Decree 356/2025/NĐ-CP – guiding the Personal Data Protection Law

Pursuant to the Law on Organization of the Government No. 63/2025/QH15;

Pursuant to the Personal Data Protection Law No. 91/2025/QH15;

Pursuant to the Digital Data Law No. 60/2024/QH15;

Pursuant to the Law amending and supplementing a number of articles of the Law on Bidding, the Law on Investment according to the public-private partnership method, the Law on Customs, the Law on Value Added Tax, the Law on Export and Import Taxes, the Law on Investment, the Law on Public Investment, and the Law on Management and Use of Public Assets No. 90/2025/QH15;

At the proposal of the Minister of Public Security;

The Government issues a Decree detailing a number of articles and measures to implement the Law on Personal Data Protection.

Chapter I. GENERAL PROVISIONS

Article 1. Scope of regulation

This decree details Clause 2, Clause 3 of Article 2; Clause 5 of Article 4; Clause 3 of Article 6; Clause 5 of Article 9; Clause 3 of Article 17; Clause 7 of Article 20; Clause 7 of Article 21; Clause 4 of Article 22; Clause 5 of Article 23; Clause 3 of Article 27; Clause 6 of Article 30; Point b, Clause 4 of Article 31; Clause 3 of Article 33; Article 35; Clause 4 of Article 38 of the Personal Data Protection Law and stipulates measures for organizations to implement the Law on research, development of personal data protection solutions, specialized personal data protection agencies, the National Portal on Personal Data Protection; the responsibilities of ministries, sectors, and localities in personal data protection; funding to ensure personal data protection activities.

Article 2. Subjects of application

1. Vietnamese agencies, organizations, and individuals;

2. Foreign agencies, organizations, and individuals in Vietnam;

3. Foreign agencies, organizations, or individuals directly involved in or related to the personal data processing activities of Vietnamese citizens and persons of Vietnamese origin whose nationality has not been determined and who are living in Vietnam, have been issued a citizen identification card.

Article 3. List of basic personal data

Basic personal data includes:

1. Surname, middle name, and given name at birth, other names (if any);

2. Date of birth; date of death or disappearance;

3. Gender;

4. Place of birth, place of birth registration, place of permanent residence registration, place of temporary residence registration, current residence, hometown, contact address;

5. Nationality;

6. Image of the individual;

7. Phone number, personal identification number, passport number, driving license number, vehicle registration number;

8. Marital status;

9. Information about family relationships (parents, children, spouse);

10. Information about the individual's account number;

11. Other information associated with a specific person or that helps identify a specific person not included in the provisions of Article 4 of this Decree.

Article 4. List of sensitive personal data

1. Sensitive personal data includes:

a) Data revealing racial origin, ethnic origin;

b) Political, religious, or belief viewpoints;

c) Information about private life, personal secrets, family secrets;

d) Health status;

đ) Biometric data, genetic characteristics;

e) Data revealing an individual's sexual life, sexual orientation;

g) Data on crimes, legal violations collected and stored by law enforcement agencies;

h) Individual location determined through location services;

i) Information on username and password for accessing the individual's electronic identification account; images of identity card, citizen identification card, personal identification card;

k) Login names, access passwords of bank accounts; bank card information, data on transaction history of bank accounts; financial, credit information and information on customer activity, financial, securities, insurance transaction history at credit institutions, foreign bank branches, payment intermediary service providers, securities, insurance, and other permitted organizations;

l) Data tracking behavior, use of telecommunications services, social networks, online media services, and other services in cyberspace;

m) Other personal data that is required by law to be kept confidential or to have strict security measures.

2. In the process of handling sensitive personal data, agencies and organizations must establish regulations on access limitation, processing procedures, and security measures.

Chapter II. REQUIREMENTS AND CONDITIONS FOR THE PROTECTION OF PERSONAL DATA

Article 5. Exercise of the rights of the personal data subject

1. The personal data controller, and the personal data controller and processor must establish clear processes, procedures, and forms to exercise the rights of the personal data subject in accordance with personal data processing activities and the responsibilities of the relevant departments; ensuring that the personal data subject is informed about

the procedures for exercising the rights prescribed in Clause 1, Article 4 of the Law on Personal Data Protection.

2. Upon receiving a request to withdraw consent for the processing of personal data, to restrict the processing of personal data, or to object to the processing of personal data in accordance with the procedures of the personal data subject, the personal data controller, and the personal data controller and processor must respond within 2 working days, providing full information to the personal data subject about the procedure to stop processing personal data and implement it within 15 days, except in cases where the processing of personal data does not require the consent of the personal data subject as stipulated in Article 19 of the Law on Personal Data Protection. In cases where it is necessary to request the personal data processor or a third party to stop processing the personal data of the personal data subject, it must be carried out within 20 days.

Depending on the nature and complexity of the request, in cases where an extension of the processing time is necessary, it may be extended for a maximum of one additional time within a period not exceeding 15 days. The personal data controller and the personal data controller and processor must inform the data subject of the reason for the extension and are responsible for proving that the extension is necessary and reasonable.

3. Upon receiving a request to view, correct, or request the correction of personal data, and to provide personal data according to the procedures of the data subject, the personal data controller and the personal data controller and processor must respond within 2 working days, providing complete information to the data subject about the procedures and implementing them within 10 days. In cases where it is necessary to request the personal data processor or a third party to correct the data of the data subject, this must be carried out within 15 days.

Depending on the nature and complexity of the request, in cases where it is necessary to extend the processing time, an extension may be granted for a maximum of one time within a period not exceeding 10 days. The personal data controller and the party controlling and processing personal data must notify the data subject of the reason for the extension and are responsible for proving that the extension is necessary and reasonable.

4. Upon receiving a request to delete personal data in accordance with the data subject's proper procedure, the personal data controller and the party controlling and processing personal data

The individual must respond within 2 working days, providing full information to the personal data subject about the procedures and carrying them out within 20 days. In cases where it is necessary to request the personal data processor, a third party to provide, delete, or restrict the processing of the personal data subject's data, it must be carried out within 30 days.

Depending on the nature and complexity of the request, in cases where an extension of the processing time is required, it may be extended for a maximum of one time within a period not exceeding 20 days. The personal data controller, the personal data controller and processor shall notify the data subject of the reason for the extension and be responsible for proving that the extension is necessary and reasonable.

