From Decree 13/2023 to the 2025 Personal Data Protection Law: What Businesses Must Do

Decree 13/2023/ND-CP on personal data protection ceased to have effect on 1 January 2026. It has been replaced by the Law on Personal Data Protection No. 91/2025/QH15, passed by the National Assembly on 26 June 2025, and its implementing Decree 356/2025/ND-CP, both in force from 1 January 2026. This article compares what businesses did under Decree 13 with the new requirements and sets out what to do now.

Why the move from a decree to a law matters

Decree 13/2023 (in force 1 July 2023) was Vietnam's first comprehensive set of personal data rules, but as a government decree it could not impose high penalties and left enforcement to other instruments. Law 91/2025 (5 chapters, 39 articles) raises the framework to statutory level: it keeps most Decree 13 concepts, adds revenue-based fines, expressly prohibits trading in personal data, introduces sector-specific rules and provides exemptions for small businesses. Documents prepared under Decree 13 do not simply lapse, but they must be reviewed against the new law.

What stays the same

• Two categories of data: basic personal data (name, date of birth, phone number, identification number…) and sensitive personal data (health, biometrics, financial information, location, sex life, political and religious views…), with stricter protection for the latter.
• Consent as the main legal basis, alongside the cases where processing is allowed without consent (performing a contract with the data subject, legal obligations, emergencies threatening life or health, and others set by law).
• Data subject rights: to be informed, to consent or withdraw consent, to access, correct, request deletion, restrict processing, object, complain and claim compensation.
• Two impact assessment dossiers: a personal data processing impact assessment and a cross-border transfer impact assessment, filed with the specialised personal data protection authority under the Ministry of Public Security.
• Breach notification: the data controller must notify the specialised authority within 72 hours of detecting a violation of personal data.

What is new

• Stricter consent. Consent must be voluntary, clear, verifiable and specific to each purpose. Silence or non-response is not consent; pre-ticked boxes and "accept all" clauses bundling several purposes should be removed.
• A ban on buying and selling personal data. Trading in personal data is a prohibited act. Business models built on purchased lead lists or paid data sharing with partners need to be re-examined.
• Revenue-based fines. The maximum administrative fine for trading in personal data is ten times the revenue obtained from the violation; for breaches of the cross-border transfer rules, 5% of the preceding year's revenue; where there is no such revenue or the percentage-based amount is lower, the cap is VND 3 billion. Other violations carry a maximum of VND 3 billion for organisations, with individuals fined half the organisational level. Serious cases may lead to criminal liability.
• Sector-specific rules for data of children and persons lacking legal capacity, recruitment and employment, health, insurance, finance and banking, advertising, social networks, big data and artificial intelligence, biometrics, and audio-visual recording in public places.
• Deadlines for answering data subjects are set out in Decree 356/2025, which requires prompt acknowledgement of requests and completion within time frames depending on the type of request — a documented internal procedure is now needed.
• Data protection personnel or a data protection unit must be designated and meet the qualification and experience criteria set by Decree 356/2025; this function may be outsourced to a data protection service provider.
• Data processing services (analytics, storage, outsourced processing) become an activity subject to conditions under the new rules.

Relief for small businesses

Decree 13 had no such mechanism. Under Law 91/2025, household businesses and micro-enterprises are exempt from preparing impact assessment dossiers and designating data protection personnel, while small enterprises and start-ups may choose whether to apply these obligations for five years from 1 January 2026. The relief does not apply to businesses providing data processing services, directly processing sensitive personal data, or processing the data of a large number of data subjects. The exemption concerns paperwork, not substance: processing principles, consent, data subject rights and the ban on trading data apply to every business.

What businesses should do now

1. Map your data: what you collect, through which channels (website, app, call centre, recruitment, CCTV), where it is stored, who can access it, and whether it leaves Vietnam (cloud servers, parent-company systems, foreign software vendors).
2. Fix consent mechanics: separate each purpose (service delivery, marketing, sharing with partners), remove pre-ticked boxes, keep evidence of consent and make withdrawal easy.
3. Update impact assessments prepared under Decree 13 to the forms and legal basis of Law 91/2025 and Decree 356/2025, and update them when purposes, data types or recipients change.
4. Review contracts with processors and overseas recipients: scope of processing, security measures, incident notification and deletion on termination.
5. Designate responsible staff and set up procedures for data subject requests and for 72-hour incident handling.
6. Train staff in sales, customer service and HR — the people who handle personal data daily and most often breach the rules inadvertently.

In practice, the hardest part is not drafting a privacy policy but knowing where the data actually flows. Companies relying on foreign SaaS tools (CRM, email marketing, timekeeping) are often already transferring data abroad without a cross-border transfer impact assessment in place.

Quick Q&A

Is Decree 13/2023 still in force?

No. Decree 13/2023/ND-CP ceased to have effect on 1 January 2026; personal data protection is now governed by Law No. 91/2025/QH15 and Decree 356/2025/ND-CP.

Do impact assessments filed under Decree 13 have to be redone?

Not from scratch, but they should be reviewed and updated to the forms and legal basis of Law 91/2025 and Decree 356/2025, especially when purposes, data types or recipients change.

What are the maximum fines?

Trading in personal data: up to ten times the revenue obtained; cross-border transfer violations: up to 5% of the preceding year's revenue; other violations: up to VND 3 billion for organisations.

Are small businesses exempt?

Household businesses and micro-enterprises are exempt from impact assessments and designating data protection staff; small enterprises and start-ups may opt out for five years from 1 January 2026, unless they provide data processing services or process sensitive data or data of a large number of people.