Cold Email Laws in Vietnam: Prior Consent, the [QC] Tag and a Three-a-Day Cap

September 28, 2026. Cold email to Vietnam is opt-in, and the rule is written for email specifically rather than borrowed from a privacy statute. Decree No. 91/2020/ND-CP of August 14, 2020, in force since October 1, 2020, defines an advertising email as any email introducing a product, goods or service for profit, defines a spam email as an advertising email sent without the user's prior consent, and then sets out exactly what a lawful advertising email has to look like: a tag at the start of the subject line, the advertiser's full details, an opt-out block at the end, and no more than three emails to one address in a day. There is no exception for business recipients. Two newer layers now sit on top. Since January 1, 2026 the Law on Personal Data Protection, Law No. 91/2025/QH15, requires consent to use a person's data for advertising at all and reaches foreign companies that process Vietnamese citizens' data. And since August 19, 2026, Decree No. 330/2026/ND-CP has given the email rules a fine schedule of their own, starting at VND 10 million for a single advertising email sent without consent.

What Decree 91 requires of every advertising email

1. Prior consent, no business carve-out. Article 13.1 prohibits sending advertising emails to users who have not expressed prior consent to receive advertisements. The decree speaks of users, not consumers, and its definitions do not exempt a work address or a company mailbox. Article 3 defines the spam email as precisely the advertising email sent without that consent.
2. A subject-line tag. Article 18 says every advertising email must be marked, the mark must sit at the top position of the subject line, and it may take the form [QC] or [AD]. QC is the Vietnamese abbreviation for quang cao, advertising.
3. The advertiser's identity, in full. Article 19 requires the advertiser's name, telephone number, email address, geographical address and website or social network addresses, placed immediately before the opt-out information.
4. An opt-out block with three channels. Article 20 requires opt-out information at the end of the email, clearly expressed, confirming the user's right to opt out of all the advertiser's products, and offering opt-out via website or social network, via email and via call. On receiving a request the advertiser must immediately send a confirmation stating the time received and the time sending will stop, sent once and containing no advertising.
5. Frequency and stop. Article 13.5 caps advertising emails at three per address in 24 hours unless the user agrees otherwise, and Article 13.4 requires sending to stop immediately on an opt-out request.
6. Subject must match content. Article 17 requires the subject to match the content, which must comply with the Law on Advertising, and for charged services the email must state the rates.

The fines: Decree 330/2026 since August 19, 2026

Decree 91 does not carry its own fine schedule. When it was issued, Articles 32 and 33 inserted the penalties into Decree 15/2020/ND-CP, the sanctioning decree for post, telecommunications and information technology, with a band of VND 20,000,000 to 30,000,000 for failing to take measures to check the user's clear prior consent when sending advertising emails, and the same band for failing to give users tools to search or store their registration and opt-out agreements on the sender's website or social network. That schedule has now been restated and raised. Decree No. 330/2026/ND-CP of August 19, 2026, on sanctioning administrative violations in the fields of cybersecurity and personal data protection, took effect the same day under its Article 80, and its Article 37 is written for emails and messages that provide information on products and services. The ladder for an outbound sender runs: VND 10,000,000 to 20,000,000 for sending advertising emails to recipients without their consent, or for labelling them incorrectly or incompletely (clause 1); VND 20,000,000 to 30,000,000 for failing to label advertising emails at all, or for failing to store advertising registrations, refusal requests and refusal confirmations for at least one year (clause 2); VND 30,000,000 to 50,000,000 for sending more than three advertising emails to one address in 24 hours, for lacking measures to check the user's clear prior consent, or for failing to confirm a refusal request in the required time, form and content (clause 3); VND 70,000,000 to 80,000,000 for incomplete forms of refusing advertising emails (clause 5); and VND 80,000,000 to 90,000,000 for advertising by email without a system for receiving and handling refusal requests, the same band as texting or calling a number on the Do-Not-Call Register (clause 6). Clause 8 adds a suspension of service to new customers for one to three months for several of those acts, and Article 82 makes the Minister of Public Security responsible for guiding and organising the decree's implementation. Tilleke and Gibbins notes that the Penal Code can reach VND 6 billion for commercial legal entities in the worst cases. The bands are the same for every sender; the decree does not scale them to company size.

The 2026 data protection law sits on top

Law No. 91/2025/QH15 was passed on June 26, 2025 and took effect on January 1, 2026 under its Article 38. Article 1 applies it to Vietnamese organizations, to foreign organizations in Vietnam, and to foreign organizations directly involved in processing the personal data of Vietnamese citizens, which is the clause that reaches a sender in Dubai, London or Austin. Article 28, on personal data in the provision of advertising services, requires the customer's consent to the processing of their personal data for advertising, given on the basis that the customer clearly knows the content, method, form and frequency of the product introduction, requires a method for the customer to refuse, says in terms that the use of personal data for advertising must comply with the anti-spam law, and gives data subjects the right to demand that advertising stops, with the provider obliged to offer a mechanism and stop on request. Article 9 defines valid consent: voluntary, informed of the data type, purpose, controller and the subject's rights, expressed explicitly and specifically in a form that can be printed or copied, given per purpose, and never inferred from silence. A business email address that identifies a named person is personal data under Article 2. The fines are set by the law itself: a maximum of VND 3 billion for administrative violations in general, 5% of the preceding year's revenue for cross-border transfer violations, and ten times the proceeds for buying or selling personal data, with individuals liable for half the organizational maximum. Small enterprises and startups may defer Articles 21 and 22 for five years, but that deferral covers impact assessments, not consent.

What it means for operators

Vietnam is the largest impression pool on our site without a page for a reason: the demand is real and the honest answer is uncomfortable. A classic cold sequence to a purchased list of Vietnamese work addresses breaks Article 13.1 of Decree 91 on the first send, Article 28 of the data protection law on the first processing, and, since August 19, 2026, Article 37 clause 1 of Decree 330 on every email, with the consent-check and three-a-day clauses in the VND 30 to 50 million band above it. The routes that survive are consent-first: a webinar, a download, a partner introduction or an inbound form that captures explicit, purpose-specific consent in a form you can print, then a sequence that carries the [QC] tag, the full advertiser block, three opt-out channels and a confirmation on every unsubscribe, at no more than three emails a day. Sending infrastructure has to keep the proof: Decree 330 fines the sender who cannot produce registrations, refusals and refusal confirmations going back a year, so consent capture and suppression have to live in the system that sends, which is the design principle behind our email infrastructure builds. For where Vietnam sits against its neighbours, our Japan and South Korea guides cover two other opt-in regimes with narrow business exceptions, our country-by-country comparison table puts every regime we have researched side by side, and the opt-in vs opt-out map places them on one scale. A Vietnam programme is a lead generation build that starts with the consent event, not with the list.