5. Upon receiving a request to implement measures or solutions to protect their personal data in accordance with the procedures of the data subject, the competent authority or agency, organization, or individual related to the processing of personal data must respond within 02 working days, providing complete information to the data subject about the procedures and implementing them within 15 days.

Depending on the nature and complexity of the request, in cases where an extension of the processing time is necessary, it may be extended for a maximum of one additional time within a period not exceeding 15 days. The personal data controller and the personal data controller and processor must inform the data subject of the reason for the extension and are responsible for proving that the extension is necessary and reasonable.

Article 6. Methods of expressing the consent of the data subject

1. The methods for obtaining the consent of the personal data subject must ensure verifiability regarding the identification of the personal data subject who has given consent, the time, and the content of the consent, including:

a) In writing;

b) By recorded phone call;

c) Consent syntax via text message;

d) Via email, on an electronic information page, platform, or application with technical arrangements for obtaining consent;

e) By other appropriate methods that can be printed, copied in writing, including in electronic or verifiable format.

2. The data controller, and the controller and processor of personal data must store the consent of the data subject. In case of disputes, the responsibility to prove the consent of the data subject belongs to the data controller, and the controller and processor of personal data.

3. The personal data controller, the party controlling and processing personal data, must not set default methods of consent or create unclear instructions that cause confusion between consent and non-consent for the data subject. The available default settings must ensure the principle of personal data protection, respecting the rights of the personal data subject.

4. For obtaining consent to process sensitive personal data, the data subject must be informed that the data to be processed is sensitive personal data.

Article 7. Transfer of personal data

1. Organizations and individuals transferring personal data under points a, c, and d, clause 1, Article 17 of the Law on Personal Data Protection, must establish an agreement on the transfer of personal data with the recipient of the personal data, specifying the following contents:

a) The purpose of transferring personal data;

b) The subjects of personal data and the types of personal data being transferred in accordance with the purpose of the transfer;

c) The duration of personal data processing, requirements for deleting or destroying personal data after fulfilling the transfer purpose;

d) The legal basis for the transfer of personal data;

e) Responsibility for protecting personal data during the transfer and processing of personal data;

f) Responsibility for exercising the rights of personal data subjects;

g) Responsibility for coordination and compliance of the parties in case of detecting violations of personal data protection regulations.

2. The transfer of sensitive personal data must include physical security measures for storage and transmission devices, encryption measures, anonymization of personal data, and other security measures during the transfer process.

3. In cases of transferring personal data under point a and point d, Clause 1, Article 17 of the Law on Personal Data Protection, with a fee for providing services to the data subject or to serve the legitimate interests of the data subject, organizations and individuals shall comply with the following regulations:

a) It is necessary to establish a technical system and a transparent mechanism so that the subject of personal data gives precise and clear consent for each transfer, based on knowing exactly the purpose of the transfer, and the organization or individual receiving and processing the personal data;

b) Personal data may only be processed correctly for the transfer purpose agreed by the data subject, in accordance with the registered business sector and profession;

c) The type of personal data transferred must be limited to the scope of the transfer purpose;

d) It is not allowed to collect, store, or form personal data repositories from personal data transfer activities to use for purposes other than those agreed upon by the personal data subject;

d) Clearly define the roles of the personal data controller, personal data processor, and third party in personal data transfer activities;

e) There must be an agreement on the transfer and processing of personal data before the transfer and a commitment of responsibility and obligations to the personal data subject.

4. In cases of sharing personal data between departments within the same agency or organization to process personal data in accordance with the established processing purpose, the agency or organization must establish procedures to control the sharing and use of personal data properly; and have measures to prevent internal staff of the agency or organization from illegally sharing personal data with third parties.

5. Personal data must be de-identified before being traded on the data exchange.

6. Agencies, organizations, and individuals providing personal data according to Clause 2, Article 15 of the Law on Personal Data Protection based on specific requests from data subjects shall not be considered a data transfer and are not required to comply with the provisions of this Article.

Article 8. Protection of personal data in financial and banking activities, and credit information activities

1. Organizations and individuals operating in the fields of finance, banking, and credit information activities are responsible for applying standards and technical regulations for personal data protection; technical regulations for de-identification of personal data, anonymization of personal data issued and applied in Vietnam; conducting compliance assessments with personal data protection regulations periodically once a year; and recording logs of all personal data processing activities.

2. Organizations and individuals operating in the fields of finance, banking, and credit information activities, as personal data controllers, controllers, and processors, when seeking the consent of personal data subjects, must ensure to clearly specify:

a) The purposes of personal data processing, including scoring, credit ranking, credit information evaluation, and assessment of creditworthiness if any;

b) Sources of personal data collection and the parties collecting and sharing the related personal data;

c) Personal data storage period;

d) Mechanism and method for withdrawing consent and policy for deleting and destroying personal data as prescribed.

3. Within no more than 72 hours after discovering a leak or loss of sensitive personal data of the data subject in the fields of finance, banking, credit information activities, the organization or individual directly collecting personal data of the data subject is responsible for notifying the specialized agency for personal data protection and the data subject. The notification content must ensure at least the contents prescribed in Clause 1, Article 28 of this Decree.

individuals and personal data subjects. The content of the notification must ensure at least the contents prescribed in Clause 1, Article 28 of this Decree.

Article 9. Personal data protection in big data processing

1. Processing big data containing personal data is the activity of processing personal data on a large scale, continuously, integrated from multiple sources, with the ability to analyze behavior, predict trends, or classify users.

2. In cases of processing big data containing personal data, the relevant agencies, organizations, and individuals are responsible for:

a) Complying with regulations on personal data protection during the data processing process from the very beginning of processing;

b) Collecting, processing, and storing personal data only within the correct scope, appropriate to a specific and clear purpose;

c) Developing policies for storing, deleting, and destroying personal data that are appropriate and in accordance with legal regulations;

d) Organize training, dissemination, and raising awareness about personal data security and personal data protection measures for employees on a regular basis, especially for personnel directly handling personal data. Enhance awareness of the importance of protecting personal data within the organization;

d) Have agreements with third parties, partners, and service providers to ensure full compliance with regulations on personal data protection;

e) Have appropriate notification and explanation mechanisms for data subjects regarding the use of their personal data in big data analysis systems.

