Is Decree 13/2023 still in effect? No. Decree 13/2023/ND-CP ceased to have effect on 1 January 2026, the day Decree 356/2025/ND-CP and Personal Data Protection Law No. 91/2025/QH15 took effect (Article 42(1) and (2) of Decree 356). That does not wipe out a compliance programme built in 2023. Article 39 of Law 91 keeps two things alive: consents for processing already under way, and impact assessment dossiers that the A05 Department had received before 1 January 2026. Everything else (the DPO appointment, policies, request-handling procedures, new processing since 2026) has to be measured against the new rules.
Many foreign-invested companies in Vietnam rolled out a group-designed Decree 13 programme in 2023 and have not touched it since. This guide is for them: what still stands, where the gaps usually are, and what to redo, as at 13 October 2026. For a summary of the old decree itself, see our Decree 13/2023/ND-CP archive page.
Is Decree 13/2023 still in effect anywhere? What replaced it#
Decree 13 has no residual force. Decree 356 replaced Decree 13 outright rather than amending it, and the framework since 1 January 2026 has three layers:
- Law 91/2025/QH15, in force from 1 January 2026 (Article 38(1)). It is the first statute dedicated to personal data protection, and it sets the fine caps itself (Article 8).
- Decree 356/2025/ND-CP, which implements the Law and replaced Decree 13 on the same day (Article 42). It carries the forms, the data subject request deadlines, the DPO conditions and the dossier update cycle.
- Decree 330/2026/ND-CP on administrative penalties for cybersecurity and personal data protection, in force from 19 August 2026 (Article 80). See PDPL penalties.
The A05 procedures changed too. Decision 778/QD-BCA-A05 of 9 February 2026 abolished the five Decree 13-era procedures and announced new ones for filing and updating dossiers (Articles 1 and 2); see the Decision 778 summary. Privacy notices, intra-group agreements and vendor contracts that still cite Decree 13 as the governing rule should be re-papered on Law 91 and Decree 356.
Is Decree 13/2023 still in effect for work done before 2026?#
Not as a rule, but Article 39 of Law 91 preserves some of what was built under it. The article has only two clauses, so the answer depends on the item:
| Item built under Decree 13 | Still valid? | Basis | What to do |
|---|---|---|---|
| Consent or agreement for processing that was already under way before 1 January 2026 | Yes. Processing continues without fresh consent or a new agreement | Article 39(1) Law 91 | Keep the consent records; any new activity or purpose from 2026 follows the new rules |
| DPIA dossier received by the A05 Department before 1 January 2026 | Yes. Keep using it; no new dossier under Law 91 | Article 39(2) Law 91 | Update it under Law 91 when things change |
| Overseas transfer impact assessment dossier received before 1 January 2026 | Yes, on the same terms | Article 39(2) Law 91 | Same as above |
| Dossier filed but not received, or never filed | Not covered by Article 39 | Articles 20 and 21 Law 91 | Prepare and file under Decree 356 |
| Data protection officer or unit appointed under Decree 13 | No specific transition rule | Article 33(2) Law 91; Article 13 Decree 356 | Re-check the appointment document and the person's qualifications |
| Privacy notice, internal rules, contracts citing Decree 13 | No specific transition rule | Article 42(2) Decree 356 | Replace the references and review the substance |
Consents collected under Decree 13: valid if you can prove them#
Article 39(1) is generous. Processing that was under way with the data subject's consent, or under an agreement, as required by Decree 13 continues "without asking for consent again or agreeing again". A group-wide re-consent campaign is usually unnecessary and tends to lose part of the customer or employee base that simply does not answer.
Consents collected under Decree 13 are therefore a usable asset, within two limits:
- The protection covers processing already under way. A new purpose, a new product or a new recipient added since 1 January 2026 needs consent (or another legal basis) under the new rules. Article 6 of Decree 356 requires a method that shows who consented, when and to what; the controller must store the consent and bears the burden of proof in a dispute; pre-ticked or ambiguous choices are prohibited; and the data subject must be told when the data is sensitive. See what counts as consent in Vietnam.
- "Grandfathered" is not the same as "undocumented". Decree 330 fines a failure to record and store a consent log, or to prove that consent was given when the data subject or an inspector asks, at VND 30 to 50 million for an organisation (Article 43(1)(g)). Consents buried in a 2023 employment contract template or a website checkbox that was never logged are worth tracing now.
