Decree 13/2023 on personal data protection was Vietnam’s first comprehensive rulebook for personal data. Issued on 17 April 2023 and in force from 1 July 2023, it set out, for the first time in one document, what counts as personal data, when a business needs a customer’s consent, what rights people have over their own information, and what happens when data crosses borders. If you run a shop, a website, an app, or any service that collects names, phone numbers, or addresses, this decree shaped the rules you work under. One important update first: the National Assembly passed the Law on Personal Data Protection, Law No. 91/2025/QH15, on 26 June 2025, and that law repealed Decree 13 when it took effect on 1 January 2026. This article explains what Decree 13 introduced — the concepts and habits that still underpin the new law — and where the rules have moved on.
What counts as personal data
Under Decree 13, personal data means information in electronic form — symbols, letters, numbers, images, sounds, or similar formats — that is associated with a specific person or can identify one. The decree divides it into two groups. Basic personal data includes a person’s full name, date of birth, gender, place of birth and residence, nationality, image, phone number, identity card number, marital status, family relationships, and digital account details. Sensitive personal data is the category that could harm a person’s legitimate rights and interests if mishandled: health information, political and religious views, biometric data such as fingerprints and facial scans, criminal records, bank account details, and location data, among others.
The distinction matters because sensitive data carries stricter requirements. For an ordinary online shop, the practical takeaway is simple: collect only the data you actually need, and be extra careful with anything that reveals health, finances, or identity documents. A delivery address and a phone number are part of doing business; a scan of a customer’s identity card is not, unless a specific rule requires it.
Consent is the default rule
Decree 13 takes a consent-based approach: processing someone’s personal data requires their consent, unless a specific exception applies — for example, protecting life and health, or a requirement of national security. Consent must be given freely, clearly, and for a stated purpose. A pre-ticked box or a vague line buried in terms and conditions does not meet that standard. People must be told what data is collected, why, who will receive it, and how long it will be kept.
That leads to a practical habit: write a short, plain-language privacy notice and show it where data is collected — on the signup form, at checkout, in the app. It needs to answer four questions: what do you collect, why, who else sees it, and how can a customer ask you to delete it? The decree also gives people eleven rights over their data, including the right to know, to access, to correct, to delete, and to withdraw consent.
What businesses must actually do
Decree 13 assigns responsibilities according to role. A data controller decides the purposes and means of processing — for most small businesses, that is the business itself. A data processor handles data on behalf of a controller under an agreement, such as a cloud provider or a marketing agency. Both must put technical and organisational measures in place to protect the data, use it only for the purposes declared, and notify the authorities promptly when a violation occurs. The specialised agency for personal data protection sits under the Ministry of Public Security, in the Department of Cybersecurity and Hi-tech Crime Prevention.
Two obligations catch many small businesses by surprise. The first is the impact assessment for cross-border transfers: sending personal data of Vietnamese citizens abroad requires an assessment filed with the authorities, with details of the transfer, the recipient, and the protections in place. That matters for any business using overseas cloud services or analytics tools. The second is the appointment of a data protection officer or department — but here the decree gave small and medium-sized enterprises and start-ups a two-year grace period, recognising that a small shop cannot build a compliance department overnight. For most small businesses, the realistic starting point is not a new hire but a named person responsible for data, a list of what data the business holds and where, and a routine for handling customer requests.
From decree to law: what changed in 2026
Because Decree 13 was a government decree rather than a law passed by the National Assembly, it had limits — notably on penalties. The National Assembly addressed that on 26 June 2025 by passing the Law on Personal Data Protection, Law No. 91/2025/QH15, which took effect on 1 January 2026 and formally repealed Decree 13. The implementing decree, Decree 356/2025/ND-CP, was issued on 31 December 2025. The new law builds on the same foundations — the same definitions of basic and sensitive data, the same consent principle, the same set of data subject rights — but gives the framework the stability of a statute and ties penalties to a percentage of annual revenue.
For a business, the message is continuity, not upheaval: the habits Decree 13 introduced — collect less, explain clearly, get consent, protect what you hold, delete what you no longer need — are exactly what the new law expects. If you built those habits under the decree, you are already most of the way there. The change to watch is enforcement: revenue-based fines raise the cost of getting it wrong, so the time to tidy up data practices is now.
Data protection connects directly to the rest of Vietnam’s digital rules. The same customer data that Decree 13 protected is the data that Decree 147/2024 requires online platforms to handle carefully, and it is the data behind the verified accounts in Decree 320/2026 on VNeID linkage. Estonia’s experience, described in our article on Estonia’s once-only principle and X-Road, shows how one country built data protection into the design of its digital government rather than bolting it on afterwards — a useful reference point as Vietnam’s framework matures.
What this means
Decree 13/2023 gave Vietnam its first complete set of personal data rules: clear definitions, consent as the default, eleven rights for individuals, and real obligations for the businesses that hold their data. It has now been replaced by the Law on Personal Data Protection, which took effect on 1 January 2026, but the practical duties are unchanged. For any business, the checklist is short: collect only what you need, tell customers plainly what you do with it, get their consent, keep it safe, and delete it when you are done. Do those five things well and you will be in good shape under either the decree or the law that followed it.