3. Agencies, organizations, and individuals apply personal data protection measures in the process of big data processing, including:

a) Apply measures to ensure network security, data security, and prevent personal data leakage during the storage, processing, and transmission of personal data;

b) Use strong authentication methods, requiring at least multi-factor authentication (password, PIN combined with a one-time password, digital signature device or biometric factor), appropriate to the sensitivity level of personal data; assign

access rights to ensure that only authorized individuals can access personal data;

c) Implement encryption and anonymization of personal data (the process of separating data that identifies a specific individual to store and secure it separately; personal data after this process is used for processing without being able to identify a specific individual) during the transfer or provision of personal data, except in cases where specialized law provides otherwise or when processing requires data in clear form to serve crime prevention, anti-money laundering, national security assurance, handling customer complaints, or disputes. In these cases, the agency or organization must additionally apply security measures to ensure that personal data is not accessed or used unlawfully;

d) Conduct continuous monitoring, using monitoring tools to track access to personal data and detect abnormal activities;

d) Conduct regular inspections and evaluations of cybersecurity and data protection to detect, prevent, and remedy security vulnerabilities.

Article 10. Protection of personal data in artificial intelligence systems and virtual universe

1. Organizations and individuals are entitled to use personal data for researching and developing self-learning algorithms, artificial intelligence systems, and other automated systems but must ensure compliance with regulations on personal data protection.

2. Data resulting from artificial intelligence reasoning that can be used to identify or help identify a specific person must be subject to personal data protection measures in accordance with the law.

3. The personal data controller, the party controlling and processing personal data, is responsible for notifying the data subject about the automated processing of personal data, explaining the operating principles of the algorithm and its impact on the rights and legitimate interests of the data subject; providing options for the data subject to exercise the right not to participate.

4. The virtual universe (metaverse) is a digital universe that combines aspects of social media, online gaming, augmented reality (AR), virtual reality (VR), the Internet, and cryptocurrency to allow users to use virtual reality technology to interact.

5. Organizations and individuals apply personal data protection measures in artificial intelligence systems and the virtual universe, including:

a) Research, develop, and implement a system that meets cybersecurity standards and comprehensive data protection standards for artificial intelligence systems, with particular focus on the following factors: information security, algorithm reliability, system stability, and the ability to prevent cyberattacks;

b) Establish a mechanism for monitoring the activities of artificial intelligence systems on two aspects: supervision by authorized state agencies; accountability to the personal data subjects by the personal data controller, and personal data controller and processor.

c) Develop a personal data protection mechanism according to appropriate standards, and develop a monitoring and early warning system for cybersecurity risks;

d) Establish mechanisms to control and prevent the exploitation of artificial intelligence and virtual reality for activities that infringe upon national security and social order and safety;

e) Conduct regular assessments of compliance with personal data protection regulations once a year.

6. Personal data subjects must have the right to edit, anonymize, or delete identification records, even when platforms store behavioral history.

Article 11. Personal data protection in blockchain technology

1. Relevant agencies, organizations, and individuals, when processing personal data in blockchain technology, are responsible for complying with personal data protection regulations throughout the research and development of products, services, applications, systems using blockchain technology and during the processing of personal data.

2. Agencies, organizations, and individuals apply personal data protection measures when processing personal data in blockchain technology, including:

a) Only apply encryption algorithms, hashing algorithms, and digital signature algorithms that ensure security;

b) Do not store personal data directly on the blockchain, only store it when the personal data has been de-identified or store the hash value of the personal data;

c) Conduct compliance assessments of personal data protection regulations once a year.

Article 12. Personal Data Protection in Cloud Computing

1. Relevant agencies, organizations, and individuals must apply technical and organizational measures to prevent personal data from being accessed illegally when deploying cloud computing services.

2. Organizations and individuals who enter into contracts related to personal data processing with cloud service providers are responsible as follows:

a) Clearly state in the contract the compliance with Vietnamese law on personal data protection; provide information about the department and personnel responsible for personal data protection; comply with regulations on administrative procedures related to personal data protection according to the law;

b) Clearly identify the personal data processing flow, the roles of the parties in cloud computing service provision, and the corresponding responsibilities;

c) Include requirements on security, technical, and organizational measures, clearly stated in the contract;

d) Immediately notify relevant parties of any changes that may affect personal data;

e) Comply with the timeframe for personal data processing and requirements for deletion and destruction of personal data;

f) Ensure the exercise of the rights of data subjects;

g) Fully implement technical measures to ensure that access to personal data is reasonably delegated.

3. Organizations providing cloud computing services:

a) Comply with Vietnam's personal data protection regulations, provide information about the department and personnel responsible for personal data protection, and comply with administrative procedures related to personal data protection as prescribed by law;

b) Require subcontractors to comply with personal data protection regulations and obligations as prescribed by law;

c) Apply technical and organizational measures appropriate to the scale and level of personal data processing;

d) Conduct compliance assessments with personal data protection regulations once a year.

4. Personal data on the cloud must be encrypted at rest and in transit, accompanied by strict access control permissions.

Article 13. Conditions for personal data protection personnel, personal data protection departments in agencies and organizations

1. The appointment of personal data protection personnel or a personal data protection department must be carried out through an official written document of the agency or organization; it must specify the assignment, functions, duties, powers, and other requirements related to personal data protection activities within that agency or organization.

2. Personal data protection personnel appointed by the agency or organization must meet the following competence conditions:

a) Have a college degree or higher;

b) Have at least 2 years of work experience (from the time of graduation) in one of the following fields: legal affairs, information technology, cybersecurity, data security, risk management, compliance control, human resource management, or organizational personnel management;

c) Have been trained and nurtured in legal knowledge and professional skills regarding personal data protection.

3. In the case that an agency or organization establishes a personal data protection unit, the personnel in the unit must meet the competency conditions prescribed in Clause 2 of this Article.

4. The agency or organization is responsible for assessing and selecting personnel for personal data protection.

5. The agency or organization shall sign a confidentiality responsibility agreement with the personnel protecting personal data, and may agree on cases of exemption from liability in the event of violations or damage to the protected personal data.

6. The agency or organization shall assign the personnel protecting personal data or the personal data protection unit the responsibility to train and improve knowledge and skills on personal data protection for the personnel protecting personal data.

