- Full title: Decree detailing a number of articles of, and measures to implement, the Law on Personal Data Protection
- Issued by: the Government, 31 December 2025
- In force from: 1 January 2026
- Structure: 5 chapters, 42 articles and 13 forms
- Replaces: Decree 13/2023/ND-CP
- Official Vietnamese text: Government e-portal · Official Gazette PDF
Note: this page summarises the main rules. It is not the full text of the Decree, and the forms are not reproduced.
Legal basis and scope
The Decree is issued under the Law on Government Organisation No. 63/2025/QH15, Law No. 91/2025/QH15 on Personal Data Protection, the Law on Data No. 60/2024/QH15 and Law No. 90/2025/QH15 (amending the laws on bidding, public-private partnership investment, customs, value added tax, import and export duties, investment, public investment and public property).
It details Articles 2, 4, 6, 9, 17, 20, 21, 22, 23, 27, 30, 31, 33, 35 and 38 of the Law. It also sets out implementing measures: research into data protection solutions, the specialised data protection authority, the National Personal Data Protection Portal, the responsibilities of ministries and localities, and funding.
Basic and sensitive personal data (Articles 3 and 4)
- Article 3 lists basic personal data in 11 groups.
- Article 4 lists sensitive personal data in 12 groups:
- racial or ethnic origin;
- political and religious views and beliefs;
- private life, personal and family secrets;
- health;
- biometric and genetic data;
- sex life and sexual orientation;
- data on crimes and violations of law collected and stored by law enforcement agencies;
- location data from location services;
- usernames and passwords for electronic identification accounts, and images of ID cards (including citizen ID and old identity cards);
- bank account usernames and passwords, card details and transaction history, and customers’ financial, credit, securities and insurance information held by credit institutions, foreign bank branches, payment intermediaries, securities and insurance firms and other licensed organisations;
- data tracking a person’s use of telecoms, social networks, online media and other online services;
- other data that the law requires to be kept confidential or strictly secured.
Access to sensitive data must be restricted (Clause 2, Article 4), and sensitive data needs its own protective measures. See sensitive personal data and basic personal data.
Data subject requests (Article 5)
Controllers and controller-processors must have clear procedures and forms for receiving requests. They must reply within 2 working days, then complete the request within these deadlines:
| Request | Deadline | If a processor or third party is involved |
|---|---|---|
| Withdraw consent, restrict or object to processing | 15 days | 20 days |
| View, correct or obtain personal data | 10 days | 15 days |
| Delete personal data | 20 days | 30 days |
| Take measures to protect the data | 15 days | — |
The deadline may be extended once, by up to 15 days (withdrawal, restriction, objection, protective measures), 10 days (viewing, correcting, obtaining data) or 20 days (deletion). The controller must tell the data subject why, and must be able to show that the extension was necessary (Clauses 2–5). See data subject rights.
Data processing impact assessment (DPIA)
- Contents: an impact assessment report on Form 10, with copies of data processing contracts and agreements and the related policies, procedures, rules and forms. It is filed with Form 02a/02b.
- Deadline: sent to the specialised authority (the A05 Department) within 60 days of starting to process personal data (Clause 1, Article 21 of the Law; Clause 4, Article 19 of the Decree). The authority says within 15 days whether the dossier passes. If it is incomplete or incorrect, the authority requires it to be completed within 30 days (Clauses 5 and 6, Article 19). Filing the DPIA dossier is one of the A05 procedures announced in Decision 778/QD-BCA-A05.
- Updates: every 6 months from the first filing when there is a new purpose or a change in the parties involved (Clause 1, Article 20). An update is needed within 10 days if the organisation is reorganised, stops operating, is dissolved or goes bankrupt, if the details of its data protection service provider change, or if a business line involving data processing changes (Clause 2, Article 20; Article 22 of the Law). Updates use Form 03a/03b and are filed online, in person or by post (Clause 3, Article 20).
See what is a DPIA.
Relief for small businesses (Article 41)
- Small enterprises and start-ups may choose not to perform the DPIA (Article 21 of the Law), the dossier updates (Article 22) and the designation of data protection staff (Clause 2, Article 33) for 5 years, from 1 January 2026 to 31 December 2030.
- Household businesses and micro-enterprises do not have to perform these obligations at all (Clause 2, Article 41).
- Neither relief applies to a business that provides personal data processing services, directly processes sensitive data, or processes the data of 100,000 or more data subjects (counted cumulatively across all personal data processed, from the time that scale is reached).
- The relief does not cover the cross-border transfer dossier (Article 20 of the Law) or any other data protection obligation. Medium-sized and large enterprises get no relief.
Cross-border transfers
Businesses must prepare a cross-border transfer impact assessment dossier on Form 09, which replaces Form 06 under Decree 13/2023/ND-CP. They must send one original, with Form 01a/01b, to the specialised authority within 60 days of the first transfer (Clause 2, Article 20 of the Law; Clause 4, Article 18 of the Decree). The authority gives its result within 15 days, and an incomplete or incorrect dossier must be completed within 30 days (Clauses 5 and 6, Article 18). The dossier is updated under Article 20 of the Decree, like the DPIA dossier. See cross-border data transfer.
Data protection department and staff (the DPO)
Clause 2, Article 33 of the Law lets an organisation either designate its own data protection department or staff, or hire a data protection service provider:
- Internal designation (Article 13): made by a written internal decision. The staff member must hold at least a college degree, have at least 2 years of relevant experience since graduating and have been trained in personal data protection (Clause 2, Article 13). There is no separate procedure for notifying the authority of the appointment.
- Hiring an individual (Article 15): the provider needs at least a college degree, at least 3 years of relevant experience and specialised training. The organisation checks their qualifications, signs a contract and publishes their details for data subjects.
- Hiring an organisation (Article 16): the provider needs at least 3 qualified staff (under Clause 2, Article 15) and a capability profile. The organisation reviews the profile, signs a service contract with a data processing agreement, and publishes the provider’s details for data subjects. An organisation may both designate its own staff and hire a provider (Clause 4, Article 16).
See what is a DPO.
Breach notification
- Notifiable breaches are reported on Form 08 within 72 hours of detection (Article 23 of the Law). The content of the notice is set out in Article 28 of the Decree.
- For breaches involving location or biometric data, Article 29 requires notifying the affected data subjects within 72 hours. If that is not possible for technical or urgent reasons, the organisation must post a public notice on its website or app and notify individuals as soon as it can. Breach records are kept for at least 5 years after the breach is resolved.
- In finance, banking and credit information, a leak or loss of sensitive data must be notified to both the specialised authority and the data subjects within 72 hours (Clause 3, Article 8). Sector context: data protection in banking in Vietnam.
See the 72-hour rule.
Implementation (Article 42)
- In force from 1 January 2026. Decree 13/2023/ND-CP of 17 April 2023 ceases to have effect from the same date.
- It amends Clause 2, Article 16 of Decree 165/2025/ND-CP (implementing the Law on Data). When core or important data that is also personal data is transferred or processed across borders, the data owner prepares the dossier under the personal data protection rules. It does not also need the risk and impact assessment required by Decree 165/2025/ND-CP.
- The Ministry of Public Security guides, inspects and oversees implementation.
