← Global Privacy Laws Research Library
Nghị định 13/2023/NĐ-CP
Decree No. 13/2023/ND-CP on Personal Data Protection: Vietnam
Prepared by Shubhank Suman · Last reviewed
Historical / superseded from 1 January 2026
- Legal character
- Government decree
- Region
- Asia-Pacific
- Issued
- 17 April 2023
- Effective
- 1 July 2023
What it covers
Decree 13/2023 was Vietnam's dedicated personal-data decree and established detailed rules concerning:
- personal-data categories
- principles
- consent
- processing
- data-subject rights
- controllers/processors
- sensitive data
- impact assessments
- cross-border transfer
- security
- breach-related responsibilities
- organisational responsibilities.
The official Vietnamese legal database records its original effective date as 1 July 2023 (Vbpl)
Why it matters
It remains extremely important for historical and transition research because it was Vietnam's principal comprehensive personal-data instrument before the 2026 statutory framework.
But it should no longer be displayed as the current operative decree.
Refer to it when
- Studying Vietnam's pre-2026 privacy regime
- comparing Decree 13 with Decree 356
- researching historical compliance
- analysing Vietnam's transition from decree-based privacy law to statute-based regulation
- understanding legacy policies/contracts created under the 2023 framework.
AI, privacy and cybersecurity relevance
- AI: High
- Privacy: Very High
- Cyber: High
AI
High / historical.
The decree did not constitute an AI Act.
However, AI systems processing Vietnamese personal data could be subject to its data-governance requirements during the period in which it was operative.
Cybersecurity
High.
The decree was closely connected with Vietnam's existing cybersecurity and information-security legislation.
Applicability
Historical applicability to organisations and individuals involved in personal-data processing within the decree's framework.
Current validity
SUPERSEDED FROM 1 JANUARY 2026.
Read first
Scope → data categories → consent → rights → processing responsibilities → DPIA → security → cross-border transfer → Article 43 → Decree 356 replacement history.
Provisions / sections covered
The decree contains provisions concerning:
- scope and definitions
- basic/sensitive personal data
- processing principles
- consent
- data-subject rights
- controller/processor responsibilities
- impact assessments
- cross-border transfer
- security measures
- breach-related responsibilities
- implementation.
It was structured into four chapters and 44 articles, with appendices. The official text contains detailed processing obligations and Article 43 established the original 1 July 2023 effective date (Vbpl)
CURRENT STATUS: IMPORTANT CORRECTION
Vietnam enacted:
Law No. 91/2025/QH15 on Personal Data Protection, effective 1 January 2026 (Vanban Chinhphu)
It then adopted:
Decree No. 356/2025/NĐ-CP, effective 1 January 2026 (Vanban Chinhphu)
Article 42(2) of Decree 356 expressly states that Decree 13/2023 \*\*ceases to have effect from the date Decree 356 enters into force (THƯ VIỆN PHÁP LUẬT)
Therefore:
Decree 13/2023 = HISTORICAL / SUPERSEDED
not current law.
The fact that some Vietnamese government databases still display the 2023 instrument as "in force" on individual historical pages should not override the later Decree 356's express repeal/cessation clause. For PrivacyLawHub, the current legal-status field should reflect the newer instrument (Vbpl)
CURRENT REPLACEMENTS
Cross-link directly to:
Law No. 91/2025/QH15
and
Decree No. 356/2025/NĐ-CP
with the old decree retained as a historical version (Vanban Chinhphu)
Subject-matter tags
- Consent
- Sensitive data
- Data subject rights
- Impact assessment
- Security
- Cross-border transfers
- Data protection officer
- Controller and processor
- Retention
- Transparency
- AI cybersecurity
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.