Article 14. Duties of the personal data protection unit and personnel protecting personal data within the agency or organization

1. The personal data protection unit has the following functions and duties:

a) Organize the development of policies, procedures, regulations, and forms to comply with legal regulations on personal data protection;

b) Organize the implementation of the rights of personal data subjects;

c) Periodically organize the assessment of the organization's compliance with laws on personal data protection through reports evaluating the level of fulfillment of obligations under legal regulations in order to propose measures to enhance legal compliance effectiveness, prevent and control risks in personal data processing activities;

d) Carry out the preparation of cross-border personal data transfer impact assessment records, personal data processing impact assessment records, receive and report violations of personal data protection, and implement other requirements of competent authorities as prescribed;

e) Develop plans and conduct regular training and further education on personal data protection within the agency or organization;

e) Organize the implementation of technical measures for personal data security, standards, regulations for personal data protection, and emergency response plans for personal data protection incidents;

g) Research and propose decisions related to personal data protection.

2. Personnel for personal data protection have the following duties:

a) Advise on the development of policies, procedures, regulations, and forms to comply with legal provisions on personal data protection;

b) Participate in the implementation of the rights of personal data subjects;

c) Participate in periodic activities to assess the current state of compliance with personal data protection laws and propose measures to improve legal compliance effectiveness, prevent and control risks;

d) Implement the preparation of dossiers for assessing the impact of cross-border personal data transfers, dossiers for assessing the impact of personal data processing, receiving and reporting

violating personal data protection and complying with other requirements of competent authorities as prescribed;

d) Participate in programs and training courses on personal data protection;

e) Participate in implementing technical measures for personal data security, standards, regulations for personal data protection, and emergency response plans for personal data protection incidents.

Article 15. Individuals providing personal data protection services

1. An individual providing personal data protection services is a person who meets the competency conditions specified in Clause 2 of this Article and is hired by an agency or organization to work as personal data protection personnel.

2. An individual providing personal data protection services must meet the following competency conditions:

a) Have a college degree or higher;

b) Have at least 3 years of work experience (from the date of graduation) related to one of the fields of law, personal data processing, cybersecurity, data security, risk management, or compliance control;

c) Have been trained in-depth and nurtured in legal knowledge and professional skills on personal data protection.

3. Agencies and organizations that need to hire individuals to provide personal data protection services shall review the eligibility conditions according to Clause 2 of this Article, conclude contracts for the use of personal data protection personnel; publicly disclose information about personal data protection personnel to data subjects and related parties.

4. Individuals providing personal data protection services are responsible for:

a) Performing the service in accordance with the scope and duties specified in the contract or agreement;

b) Not taking advantage of the service provision to carry out acts that violate the law;

c) Deleting or destroying personal data processed in the course of providing the service after completing the contract and in accordance with legal regulations.

Article 16. Organizations Providing Personal Data Protection Services

1. Organizations providing personal data protection services:

a) An organization or enterprise that has functions, duties, or business sectors in technology, legal matters, or consulting on technology or legal issues, and is hired by an agency or organization to advise on compliance with personal data protection regulations and to perform personal data protection tasks according to the agreement;

b) Has at least 03 personnel meeting the competency conditions specified in clause 2, Article 15 of this Decree;

c) Has provided products or services related to security, cybersecurity, information technology, standard assessment, or consulting on personal data protection.

2. Organizations providing personal data protection services must develop a competency dossier demonstrating their ability to protect personal data and provide it to agencies or organizations that need to use the service. The dossier must reflect the business sector, field of operation; scale, scope, experience in providing services; service provision policies; standards, qualifications, and competencies of personnel; and related documents and certificates of evidence.

3. Agencies and organizations that need to hire personal data protection services shall review the capacity records, enter into service contracts, and agree on personal data processing with the personal data protection organization; publicly provide information about that personal data protection organization to the data subjects and relevant parties.

4. Depending on their needs, agencies and organizations may simultaneously appoint personal data protection personnel, a personal data protection department, and hire individuals or organizations to provide personal data protection services.

5. Based on the agreement with the agency or organization hiring the personal data protection service, the organization providing personal data protection services shall perform the tasks of the personal data protection department for that agency or organization.

6. The organization providing personal data protection services is responsible for:

a) Performing the service in accordance with the scope and duties specified in the contract or agreement;

b) Not taking advantage of the service provision to carry out acts that violate the law;

c) Deleting or destroying personal data processed in the course of providing the service after completing the contract and in accordance with legal regulations.

Chapter III. RECORDS, PROCEDURES, AND PROCEDURES FOR PERSONAL DATA

Article 17. Cross-border transfer of personal data

1. The personal data controller, the personal data controller and processor, the personal data processor, and the third party carry out cross-border personal data transfer activities in the following cases:

a) Personal data storage activities that involve transferring personal data collected and stored in Vietnam to a server system located outside the territory of the Socialist Republic of Vietnam or to cloud computing services provided by foreign service providers;

b) Personal data transfer activities from agencies, organizations, or individuals in Vietnam to recipients who are organizations or individuals abroad;

c) Personal data processing activities collected in Vietnam and transferred to platforms outside the territory of the Socialist Republic of Vietnam for further processing.

2. The specialized agency for personal data protection decides to require the cross-border data transfer party to stop transferring personal data across borders in the case of:

a) When it is discovered that personal data is transferred or used for activities infringing on national defense and security;

b) Having behaviors that violate regulations on personal data protection that may cause harm to national defense and security.

3. Other cases apart from the cases stipulated in points a, b, c of Clause 6, Article 20 of the Law on Personal Data Protection are not required to implement the provisions on assessing the impact of cross-border personal data transfer, including:

a) Journalism and media activities as prescribed by law;

b) Cross-border personal data transfers that have been publicly disclosed in accordance with the law;

c) In emergency situations, it is truly necessary to provide personal data across borders to protect the life, health, and property safety of individuals; to fulfill tasks and obligations as prescribed by law;

d) The activity of transferring personal data across borders to manage cross-border personnel according to rules, labor regulations, and collective labor agreements as prescribed by law;

đ) The provision of personal data across borders to sign contracts or carry out procedures related to cross-border transportation, logistics, money transfer, payment, hotels, visa applications, and scholarship applications.

Article 18. Conditions, procedures, processes, and components of the dossier for assessing the impact of cross-border personal data transfer

1. Agencies, organizations, and individuals engaging in cross-border personal data transfers in accordance with clause 1, Article 20 of the Personal Data Protection Law must establish a cross-border personal data transfer impact assessment dossier as prescribed in this Article.

2. The cross-border personal data transfer impact assessment dossier includes:

a) The cross-border personal data transfer impact assessment report according to Form No. 09 in the Appendix of this Decree;

b) A copy of the contract or document transferring personal data showing the obligations and responsibilities between the organizations or individuals transferring and receiving cross-border personal data;

c) Policies, procedures, regulations, forms, and other related documents on personal data protection of the agencies, organizations, or individuals engaging in cross-border personal data transfers.

