Update on Vietnam’s Personal Data Protection Law (PDPL) & Compliance Guidelines for Businesses

Effective Date and Significance

From July 1, 2023, Decree No. 13/2023/ND-CP on Personal Data Protection (PDPL) officially took effect, marking a major milestone in Vietnam’s legal framework on privacy and data rights.
This regulation has a broad impact on all organizations, businesses, and individuals involved in personal data processing — especially those with foreign elements or online operations.

Objectives and Scope

The PDPL aims to:

• Protect individual privacy in the digital environment.

• Enhance transparency in the collection, storage, use, and sharing of data.

• Align domestic regulations with international standards such as the EU’s GDPR.

The PDPL applies to:

• All organizations and businesses that process personal data of Vietnamese citizens.

• Foreign enterprises that operate in or provide services to users in Vietnam.

Definition and Classification of Personal Data

Personal data under the PDPL is divided into two categories:

• Basic personal data: full name, date of birth, gender, ID/Passport number, email, phone number, etc.

• Sensitive personal data: health, financial information, biometric data, location, political opinions, religion, and other private matters.

Processing sensitive data requires additional protective measures, such as encryption, access restrictions, and mandatory reporting to the relevant authorities.

Obligations of Businesses

Organizations handling personal data are required to:

1. Obtain clear and explicit consent from data subjects before collecting or sharing their information.

2. Disclose the purpose of processing in a transparent and understandable manner.

3. Store data only as long as necessary for the declared purposes.

4. Ensure data security through technical safeguards (encryption, firewalls, backups, etc.).

5. Appoint a Data Protection Officer (DPO) or designate a responsible department for data protection.

6. Notify and obtain approval from the Cybersecurity Department of the Ministry of Public Security (MPS) for cross-border data transfers.

Cross-Border Data Transfer

When transferring personal data outside Vietnam, organizations must:

• Notify the MPS Cybersecurity Department in advance.

• Maintain a copy of the data within Vietnam.

• Submit annual reports on the status of data protection and transfer compliance.

Violations may lead to suspension of data processing activities, administrative fines, or even criminal liability in serious cases.

Compliance Measures for Businesses

To comply with PDPL requirements, organizations should:

• Review existing data to identify what types of data are collected, their sources, and usage purposes.

• Develop internal privacy policies outlining processes for data handling, retention, and deletion.

• Train employees to raise awareness about data privacy and protection responsibilities.

• Establish a response mechanism for data subject requests (e.g., data deletion, correction, or access).

• Update contracts and agreements to include appropriate data protection clauses in line with the PDPL.

Benefits of PDPL Compliance

Complying with the PDPL not only helps avoid legal risks but also:

• Enhances corporate reputation by protecting customer privacy.

• Attracts investors and international partners through transparent governance standards.

• Reduces risks of data breaches and the associated costs of incident handling.

Conclusion

Vietnam is moving closer to international standards in personal data management.
Compliance with the PDPL is not merely a legal obligation, but a corporate social responsibility that reflects integrity and trustworthiness in the digital age.

At S Attorneys, we encourage businesses to begin their PDPL compliance assessment today and develop a long-term data governance strategy to ensure security and sustainability in the evolving digital landscape.

SEO Metadata (English version)

• Title: Vietnam PDPL 2023: Key Legal Updates & Compliance Guide for Businesses

• Description: Learn about Vietnam’s Personal Data Protection Law (PDPL 2023), its key requirements, and how businesses can ensure compliance with data privacy regulations.

• Focus Keywords: Vietnam PDPL, data privacy law Vietnam, PDPL compliance, Vietnam data protection