Editorial · April 25, 2023
Personal Data Decree 13: What Vietnam Businesses Must Do
Personal data decree 13 is a Vietnamese Government rule built only for personal data protection, and it starts on 1 July 2023. The Government issued it on 17 April 2023 as Decree 13/2023/ND-CP. It covers businesses that handle the personal data of people in Vietnam. This guide lists what most companies need to do before the start date.
What the decree is and when it starts
The decree is dated Hanoi, 17 April 2023. Article 43 says it takes effect on 1 July 2023. That gives businesses about ten weeks from today.
It sets one set of rules for collecting, storing, using, sharing and deleting personal data. Before this, the rules sat in many separate laws. A company that holds customer lists, staff files or online sign-ups is likely in scope.
Know your data: basic and sensitive
The decree splits personal data into two groups. Basic data includes a name, date of birth, gender, address, nationality, image, phone number, ID number, marital status and account details. Sensitive data carries more risk, so it gets stricter care.
Article 2 lists sensitive data. It includes political and religious views, health records, race or ethnic origin, genetic data, sex life, bank customer information and location data from tracking services. A business that holds sensitive data must also name a unit and a person to handle data protection, under Article 28.
Start with a simple map. List what you collect, why you collect it, where it is kept and who can see it. You cannot protect data you have not listed.
Consent and notice come first
Article 11 says consent counts only when the person gives it freely and knows four things. They must be told what data will be used, the reason for using it, the party handling it, and the rights and duties that come with it.
Consent must be clear and specific. It can be in writing, by voice, or by ticking a box. Silence is not consent. The business must be able to prove it got consent.
Article 13 adds a notice. A business tells the person what its plan is before it starts processing. That notice covers the purpose, the data types, the method and the parties involved. It is given once, before processing begins.
Article 12 lets a person withdraw consent. The business must then stop processing and ask related parties to stop too. Check that your forms, apps and sign-up pages say these things in plain words.
Answer people's requests on time
Article 9 gives people eleven rights over their data. They include the right to know, to consent, to see their data, to withdraw consent, to delete it, to limit its use, to object, and to complain.
Some requests carry a clock. A request to limit processing must be carried out within 72 hours. A request to be given a copy of their data is also covered by a 72 hour window. Set up one inbox or form for these requests, and name who answers it.
Impact files, breach reports and transfers abroad
Article 24 asks a business to prepare and keep an impact assessment file from the time it starts processing. It must send one copy to the Ministry of Public Security within 60 days from the start of processing, using Form 04.
Article 23 covers breaches. If personal data is leaked or misused, the business reports it to the Ministry of Public Security within 72 hours, using Form 03. A later report must explain the delay. A processor working for you must tell you as fast as it can.
Article 25 covers sending Vietnamese citizens' data abroad. The sender prepares a transfer impact file and sends it to the Ministry within 60 days from the start of processing. Cloud storage and overseas software vendors are common cases to check.
A short checklist before 1 July
Small firms get one break. Under Article 43, micro, small and medium businesses and start-ups may skip naming a data protection unit and person for their first two years. That break does not apply to firms that directly make a business of processing personal data.
Use the weeks left on these steps.
- List the personal data you hold and mark what is sensitive.
- Rewrite consent wording so a customer knows the data, purpose, processor and rights.
- Add a notice that appears before you start processing.
- Name who handles access, delete and limit requests, and test the 72 hour clock.
- Prepare the impact assessment file, and a transfer file if data goes abroad.
- Write a short breach plan that can reach the Ministry within 72 hours.
This is general information only. For how Decree 13 applies to your own company, read the decree and ask a Vietnamese data protection lawyer.
Sources
- Government of Vietnam, Decree 13/2023/ND-CP on personal data protection, Hanoi, 17 April 2023 (Vietnamese text, copy archived by the Wayback Machine on 25 April 2023).
A place on this register is not for sale.