3. The cross-border personal data transfer impact assessment report includes the following contents:

a) Information and contact details of the party transferring personal data, the party receiving personal data, the party processing personal data, and other parties related to cross-border personal data transfer activities;

b) Contact details of the department or personnel responsible for personal data protection; organizations or individuals providing personal data protection services (if any) of the party transferring personal data and the party receiving personal data;

c) Description and explanation of the purpose of cross-border personal data transfer, types of personal data transferred across borders, details of cross-border personal data transfer and processing activities, and diagrams of personal data processing flows;

d) Description and explanation regarding obtaining consent from personal data subjects, policies for storing, deleting, and destroying personal data;

d) Plans to ensure the security of personal data after cross-border transfer, personal data protection measures, applicable personal data protection standards;

e) System diagram, description of features of the system that stores and processes personal data after receiving cross-border personal data;

g) Procedures for the recipient of cross-border personal data to transfer or provide personal data to third parties;

h) Results of self-assessment of compliance with personal data protection regulations by agencies, organizations, or individuals engaged in cross-border personal data transfer activities;

i) Assessment of the level of personal data protection by the personal data recipient; the extent of impact, risks of cross-border personal data transfer and processing; potential consequences and damages, measures to mitigate or eliminate those risks.

4. The impact assessment file for cross-border personal data transfer must always be available to serve the inspection and evaluation activities of the agency specialized in personal data protection.

The party transferring cross-border personal data shall submit one original copy of the complete file online, directly, or via postal service to the agency specialized in personal data protection, attached with Form No. 01a/01b in the Appendix of this Decree within 60 days from the date of conducting the cross-border personal data transfer.

5. The agency specialized in personal data protection shall evaluate and provide results on whether the impact assessment file for cross-border personal data transfer meets or does not meet the requirements within 15 days.

6. The agency specialized in personal data protection shall evaluate and require the cross-border personal data transferor to complete the Cross-Border Personal Data Transfer Impact Assessment file within 30 days in cases where the file is incomplete or not in compliance with regulations. In cases where the cross-border personal data transferor fails to complete the file according to regulations, the agency specialized in personal data protection shall consider applying provisions on administrative sanctions in the field of personal data protection.

7. The cross-border personal data transferor shall update and supplement the Cross-Border Personal Data Transfer Impact Assessment file in accordance with the provisions of Article 20 of this Decree.

Article 19. Conditions, procedures, steps, and components of the personal data processing impact assessment file.

1. The personal data controller, the personal data controller and processor, and the personal data processor shall prepare and keep a Record of Personal Data Processing Impact Assessment from the time they begin processing personal data.

2. The Record of Personal Data Processing Impact Assessment of the personal data controller, the personal data controller and processor, and the personal data processor includes:

a) The Personal Data Processing Impact Assessment report according to Form No. 10 in the Appendix of this Decree;

b) A copy of the contract or agreement on personal data processing, reflecting the obligations and responsibilities between organizations and individuals in personal data processing activities;

c) Policies, procedures, regulations, forms, and other related documents on the protection of personal data of the personal data controller, the personal data controller and processor, and the personal data processor.

3. The personal data processing impact assessment report includes the following contents:

a) Information and contact details of the personal data controller, the entity controlling and processing personal data, the personal data processor, and third parties;

b) Contact details of the department or personnel responsible for personal data protection; organizations or individuals providing personal data protection services (if any) for the personal data controller, the entity controlling and processing personal data, the personal data processor, and third parties;

c) Description and justification of the purpose of personal data processing, the types of personal data processed, details of personal data processing activities, and personal data flow diagrams;

d) Description and explanation regarding obtaining consent from personal data subjects, policies for storing, deleting, and destroying personal data;

d) Plans to ensure the security of personal data, personal data protection measures, system design diagrams, and applicable personal data protection standards;

e) Results of the compliance assessment with personal data protection regulations;

g) Assess the level of impact and risk of personal data processing activities; the potential undesirable consequences and damages, and the measures to mitigate or eliminate those risks.

4. The personal data processing impact assessment dossier must always be available to serve the inspection and evaluation activities of the agency specializing in personal data protection and submit 01 original copy either online, directly, or via postal service to the agency specializing in personal data protection, accompanied by Form No. 02a/02b in the Appendix of this Decree within 60 days from the date of personal data processing.

5. The specialized personal data protection agency evaluates and returns the results of the Personal Data Processing Impact Assessment Dossier as meeting or not meeting the requirements within 15 days.

6. The specialized personal data protection agency evaluates and requests the personal data controller, the data controller and processor, or the data processor to complete the Personal Data Processing Impact Assessment Dossier within 30 days in cases where the dossier is incomplete or not in compliance with regulations. If the personal data controller, the data controller and processor, or the data processor fails to complete the dossier according to the regulations, the specialized personal data protection agency will consider applying the provisions on administrative penalties in the field of personal data protection.

7. The personal data controller, the personal data controller and processor, and the personal data processor shall update and supplement the Personal Data Processing Impact Assessment dossier in accordance with the provisions of Article 20 of this Decree.

Article 20. Updating the personal data processing impact assessment dossier and the cross-border personal data transfer impact assessment dossier

1. The cross-border personal data transfer dossier and the personal data processing impact assessment dossier shall be updated every 6 months from the initial submission in the following cases:

a) When a new purpose for personal data transfer or a new purpose for personal data processing arises;

b) When the personal data controller, the personal data controller and processor, the personal data processor, or a third party arises or changes.

2. Cases of changes that need to be updated immediately within 10 days include:

a) When an agency, organization, or unit is reorganized, ceases operations, is dissolved, or goes bankrupt according to the provisions of law;

b) When there is a change in information about the organization or individual providing personal data protection services;

c) When there arises or changes in the industry, profession, or business services related to the processing of personal data that has been registered in the personal data processing impact assessment file or the cross-border personal data transfer impact assessment file.

3. The updating of the personal data processing impact assessment record and the cross-border personal data transfer impact assessment record shall be carried out according to Form No. 03a/03b in the Appendix of this Decree, submitted online, directly, or via postal service to the specialized personal data protection agency.

Article 21. Personal data processing services

1. Services providing and operating systems or automated software to process personal data on behalf of the data controller, jointly by the controller and processor.

