Vietnam built its privacy regime the way it builds internet regulation generally: through the security ministry. Decree 13 is administered not by a data protection authority but by the Ministry of Public Security’s cybersecurity department (A05), it demands standing filings rather than internal accountability records, and it treats consent as nearly the only lawful ground. For global programs, Vietnam is the jurisdiction where GDPR instincts mislead most: there is no legitimate interests to fall back on, and your processing and transfer inventories are not internal documents but dossiers sitting in a ministry’s registry.
| Instruments | Decree 13/2023/ND-CP (1 July 2023); PDP Law (1 January 2026) |
|---|---|
| Supervisor | MPS / A05 |
| Signature duties | Consent-first processing; 60-day impact and transfer dossiers |
| 2026 penalties | Up to 5% of revenue (transfers); 10x gains (data trading) |
| Government portal | MIC (English) |
Building Vietnam compliance
Consent architecture. Explicit, per-purpose, affirmative consent with proof of capture; separate consent for marketing and for sensitive-data processing, plus the required notification that sensitive data is involved. Withdrawal must be honored and cascaded to third parties. Pre-ticked boxes and bundled terms fail the decree’s express standards.
The two dossiers. Treat them as living registrations: an impact dossier covering all processing (file within 60 days of starting, update on changes) and a transfer dossier per cross-border arrangement. Contents parallel a GDPR ROPA-plus-DPIA, purposes, categories, recipients, safeguards, retention, but the audience is A05, which inspects, comments, and can suspend transfers. Multinationals commonly route filings through their Vietnamese entity or a local representative.
Rights and incidents. Data subjects can access, correct, delete, restrict, object, and withdraw; the decree expects response within 72 hours for several obligations, and personal data violations must be notified to A05 within 72 hours of occurrence. Damages claims and complaints run through general civil law.
2026 readiness. The PDP Law converts today’s soft-sanction environment (administrative decrees with modest fixed fines) into revenue-scaled liability. If your Vietnam posture has been filing-light, close the gap before January 2026: the dossier registry gives A05 a ready-made enforcement queue.
Vietnam’s consent absolutism and security-ministry supervision place it nearest to China’s PIPL in the regional spectrum, far from Singapore’s exception-rich PDPA. Map what your Vietnam-facing properties collect and transmit with a free scan.