An existing DPIA under Decree 13 and old transfer dossiers#
An existing DPIA under Decree 13 is not automatically safe. The transition rule in Article 39(2) protects a DPIA or overseas transfer dossier "that the specialised personal data protection authority received" before 1 January 2026. Three situations follow.
Received before 2026. The dossier stays in use, and the company does not have to prepare a Law 91 dossier on Forms 09 or 10. Updates made after 1 January 2026 follow Law 91 (Article 39(2)), which means the Decree 356 cycle below. Keep the evidence of receipt (portal record, postal receipt or A05 correspondence) with the dossier.
Filed but not received by 1 January 2026. Article 39 is silent. In our reading the safer course is to confirm the dossier's status with the A05 Department and, if it was not received, file under Decree 356 rather than assume the old filing counts.
Never filed. Article 39 does not help. Some FDI subsidiaries relied on the two-year opt-out for micro, small and medium-sized enterprises and start-ups in Article 43 of Decree 13 (which did not apply to companies processing sensitive data), and that opt-out ran out on 1 July 2025. The relief under Law 91 is narrower: a small enterprise or start-up may choose not to apply the DPIA, dossier update and DPO provisions for 5 years, a micro enterprise is outside them altogether, and neither relief applies to a business that provides data processing services, directly processes sensitive personal data or has processed the data of 100,000 or more data subjects (Article 38(2) and (3) Law 91; Article 41 Decree 356). Size is measured on the Vietnamese company alone under the general SME criteria (Article 5 of Decree 80/2021/ND-CP), without adding in the group. In LexData's reading, though, an employer that collects health check results or keeps images of employees' ID cards already "directly processes" sensitive data (Article 4(1)(d) and (i) Decree 356), so few subsidiaries can rely on the relief. Medium-sized and large enterprises have no relief at all, and the cross-border transfer dossier in Article 20 is not on the relief list for anyone. A company in this position prepares the dossiers on Forms 10 (DPIA) and 09 (cross-border transfer) and files them with Forms 02a/02b and 01a/01b (Articles 18(4) and 19(4) Decree 356).
One structural change for groups: under Law 91 the DPIA filing duty sits with the controller and the controller-processor (Article 21(1)). A pure processor, such as a Vietnamese shared-service entity working for the group, prepares and keeps a DPIA for that work as agreed with the controller (Article 21(3)); Article 19(4) of Decree 356 does not say who files, and the Law prevails. The entity is still the controller of its own employees' data and files a DPIA for that, so the practical course is to describe the group processing as a separate flow in the same filed dossier.
How an old dossier is updated now#
Article 20 of Decree 356 sets the cycle for both dossiers:
- Every 6 months, counted from the first filing, when a new transfer or processing purpose arises, or when a controller, controller-processor, processor or third party is added or changed (Article 20(1)).
- Within 10 days when the company is reorganised, ceases operations, is dissolved or goes bankrupt; when the details of its data protection service provider change; or when a business line or service connected with the processing declared in the dossier is added or changed (Article 20(2)).
- Updates use Form 03a/03b and are filed online, in person or by post with the A05 Department (Article 20(3)).
Skipping an update is fined separately: VND 20 to 30 million for the DPIA dossier (Article 55(1)(d) and (dd) Decree 330) and VND 30 to 50 million for the cross-border transfer dossier (Article 56(1)(d)). For an FDI company, the 10-day trigger is easy to miss during a merger, a change of company type or a new business line added to the investment registration.
Decree 13 vs Law 91: where the rules got stricter for an FDI subsidiary#
The GDPR vs Vietnam PDPL comparison covers the framework as a whole. Comparing Decree 13 with Law 91, these are the points that most often leave a 2023 programme out of date:
A DPO is now a general duty. Decree 13 had no general DPO article: designating a data protection unit and staff was one of the measures for sensitive personal data (Article 28(2)). Article 33(2) of Law 91 requires every organisation to designate a qualified unit or person, or to hire a data protection service provider, subject only to the Article 38 relief above. The appointment must be a formal written document setting out duties and powers, and the person must hold at least a college degree, have at least 2 years of relevant experience after graduation (legal, IT, cybersecurity, data security, risk, compliance or HR) and have been trained in personal data protection (Article 13 Decree 356). A regional DPO sitting in Singapore with no Vietnamese appointment document does not tick these boxes. Failing to issue the appointment, or appointing someone who does not meet the conditions, costs VND 20 to 30 million (Article 57(2) Decree 330). See what a DPO is under Vietnamese law.