2. Services that score, rank, or assess the creditworthiness of personal data subjects.

3. Services collecting and processing personal data online from websites, applications, software, and social networks.

4. Services collecting and processing personal data through health care websites, applications, software, health monitoring, and medical services.

5. Services for collecting and processing personal data through educational applications and software with monitoring elements such as attendance tracking, video recording, behavior scoring, emotion recognition.

6. Services for analyzing and exploiting personal data, including: using analytical tools to search for information, trends, and patterns from personal data; applying data mining methods to extract value from personal data, predict user behavior, or optimize services.

7. Services for encrypting personal data during transmission and storage.

8. Services for automatic processing of personal data based on big data technology, artificial intelligence, blockchain, and virtual universe.

9. Platform services providing personal location data.

Article 22. Conditions for organizations conducting personal data processing service business

1. Being an organization or enterprise established and operating under Vietnamese law, meeting the conditions stipulated in this Article.

2. Conditions regarding personnel:

a) The head in charge of the professional management of personal data processing of the organization is a Vietnamese citizen, permanently residing in Vietnam;

b) Having a management and executive team that meets the professional requirements for personal data processing;

c) Having at least 03 personnel meeting the capacity conditions as prescribed in Clause 2, Article 13 of this Decree.

3. Having infrastructure, equipment systems, facilities, and technology suitable for personal data processing services.

4. Having results that meet the requirements for the personal data processing impact assessment file and the cross-border personal data transfer impact assessment file in case of cross-border personal data transfer.

Article 23. Responsibilities of organizations providing personal data processing services

1. Fully comply with legal regulations on personal data protection; responsibilities and obligations of data controllers and data processors.

2. Establish a personal data protection risk management framework suitable for the services provided.

3. Conduct regular compliance and trustworthiness assessments on personal data protection once a year.

4. Apply standards and regulations related to data security, personal data protection, and cybersecurity.

5. Develop regulations on the responsibilities and authority of the organization in personal data processing.

6. Ensure personal data is processed for the proper purpose, limit collection, transfer, and storage appropriately and according to the law; prevent unauthorized access, collection, use, disclosure, or similar risks in personal data processing activities.

7. In cases where the entity is a personal data processor, the organization requests the personal data controller to obtain the data subject's consent according to regulations before providing services, ensuring that the data subject is informed about the types of personal data processed, the purpose of processing, and the organization providing the personal data processing service.

8. Organizations conducting personal data processing services shall verify the identity of the organization in accordance with the law on electronic identification and authentication.

Article 24. Authority to issue, reissue, replace, and revoke Certificates of eligibility for personal data processing services

1. The Ministry of Public Security shall issue, reissue, replace, and revoke Certificates of eligibility for providing personal data processing services.

2. The Minister of Public Security assigns the responsibility to the agency specialized in personal data protection to carry out the issuance, re-issuance, replacement, and revocation of the Certificate of Eligibility for Providing Personal Data Processing Services as prescribed.

Article 25. Dossiers, order, and procedures for granting the Certificate of Eligibility for Personal Data Processing Service Business

1. The dossier for requesting the Certificate of Eligibility for Personal Data Processing Service Business includes:

a) Application for the Certificate of Eligibility for Personal Data Processing Service Business according to Form No. 04 in the Appendix of this Decree;

b) A copy of the Business Registration Certificate;

c) Document appointing the personal data protection department or a contract using personal data protection services as prescribed;

d) Proposal for requesting the Certificate of Eligibility for Personal Data Processing Service Business;

d) Degrees and other supporting documents of personnel as specified in Point c, Clause 2, Article 22 of this Decree;

e) Organizations are not required to submit the documents specified in Point b of this Clause in cases where government agencies can exploit the information based on the database.

2. The proposal for granting the Certificate of Eligibility for the Business of Personal Data Processing Services includes the following contents:

a) Necessity, objectives;

b) Content and fields proposed for approval;

c) Sectors, business fields, business plan;

d) The expected scale of personal data processing operations;

e) The risk management framework for personal data protection;

f) Plan for periodic assessment of compliance status and trust level in personal data protection;

g) Application of standards and regulations related to data security and personal data protection;

h) Plan for using services for electronic identification and authentication;

i) Responsibilities and authority of the organization in processing personal data;

k) Personnel meeting the qualifications as prescribed.

3. The organization submits 01 set of application documents for the Certificate of eligibility for personal data processing business services online, directly, or via postal service to the specialized agency for personal data protection.

The specialized agency for personal data protection evaluates the application for the Certificate of eligibility for personal data processing business services as satisfactory or unsatisfactory within 10 days. In case the application is incomplete or not in accordance with regulations, the specialized agency for personal data protection shall notify the organization in writing to supplement and complete the documents within 15 days, clearly stating the reasons.

4. Within 30 days from the date of receipt of a complete and valid application, the specialized agency for personal data protection shall appraise, review, and decide on the issuance of a Certificate of Eligibility for Personal Data Processing Service Business according to Form No. 05 in the Appendix of this Decree. The Certificate of Eligibility for providing personal data processing services can be in paper or electronic form; the paper version is issued when the application is submitted directly or via postal service, or upon request when submitting the application online through the public service portal. In case of non-issuance, the specialized agency for personal data protection shall notify the organization in writing and clearly state the reasons.

Article 26. Dossiers, procedures, and processes for re-issuance or replacement of the Certificate of Eligibility for Personal Data Processing Service Business

1. Re-issuance in case the paper copy of the Certificate of Eligibility for Personal Data Processing Service Business is lost or damaged.

a) In cases where an organization needs a reissued paper certificate, it shall submit a request form according to Form No. 05 in the Appendix of this Decree via online method, directly, or through postal services to the specialized agency for personal data protection.

b) Within 05 working days from the date of receipt of the request form as prescribed, the specialized agency for personal data protection shall consider and reissue the Certificate of Eligibility for Personal Data Processing Service Business; in case of refusal, a written notice stating the reasons must be provided.

2. Reissue in case of incorrect information or changes in the content of the Certificate of Eligibility for Personal Data Processing Service Business.

a) The dossier includes: An application form according to Form No. 06 in the Appendix of this Decree; Documents and materials proving the incorrect information and changes to the information content on the already issued Certificate.

b) The organization submits 01 set of the above dossier online, directly, or via postal service to the agency specialized in personal data protection. Within 05 working days from the date of receiving the complete dossier specified in point a of this clause, the agency specialized in personal data protection shall review and decide on the issuance of the Certificate of Eligibility to conduct personal data processing services; in case of non-issuance, a written notice specifying the reason must be provided.

