Personal data privacy compliance in Vietnam

Vietnam’s Decree 13/2023/ND-CP on Personal Data Protection, effective from 1 July 2023, establishes comprehensive requirements for personal data processing. Organisations must obtain prior consent from individuals and adhere to established principles and reporting obligations.

However, with the enactment of the Personal Data Protection Law (PDPL), which will take effect from 1 January 2026, Decree 13 will be replaced by a more robust and enforceable legal framework. The PDPL expands on Decree 13’s foundations and introduces stricter compliance requirements, broader scope, and heavier penalties for violations.

While both Decree 13 and the PDPL share similarities with the EU’s GDPR, compliance with GDPR does not automatically ensure compliance with Vietnam’s regulations. The PDPL mandates localised processes, sector-specific obligations, and impact assessments that align with Vietnam’s legal context, including fulfilling reporting obligations with local authorities.

Organisations without data privacy measures must establish proper policies, mechanisms, and fulfil reporting requirements. Those already following the EU’s GDPR or other foreign data privacy regimes must review and align their practices with Vietnam’s evolving requirements and complete all necessary compliance steps under the PDPL.

Comprehensive solutions for data protection

• Reporting support

  Assistance with preparing and submitting mandatory reports, including the Data Processing Impact Assessment (DPIA) and the Overseas Data Transfer Impact Assessment (TIA), to Vietnamese authorities within the required timeframes.

• Personal data privacy advisory

  Expert guidance on Vietnamese PDP laws and customised recommendations for your organisation’s specific needs.

• Standard policy and template package

  Comprehensive set of ready-to-use policies and templates that meet Decree 13 requirements.

• Contract template and documentation review

  Assessment of existing contracts and documents to ensure compliance with Vietnamese data protection standards.