networks and electronic devices by bypassing access controls; publicly accessible pages without such controls are below its threshold. On copyright, the amended IP Law 2022 introduced TDM provisions; Decree 134/2026/ND-CP (in force 9 April 2026) implements a non-commercial TDM exception with opt-out rights for rights holders — commercial TDM at the point of use remains prohibited absent authorisation. No sui generis database right. Overall — moderate risk; public-page crawling of non-personal data tolerable; personal data collection requires a lawful basis; cross-border restrictions are among the strictest in Southeast Asia.