Data subject requests run on fixed clocks. The controller must acknowledge a request within 2 working days and then act within 15 days for withdrawal of consent, restriction or objection, 10 days for access or correction, and 20 days for deletion, with longer periods where processors or third parties must act and one extension allowed (Article 5(2) to (4) Decree 356). A group procedure written around the GDPR's one-month response window needs a Vietnam annex. See data subject rights.
The sensitive data list needs a fresh look. Article 4(1) of Decree 356 includes, among others, images of identity cards, log-in credentials for electronic identification accounts, and data tracking behaviour and use of telecoms, social networks and other online services. Data maps prepared in 2023 should be re-classified against the current list, because sensitive data both removes the small-business relief and triggers specific notice duties. See sensitive personal data.
Fines are larger and revenue-based for transfers. The maximum fine for an organisation that breaches the cross-border transfer rules is 5% of its revenue for the preceding year; for most other breaches it is VND 3 billion (Article 8(4) and (5) Law 91; Article 7(4) Decree 330). For data protection breaches, the amounts in Decree 330 are the fines for organisations; an individual pays half (Article 7(1)).
Not every point of Decree 13 vs Law 91 is stricter; some changes cut the other way. Storing the personal data of a company's own employees on a cloud service no longer requires a cross-border transfer impact assessment (Article 20(6)(b) Law 91), and transfers for cross-border HR management under the company's labour rules and collective agreement are also exempt (Article 17(3)(d) Decree 356). Many FDI groups filed a Decree 13 transfer dossier precisely for HR data sent to the parent. The dossier remains on file; whether it still has to be updated for flows that are now exempt is not addressed in the texts, so treat that as a point to confirm with A05 rather than a reason to stop updating.
Is Decree 13/2023 still in effect for past breaches?#
Decree 13 itself contained no fines. Decree 330 applies from 19 August 2026. For a breach committed before that date and discovered or handled later, the penalty decree in force at the time of the breach applies, unless Decree 330 imposes no liability or a lighter one, in which case Decree 330 applies (Article 81(1)). Article 81 does not deal expressly with a failure that continues past 19 August 2026, such as a dossier that should have been filed and still has not been. In our reading, a company in that position should assume the Decree 330 amounts apply to the ongoing failure and close the gap rather than rely on the transition clause.
A worked example: a 2023 programme reviewed in 2026#
A Korean-owned electronics manufacturer in Bac Ninh employs 3,000 people. In November 2023 it filed a DPIA and an overseas transfer dossier with A05 covering payroll and HR data sent to its Seoul parent, and A05 acknowledged receipt. Consent clauses sit in its 2023 employment contracts. In 2026 it moved HR records to a group HRIS hosted in Singapore and launched a customer warranty app in Vietnam.
- HR processing that started before 2026 continues on the 2023 consents (Article 39(1)). The company checks that it can produce a signed or logged consent for each employee.
- The 2023 dossiers remain valid (Article 39(2)). The new HRIS vendor is a new processor, so the DPIA is updated in the next 6-month window on Form 03a/03b (Article 20(1)(b) Decree 356). The cloud storage of employee data is itself exempt from a transfer assessment (Article 20(6)(b) Law 91).
- The warranty app is a new purpose and a new data set, so it needs consent that meets Article 6 of Decree 356 and is reflected in the DPIA update (Article 20(1)(a)).
- The DPO. Under Decree 13 the company had named its HR director informally. It now issues a formal appointment and confirms the training requirement in Article 13 Decree 356.
- Documents. The privacy notice, the employee handbook and the intra-group transfer agreement are re-based on Law 91 and Decree 356.
LexData's PDPL compliance consulting covers this kind of gap review of a Decree 13 programme. Where dossiers have to be prepared or updated, see DPIA and cross-border transfer dossiers; where the DPO role is the gap, see the outsourced DPO service.
