Is Cold Email Legal in Vietnam? The 2026 Guide to the Data Law and Decree 91

Two laws, and both start from consent

The Personal Data Protection Law (Law No. 91/2025/QH15) was passed by the National Assembly on 26 June 2025 and has applied since 1 January 2026, with its guiding Decree 356/2025/ND-CP taking effect the same day. It replaced Decree 13/2023/ND-CP, which had been Vietnam's main data protection instrument since July 2023, and it is enforced by the Ministry of Public Security.

Spam has its own instrument. Decree 91/2020/ND-CP, in force since 1 October 2020, governs advertising by text message, email and phone call. It replaced the earlier spam decrees from 2008 and 2012, and its central rule is simple: an advertiser may not send an advertising message or make an advertising call without the user's prior agreement.

The two stack. A campaign has to be lawful under the data law, because you are processing personal data to run it, and lawful under Decree 91, because the message itself is advertising. A team that has solved one has not solved the other.

Why Singapore habits do not travel

In Singapore, section 4(5) of the PDPA takes business contact information, such as a work email and job title, out of the consent rules, which is why B2B cold email to a work address is routine there. Vietnam has no equivalent. A named person's work email, direct line and job title are personal data like any other, and processing them needs a lawful basis.

Nor does Vietnam offer the legitimate interest basis that makes targeted outreach workable in Thailand and the Philippines. The Law's route for ordinary commercial processing is consent, with exceptions for narrower situations such as performing a contract with the person, meeting a legal obligation, or emergencies. Unsolicited prospecting does not sit comfortably in any of those exceptions.

Consent has to mean something. It must be given voluntarily, for a stated purpose, and in a form that can be shown later; silence or a failure to reply is not consent. The person can withdraw it at any time, and once they do, processing for that purpose has to stop.

What Decree 91 requires of an advertising email, text or call

Decree 91 defines spam by the absence of prior agreement: an advertising message sent without the user's consent is spam, whatever its content. On top of the consent rule, the Decree sets out how advertising must behave.

• Label it. Advertising messages and emails must carry an advertising label, and the label may only be [QC] or [AD].
• Give a way out. Every advertising message must offer a working way to refuse further advertising, and a refusal ends the sending.
• One unanswered message is the end of it. Where a user refuses, or does not respond to the first advertising message, the advertiser may not send further advertising messages or calls to that number.
• Mind the clock and the count. Advertising text messages are limited to three per number in 24 hours, sent between 7am and 10pm. Advertising calls are limited to one per number in 24 hours, made between 8am and 5pm.
• Introduce yourself first. An advertising call must open with the caller's name and address before any advertising content, and must stop at once if the person declines.
• Respect the Do Not Call list. Numbers registered on the national Do Not Call list may not receive advertising calls or messages at all.

The Do Not Call list for advertising calls and texts

Article 7 of Decree 91 establishes the Do Not Call list: the set of phone numbers whose users have registered that they accept no advertising registration messages, advertising messages or advertising calls of any kind. Advertisers and carriers may not call or message any number on it.

For a telemarketing team this works like Singapore's DNC Registry, but with a stricter backdrop. In Singapore, a number that is not on the Registry can be called. In Vietnam, staying off the Do Not Call list is necessary but not sufficient: the consent rule for advertising calls still applies to every number.

Keep the check and the consent record together, per number. If a regulator or a complaint asks why a number was called, the answer should be on the contact record: when consent was given, how, and when the list was checked.

Personal data in the prospect list itself

The data law reaches further back than the send. Article 7 of the Law lists seven prohibited acts, including processing personal data contrary to law and buying or selling personal data unless another law allows it. A purchased list of named Vietnamese contacts is therefore a liability in itself, before a single message goes out.

Company-level data is a different matter. A company's name, registration details, sector and published switchboard describe a business, not a person, and building an account list from them carries far less risk than building a contact list. The personal data question arises when you attach named people and their direct details to those accounts.

Record where every contact came from and what the person agreed to. The Law gives data subjects rights to be informed, to access their data, to withdraw consent and to have data deleted, and answering any of those requests depends on knowing the provenance of each record.

Foreign senders and cross-border transfers

A Singapore company prospecting into Vietnam is processing the personal data of people in Vietnam, and the Law is written to reach foreign organisations that do so. Plan on the basis that it applies to you rather than hoping distance is a defence.

Transfers out of Vietnam carry their own obligations, including an impact assessment for the transfer kept available to the authority. Most outbound stacks transfer data by default, because the CRM, the email platform and the warehouse sit outside Vietnam, so Vietnamese prospect records cross a border the moment they are created. Breaches of the cross-border rules carry the Law's heaviest fine.

Penalties

Under Article 8 of the Law, the maximum administrative fine for an organisation that breaches the cross-border transfer rules is 5 per cent of its revenue in the previous year. Buying or selling personal data can be fined up to ten times the revenue earned from the violation, and other breaches up to VND 3 billion. Fines for individuals are half those for organisations.

Decree 91 brought its own sanctions for spam. Fines run from VND 5 million to VND 100 million depending on the breach, with the top band of VND 80 million to 100 million reserved for sending advertising messages or making advertising calls to numbers on the Do Not Call list.

The numbers are smaller than the reputational cost. Vietnamese business is relationship-led, and a company remembered for unsolicited bulk advertising has a harder time opening the conversations that actually close.

A practical way to sell into Vietnam

The workable pattern is to earn consent before you advertise. That sounds like a constraint, and it is, but it fits how Vietnamese buyers prefer to be approached anyway: formally, through introductions, with a company profile before a meeting.

• Build your account list from company-level data, and keep purchased lists of named Vietnamese contacts out of your CRM.
• Generate consent through channels people choose: events, webinars, partner introductions, referrals, inbound enquiries and content they request.
• Record consent on the contact: when, how, for what, and the wording they agreed to.
• Keep the first message personal and specific rather than advertising, and take advice on where your message falls before you send anything at volume.
• Label any advertising message [QC] or [AD], include a working refusal option, and stop at the first refusal or non-response.
• Check every number against the Do Not Call list before any advertising call or text, and call only between 8am and 5pm, once a day at most.
• Suppress anyone who refuses or withdraws consent across your whole organisation, permanently, so a later import cannot bring them back.
• Know which route covers Vietnamese prospect data held in offshore systems, and keep the impact assessment with it.
• Take advice from a Vietnamese lawyer before your first campaign, and again when your volume or channel mix changes.