Decree 13/2023/NĐ-CP sets new requirements for personal data collection, processing, and protection in Vietnam. Detailed analysis of business impacts and compliance roadmap.
Effective July 1, 2023, Decree 13/2023/NĐ-CP (PDPD) is Vietnam's first comprehensive legal framework on personal data protection, equivalent to EU's GDPR. For foreign businesses operating in Vietnam, this is a critical compliance area.
1. Scope of Application
Decree applies to:
- All domestic organizations and individuals processing personal data
- Foreign organizations processing Vietnamese citizens' data (extraterritorial application)
- All types of personal data: name, address, phone, email, account number, IP, biometric data
2. Personal Data Classification
2.1. Basic Personal Data
Full name, date of birth, gender, ID/citizen ID number, phone, email, address, occupation, photo.
2.2. Sensitive Personal Data
Higher protection required:
- Political views, religion
- Health status, illness
- Genetic, biometric information
- Sexual life
- Criminal, financial, location data
- Social relationship information
3. Data Processing Principles
- Lawful: have legal basis
- Transparent: clear notice to subjects
- Specific purpose: don't use for other purposes without new consent
- Minimal: only collect necessary data
- Accurate: update, correct on request
- Limited storage: only as long as necessary
- Secure: apply technical and organizational measures
- Accountable: data processing organization responsible
4. Data Subject Rights
11 main rights:
- Be informed about processing of their data
- Consent/refuse consent
- Access, view data
- Withdraw consent
- Delete data
- Restrict processing
- Data portability
- Object to processing
- Complain, denounce, sue
- Request damages
- Self-defend
5. Business Requirements
5.1. Appoint DPO (Data Protection Officer)
Mandatory for businesses processing sensitive personal data or data of over 100,000 subjects.
5.2. Conduct Impact Assessment (DPIA)
Mandatory when processing high-risk data: sensitive data, children's data, large-scale behavior profiling.
5.3. Register with Specialized Authority
Certain data processing activities must register with Cybersecurity Department (Ministry of Public Security).
5.4. Cross-Border Data Transfer
Must comply with:
- Impact assessment dossier
- Receiving country has adequate protection
- Register with Ministry of Public Security
- Mechanism allowing Vietnamese authorities access when needed
5.5. Breach Notification
Must notify competent authority within 72 hours of detecting security breach.
6. Violation Penalties
- Warning: minor violations, first offense
- Monetary fines: VND 50 million - 500 million depending on severity
- Percentage fines: up to 5% of annual revenue for serious violations
- Operation suspension: related to data processing
- Criminal prosecution: for intentional serious infringement
7. Compliance Roadmap for Businesses
Step 1: Data Inventory (1-2 months)
List all personal data being processed:
- What data types, stored where
- Processing purpose
- Legal basis for processing
- Storage period
- Third parties data shared with
Step 2: Gap Assessment (1 month)
Compare current state with legal requirements, identify gaps to fill.
Step 3: Update Policies and Processes (2-3 months)
- Website privacy policy
- Data processing agreements with third parties
- Process for handling data subject requests
- Breach incident response process
Step 4: Improve Technical Measures (2-6 months)
- Encrypt sensitive data
- Access controls per minimum principle
- Access monitoring and logging
- Backup and disaster recovery
Step 5: Employee Training (ongoing)
Train all staff on data protection obligations, deep training for IT, sales, marketing teams.
Step 6: Monitor and Improve (ongoing)
Periodic audits, updates when regulations change, learn from internal and external incidents.
8. Implications for FDI Enterprises
Special considerations:
- GDPR vs PDPD overlap: must comply with both for cross-border data flows
- Parent company sharing: even intra-group data transfers may require permits
- Cloud services: AWS, Google Cloud, Azure usage needs assessment
- Vendor management: ensure all third-party vendors PDPD-compliant
This article is for reference only. Please contact a lawyer for accurate advice.
Frequently Asked Questions
My business only collects customer emails for marketing — do I need to comply with PDPD?
Yes. Email is basic personal data. Must have customer consent (opt-in), unsubscribe mechanism (opt-out), clear notice of usage purpose.
Do I need to update website privacy policy?
Yes, mandatory. Policy must clearly state: data collected, purpose, legal basis, storage period, user rights, contact information. Recommended to have separate cookie/tracking consent box.
Does using Google Analytics violate PDPD?
Depends on usage. If configured with IP anonymization and not linked with other personal data, low risk. If combined with CRM for user profiling, must have clear consent and DPIA assessment.
Transferring customer data to Cloud (AWS, Google Cloud) — does this violate?
Possibly, since this is cross-border data transfer. Need: sign Data Processing Agreement with provider, impact assessment, register with Ministry of Public Security (if mandatory), ensure provider compliance with adequate protection measures.
On data breach, must notify whom within 72 hours?
Notify Cybersecurity Department and Cybercrime Prevention Department (A05 - Ministry of Public Security). Also notify affected data subjects if high risk to rights.