- Full title: Decree on personal data protection
- Issued by: the Government, 17 April 2023
- In force: 1 July 2023 to 31 December 2025
- Status: no longer in force from 1 January 2026. Replaced by Decree 356/2025/ND-CP.
Archive page. This is a summary of the main provisions of Decree 13/2023/ND-CP, not the full text (the original has 4 chapters, 44 articles and 4 appendices). It is kept for historical reference. For current obligations, see Decree 356/2025/ND-CP and Law No. 91/2025/QH15.
Legal basis
The 2015 Civil Code, the 2004 Law on National Security, the 2018 Law on Cybersecurity and the 2015 Law on Government Organisation (as amended in 2019).
Chapter I: General provisions
Article 1. Scope
The Decree governed personal data protection and the responsibilities of the agencies, organisations and individuals involved. It applied to Vietnamese agencies, organisations and individuals, foreign ones in Vietnam, Vietnamese ones operating abroad, and foreign ones directly involved in processing personal data in Vietnam.
Article 2. Definitions
Personal data meant information in the form of symbols, text, numbers, images, sounds or similar in the electronic environment that is linked to, or helps identify, a specific person. It was divided into:
- basic personal data: name, date of birth, gender, residence, nationality, photo, identification number, phone number, accounts and data on online activity, among others;
- sensitive personal data: political and religious views, health, racial or ethnic origin, inherited or acquired genetic characteristics, sex life, criminal records, customer information of credit institutions, location data, among others.
The Decree also defined data subject, processing, controller, processor, controller-processor and third party.
Article 3. Principles
Processing had to be lawful and transparent to the data subject, limited to the registered or stated purpose, and adequate for that purpose. Personal data could not be bought or sold in any form unless the law provided otherwise. Data had to be kept up to date, secured and retained only as long as needed. The parties had to comply and be able to demonstrate compliance.
Articles 4 and 5. Accountability and violations
Controllers, controller-processors and processors had to be able to show the data subject and the authorities that they complied. Violations could lead to disciplinary action, administrative penalties or criminal prosecution.
Chapter II: Protection during processing
Article 8. Prohibited acts
Processing personal data unlawfully; processing it to produce information against the State or harmful to national security, public order or other people’s rights; obstructing the authorities’ data protection work; and exploiting data protection activities to break the law.
Article 9. Data subject rights
Eleven rights: to be informed, to consent, to access (view and correct), to withdraw consent, to delete data, to restrict processing, to obtain data, to object to processing (including disclosure or use for advertising and marketing), to complain, denounce or sue, to claim damages, and to self-protection.
Article 11. Consent
Consent was valid only if voluntary and informed about the type of data, purpose, the parties processing it, and the data subject’s rights and obligations. It had to be clear and affirmative (opt-in), in a format that could be printed or copied in writing, including electronically or in another verifiable format. Silence or no response was not consent. Consent could be partial or conditional.
Article 13. Processing notice
Notice had to be given once, before processing started. It covered the purpose, types of data, method of processing, the parties involved, possible risks, and the start and end of processing.
Article 20. Children’s data
Children’s data had to be processed in their best interests, with the consent of children aged 7 or over and of their parent or guardian.
Chapter III: Contracts and overseas transfers
Article 23. Breach notification
On detecting a violation (such as a leak or loss of data), the parties had to notify the Ministry of Public Security (A05 Department) within 72 hours of detection, using Form 03. The exception was a violation fully dealt with before the deadline that caused no harm to data subjects. A processor had to notify the controller as soon as possible.
Article 24. Processing impact assessment
Controllers and controller-processors had to prepare an impact assessment dossier from the start of processing and send it to the Ministry of Public Security (A05 Department) within 60 days of starting to process.
Article 25. Overseas transfer impact assessment
Vietnamese citizens’ personal data could be transferred abroad once the transferor had prepared an overseas transfer impact assessment dossier and completed the procedures. The dossier had to be available for inspection by the Ministry of Public Security. The A05 procedures from the Decree 13 era were abolished and replaced by those announced in Decision 778/QD-BCA-A05.
Data protection department and staff
Decree 13/2023 had no separate article on appointing a DPO. The duty to designate a data protection department and staff (and to share information with the specialised authority) was one of the measures for sensitive personal data (Clause 2, Article 28). Data protection forces were covered in Article 30. Micro, small and medium-sized enterprises and start-ups could opt out for the first 2 years under Article 43, unless they processed sensitive data.
Chapter IV: Implementation
Article 43. Entry into force
- The Decree took effect on 1 July 2023.
- Micro, small and medium-sized enterprises and start-ups could choose not to designate data protection staff or prepare the impact assessment dossier for 2 years from that date, unless they processed sensitive data.
LexData note (not part of the original text): Decree 13/2023/ND-CP ceased to have effect on 1 January 2026 under Clause 2, Article 42 of Decree 356/2025/ND-CP, which implements Personal Data Protection Law No. 91/2025/QH15. Under the transitional rules in Article 39 of the Law, processing already under way with consent or an agreement under Decree 13 may continue without new consent, and impact assessment and overseas transfer dossiers that the authority received before 1 January 2026 remain in use; later updates follow the Law.
Article 44. Responsibility for implementation
Ministers, heads of ministerial-level and government agencies, chairpersons of provincial People’s Committees and the agencies, organisations and individuals concerned were responsible for implementing the Decree.
