CevroVietnam: Personal Data Protection Law / Decree 13/2023 and what it requires
Personal Data Protection Law / Decree 13/2023: a law that is enacted or being phased in, with enforcement practice still maturing. Overseen by Ministry of Public Security.
Key requirements at a glance
| Registration with the regulator | Not required |
|---|---|
| Data protection officer | Not required |
| Breach notification | No fixed hourly deadline in our reference |
| Cross-border transfer restrictions | Required |
| Data localization | Depends on thresholds or circumstances |
Penalties and enforcement
Administrative penalties under the Decree; the regime is strengthening.
What to know in practice
Localization requirements apply to certain categories of data.
How Cevro helps
- Maps Personal Data Protection Law / Decree 13/2023 to the rest of your compliance program, so evidence collected for SOC 2 or ISO 27001 also counts here where it overlaps.
- Gives every failing control a specific fix and a way to re-check it.
Frequently asked questions
Who regulates data protection in Vietnam?
Ministry of Public Security oversees Personal Data Protection Law / Decree 13/2023.
Is breach notification mandatory under Personal Data Protection Law / Decree 13/2023?
Our reference does not record a fixed hourly deadline for Personal Data Protection Law / Decree 13/2023. Check the statute and Ministry of Public Security guidance for the notification timing that applies to you.
Does Vietnam restrict cross-border data transfers?
Yes. Moving personal data out of Vietnam is restricted, so confirm a lawful transfer basis before data leaves the jurisdiction.
Do you need a data protection officer under Personal Data Protection Law / Decree 13/2023?
It is not a general requirement in our reference, though naming an accountable person is still good practice.
What are the penalties for non-compliance in Vietnam?
Administrative penalties under the Decree; the regime is strengthening.