Search for:

In brief

The long-awaited Decree on Personal Data Protection (PDPD) has finally been issued as Decree No. 13/2023/ND-CP last night.

In more detail

Mirroring the EU’s General Data Protection Regulation in different aspects, the PDPD introduces various new requirements to any organizations/individuals engaging in and/ or related to personal data processing activities in Vietnam.

Notable provisions under the PDPD include:

  • Extra-territorial scope of application – the PDPD will apply to both local and offshore entities directly engaging in and/or related to personal data processing activities in Vietnam
  • Extended categories of regulated subjects – as hinted under the draft Cybersecurity Administrative Sanctions Decree, the PDPD recognizes the concepts of “data controller” and “data processor”. It also introduces the concept of “data controlling and processing entity”
  • Broad definition of personal data and data processing – similar to the public draft version of the PDPD, the final issued version classifies personal data into two groups of “basic personal data” and “sensitive personal data”. In which, the list of sensitive personal data is very broad and non-exhaustive
  • New requirements for a valid consent, sensitive personal data processing, and cross-border data transfer. No specific data localization requirement was introduced
  • Obligation to apply different managerial and technical measures to protect personal data, including personal data protection impact assessment
  • Strict time limit to comply with a data subject’s request

The PDPD will come into effect on 01 July 2023.

A grace period of 2 years, however, only applies to small-and-medium sized enterprises.


Hung Tran is the practice group leader of the Intellectual Property (IP) and Technology Practice Groups of Vietnam offices. For years, he has been constantly ranked as a leading IP lawyer by numerous researchers such as Chambers Global and Chambers Asia.
He regularly writes articles concerning pressing legal issues in both English and Vietnamese, and his works have been published regularly in various reputable publications. He has assisted the government in reviewing and revising the IP Law, the IP provisions under the country’s criminal code, the draft e-Transaction Law, and the first draft Personal Data Protection Decree, etc.
He is also a respected presenter in the area of IP, Franchising, Data Privacy, and Entertainment Laws. In addition to authoring many publications, Mr. Tran has lectured at Waseda University School of Law (Japan), Vietnam-German University, Hanoi Law University, Diplomatic Academy of Vietnam, Foreign Trade University, an international MBA Program (CFVG) and IP laws for the Professional Training School of the Ministry of Industry and Trade. He used to serve as the Chairman of the Legal Committee of Hanoi American Chamber of Commerce.


Huu Tuan Nguyen is a Senior Associate in BMVN International LLC, Ho Chi Minh City office.


Huyen Minh Nguyen is a Senior Associate in BMVN International LLC, Hanoi office.

Write A Comment