From Decree 13 to the Personal Data Protection Law: a 2026 checklist

Decree 13/2023/NĐ-CP, in force since 1 July 2023, introduced Vietnam's most comprehensive personal-data rules to date. From 1 January 2026, the Personal Data Protection Law (Law 91/2025/QH15) elevates that framework from a decree to a statute. Finance and HR teams hold exactly the data these rules protect — tax codes, ID numbers, salaries, bank accounts — so compliance is not optional.

Map your data

List every place personal data is collected, stored and shared — payroll files, accounting vouchers, insurance declarations, shared drives, outsourced processors. You cannot protect, or account for, what you have not mapped.

Get consent right

Vietnam takes a consent-centric approach: consent must be specific, informed, freely given and recorded in a verifiable form, and the law does not recognize a general "legitimate interest" basis the way the GDPR does. Generic check-boxes buried in a contract are not enough.

File your impact assessments

Organizations processing personal data must prepare a data-processing impact assessment (DPIA) dossier and submit it to the Ministry of Public Security within 60 days of starting processing; cross-border transfers require a separate transfer impact assessment (TIA) on the same 60-day clock. The 2026 law keeps these obligations and adds targeted exemptions — for example, storing employees' personal data on cloud services purely for internal use.

Lock down access

Limit who can see sensitive data, log access, and review those logs periodically. Payroll and tax files deserve the same access discipline as the bank account.

What to review in 2026

• Re-check consent language and privacy notices against the new law's wording.
• Confirm DPIA and TIA filings are up to date and reflect current processing.
• Update data-processing terms with payroll, accounting and IT vendors.
• Train the HR and accounting staff who touch personal data daily.

Our advisory team helps align HR and finance processes, documentation and vendor contracts with Decree 13 and the new law.