Article 27. Revocation of the Certificate of Eligibility to conduct personal data processing services

1. The Certificate of Eligibility to conduct personal data processing services shall be revoked in the following cases:

a) When failing to meet one of the conditions in Clause 1, Clause 2 of Article 26 of this Decree;

b) Not operating the service for 12 months or more;

c) Being dissolved or declared bankrupt according to the law;

d) Failing to rectify violations regarding personal data protection, information security, cybersecurity, and data security as required by the competent state authority;

e) Proactively requesting suspension or termination of operations.

2. The agency specializing in personal data protection shall decide on the revocation of the Certificate of Eligibility for Personal Data Processing Service Business according to Form No. 07 in the Appendix of this Decree.

3. Organizations engaged in personal data processing services are responsible for returning the issued Certificate to the agency specializing in personal data protection within 05 working days from the date of receiving the revocation decision.

4. The agency specialized in personal data protection, when issuing a Decision on the revocation of the Certificate of Eligibility for Personal Data Processing Services, shall notify on the National Portal on Personal Data Protection.

Article 28. Content of notification of violations of personal data protection regulations

1. The content of the notification of violations of personal data protection regulations includes:

a) Description of the nature of the violation of personal data protection regulations, including: time, place, actions, organizations, individuals, types of personal data, and the amount of relevant data;

b) Contact details of the personal data protection department, personnel, or organizations, individuals providing personal data protection services;

c) Description of possible consequences and damages of the violation of personal data protection regulations;

d) Description of measures taken to resolve and mitigate the harm of the violation of personal data protection regulations.

2. The personal data controller, the personal data controller and processor, and the third-party processor shall send a notice of personal data regulation violations to the specialized agency for personal data protection or via the National Personal Data Protection Portal according to Form No. 08 in the Appendix of this Decree.

Article 29. Notification of violations regarding personal location data and biometric data

1. In the event of a personal data violation incident related to location data or biometric data, the personal data controller or the personal data controller and processor shall be responsible for:

a) Notifying the affected data subject within no more than 72 hours from the time the violation is detected;

b) Report to the competent state authority as prescribed in Article 28 of this Decree;

c) Record, store, and update violation dossiers to serve inspection, examination, and handling work. Organizations must keep violation records for a minimum of 5 years from the date the incident is remedied.

2. Notification to the data subject pursuant to point a, clause 1 of this Article must include at least the following contents:

a) The time and method of detecting the violation;

b) The type of data affected (location, biometric, or both);

c) The severity and potential risks to the legal rights and interests of the data subject;

d) Measures that have been, are being, and will be taken to remedy the incident and mitigate damage;

đ) Instructions for the data subject to implement further preventive and protective measures;

e) Contact information of the department or personnel responsible for personal data protection, or organization, individual providing personal data protection services; the department receiving and handling personal data incidents within the organization.

3. In case the organization or individual cannot notify all affected personal data subjects within the time frame specified in Clause 1 of this Article due to technical or urgent reasons, the following must be carried out:

a) Public notification through the organization's official electronic means via its website or application;

b) Sending notifications to the relevant personal data subjects as soon as technical conditions permit.

4. In case the organization or individual fails to notify on time or deliberately delays or avoids the notification obligation, they will be subject to consideration for violation handling in accordance with the provisions of law.

Chapter IV. IMPLEMENTATION OF PERSONAL DATA PROTECTION

Article 30. Responsibility to implement international cooperation on personal data protection

1. The agency specializing in personal data protection is responsible for assisting the Ministry of Public Security in carrying out international cooperation on personal data protection.

2. Ministries, ministerial-level agencies, and government agencies shall implement international cooperation on personal data protection in sectors and fields under their management in accordance with the law and the functions and tasks assigned.

3. Provincial-level People's Committees shall implement international cooperation on personal data protection in accordance with the law and the functions and tasks assigned.

Article 31. Inspection of personal data protection activities

1. Inspection of personal data protection activities shall be conducted regularly, unexpectedly, in the following cases:

a) When there are reasonable grounds to suspect violations of the law on personal data protection;

b) When there is an order from agencies or persons with state management authority on personal data protection;

c) To perform state management tasks in accordance with the law.

2. Subjects of inspection of personal data protection activities include:

a) Agencies, organizations, and individuals with personal data processing activities;

b) Organizations and individuals doing business in personal data processing services;

c) Agencies, organizations, and individuals required to carry out impact assessment activities on personal data processing and cross-border personal data transfer impact assessments;

d) Agencies, organizations, and individuals involved in cases or incidents of violations of personal data protection regulations.

3. Content of inspection of personal data protection work:

a) The current status of compliance with personal data protection work;

b) Activities of impact assessment on personal data processing and impact assessment of cross-border personal data transfer;

c) Business activities providing personal data processing services.

4. The specialized agency for personal data protection shall issue an inspection decision and notify the entity to be inspected as specified in Clause 2 of this Article at least 15 days in advance regarding the time, content, and composition of the inspection team. In the case of unscheduled inspections to promptly verify, detect, and prevent violations of personal data protection laws, the specialized agency for personal data protection has the right to conduct the inspection immediately without prior notice.

5. The entity to be inspected must fully prepare the inspection contents in accordance with the provisions of Clause 3 of this Article and the specific requirements stated in the inspection decision issued by the specialized agency for personal data protection.

Article 32. Research and development of personal data protection solutions

Agencies, organizations, enterprises, and individuals participating in the research, development, and application of personal data protection solutions, including:

1. Developing software systems and equipment for personal data protection;

2. Methods for evaluating software and equipment for personal data protection to meet standards;

3. Methods for testing hardware and software provided to ensure they perform their functions correctly;

4. Recording and managing compliance with personal data protection regulations;

5. Addressing risks of personal data leakage and loss;

6. Technical initiatives to enhance awareness and skills in personal data protection;

7. Processing personal data for statistical and scientific purposes;

8. Solutions for data subjects to control their personal data, provide and share data according to selective disclosure mechanisms, applying high technology and strategic technology in accordance with international standards and norms;

9. Personal data protection standards;

10. Other personal data protection solutions in accordance with legal regulations.

Article 33. State management content on personal data protection

1. Issue according to authority or submit to competent state agencies for promulgation of legal documents on personal data protection; organize the implementation of laws on personal data protection.

