Medical data privacy in Vietnam: what the law says

What the law says

How Vietnam treats your health data.

The law: Law on Personal Data Protection No. 91/2025/QH15, in force since 1 January 2026[S97]
The regulator: Ministry of Public Security, through its data protection department (A05)[S99]
Health data: Health data is sensitive personal data, and processing it needs your consent.[S98]
Sending it abroad: Sending data out of Vietnam needs a cross-border transfer impact assessment, filed with the Ministry of Public Security within 60 days of the first transfer.[S98]
EU adequacy: No. Vietnam is absent from the European Commission's adequacy list, so an EU organisation sending data there needs other safeguards.[S77]
If there is a breach: Within 72 hours to the Ministry's data protection department, and to the people affected within 72 hours where sensitive data is involved.[S99]
Fines: Up to 5% of the previous year's revenue for cross-border transfer violations, up to ten times the revenue from buying or selling personal data, and up to VND 3 billion for other violations.[S98]

Sending your records

The law protects the clinic’s copy. How it gets there is up to you.

Email and messaging apps leave a readable copy on every server they pass through, in Vietnam and at home. The safest file is the one that stays encrypted on your own phone, shown to the doctor in the room or sent by a link that expires by itself.

Try the free privacy check

Questions

Vietnam: common questions.

Is it safe to email medical records to a clinic in Vietnam?

Email is protected between mail servers only when both providers support TLS, and it stays readable on each server afterwards. Once your records reach a clinic in Vietnam, local law applies: health data is sensitive personal data, and processing it needs your consent. For a full history, use a channel where you hold the key, such as a link that expires by itself.

How does Vietnam protect health data?

Health data is sensitive personal data, and processing it needs your consent. Breaches must be reported within 72 hours to the Ministry's data protection department, and to the people affected within 72 hours where sensitive data is involved. The regulator is the Ministry of Public Security, through its data protection department (A05).

Can a clinic in Vietnam send my medical records abroad?

Sending data out of Vietnam needs a cross-border transfer impact assessment, filed with the Ministry of Public Security within 60 days of the first transfer.

Keep reading

More on Vietnam, and elsewhere.

Sources are numbered in the text and listed in full in the reference list.

Medical data privacy in Vietnam.