2. Develop and organize the implementation of strategies, policies, proposals, projects, programs, plans on personal data protection.

3. Guide agencies, organizations, and individuals on measures, procedures, standards, and norms for personal data protection in accordance with the law.

4. Propagate and educate the law on personal data protection; communicate and disseminate knowledge and skills on personal data protection.

5. Build, train, foster, and develop human resources on personal data protection.

6. Inspect, examine, commend, resolve complaints and denunciations, and handle violations of the law on personal data protection in accordance with legal regulations.

7. Statistics, information, reporting on the situation of personal data protection and the implementation of the law on personal data protection to competent state agencies.

8. Organize preliminary reviews, summarizations, and scientific research on personal data protection; research and apply scientific and technological advancements in personal data protection.

9. International cooperation in personal data protection.

Article 34. Responsibilities of the Ministry of Public Security

1. Assist the Government in uniformly implementing state management on personal data protection.

2. Preside over the drafting, promulgation, or submission to competent state agencies for promulgation, and guide the implementation of legal normative documents guiding the implementation of provisions of the law on personal data protection.

3. Guide and deploy activities for personal data protection, protecting the rights of data subjects against acts violating the provisions of the law on personal data protection.

4. Preside over and coordinate with the Ministry of Science and Technology in developing standards and technical regulations for personal data protection; technical regulations for de-identification of personal data, anonymization of personal data to be promulgated and applied in Vietnam.

5. Develop, manage, and operate the National Portal on personal data protection.

6. Implement propaganda, dissemination, legal education, and provide guidance and training in knowledge and skills on personal data protection for the personal data protection force.

7. Evaluate, summarize, and review the results of personal data protection work of relevant agencies, organizations, and individuals.

8. Promote scientific research on personal data protection; study and apply scientific and technological advances in personal data protection to innovate in the field of personal data protection.

9. Implement international cooperation activities on personal data protection.

Article 35. Responsibilities of the Ministry of National Defense

1. Coordinate with the Ministry of Public Security and relevant agencies and organizations to arrange forces and means to protect personal data, detect, and prevent acts violating regulations on personal data protection within the management scope.

2. Within the scope of assigned functions and tasks, to take the lead and coordinate with the Ministry of Public Security to conduct assessments of personal data protection work for agencies, organizations, and individuals under its management; to promote the application of personal data protection measures; to research and apply advanced security technologies in the processing and protection of personal data to serve national defense activities; to carry out international cooperation on personal data protection within the scope of management in accordance with legal regulations.

3. To organize propaganda, dissemination, legal education, and knowledge and skills training on personal data protection for officers, professional soldiers, officials, and public employees under the scope of management.

4. To inspect, check, supervise, and handle violations of regulations on personal data protection for agencies, organizations, and individuals within the management scope of the Ministry of National Defense in accordance with the law and the assigned functions and tasks.

Article 36. Responsibilities of the Ministry of Science and Technology

1. Coordinate with the Ministry of Public Security in developing standards and technical regulations for personal data protection; technical regulations for personal data de-identification and anonymization that are promulgated and applied in Vietnam.

2. Coordinate with the Ministry of Public Security and relevant agencies in researching, developing, mastering, and applying personal data protection measures using advanced technologies, high technologies, strategic technologies, forming solutions, products, and services for personal data protection in the process of developing a digital government, digital economy, and digital society through science and technology programs.

Article 37. Responsibilities of ministries, ministerial-level agencies, and government-affiliated agencies

1. Perform state management of personal data protection in sectors and fields within their management scope as prescribed by law.

2. Develop and implement the contents and tasks of personal data protection in this Decree.

3. Supplement personal data protection provisions in the development and implementation of tasks of ministries and sectors.

4. Arrange personnel and personal data protection units in entities within the management scope; ensure meeting capacity, suitable for job positions, and professional requirements on personal data protection as prescribed by law.

5. Allocate funding for personal data protection activities according to the current budget management hierarchy.

6. Organize propaganda, legal dissemination, professional training, and skill development for officials, public servants, and units within the management scope regarding personal data protection.

7. Coordinate with the Ministry of Public Security in inspection, supervision, and handling violations of personal data protection regulations within the management scope.

8. Coordinate with the Ministry of Public Security and the Ministry of Science and Technology in developing guidelines and implementing the application of standards and technical regulations on personal data protection for units, organizations, and individuals within the scope of management.

Article 38. Responsibilities of the People's Committees of provinces and centrally-run cities

1. Carry out state management of personal data protection for sectors and fields under management according to the provisions of the law on personal data protection.

2. Implement the provisions on personal data protection in this Decree.

3. Arrange personnel and personal data protection units in units within the scope of management; ensure compliance with capacity conditions, suitable for job positions, and meet professional requirements for personal data protection according to legal regulations.

4. Allocate funding to serve personal data protection activities according to the current budget management decentralization.

5. Organize propaganda and dissemination of laws, knowledge, and skills to protect personal data for officials, public servants, employees, citizens, and businesses in the locality.

6. Organize training to improve the capacity of the team working on personal data protection at administrative levels; integrate personal data protection content into administrative reform and digital transformation programs.

7. Develop a system for statistics, aggregation, and periodic reporting on the situation of personal data protection in the locality to send to the specialized personal data protection agency as prescribed.

Article 39. Specialized personal data protection agency and National Portal on personal data protection

1. The specialized personal data protection agency is a unit under the Ministry of Public Security, responsible for assisting the Minister of Public Security in performing the state management function on personal data protection.

2. The national portal on personal data protection is the place that provides information to propagate the Party's guidelines, policies, and the State's laws on personal data protection; supports guidance, raising awareness, and personal data protection skills for agencies, organizations, and individuals; receives and handles feedback and recommendations from relevant agencies, organizations, and individuals; carries out other activities in accordance with the provisions of the law on personal data protection.

Article 40. Funding to ensure the operation of personal data protection

1. Funding for the implementation of personal data protection includes the state budget; contributions from agencies, organizations, and individuals both domestically and internationally; revenue from activities providing personal data protection services; international aid, and other legal sources of revenue.

2. The personal data protection funding of state agencies is guaranteed by the state budget and allocated in the annual state budget estimates. The management and use of funds from the state budget are carried out in accordance with the provisions of the law on the state budget.

3. The personal data protection funding of organizations and enterprises is arranged by the organizations and enterprises themselves and implemented according to regulations.

Chapter V. IMPLEMENTATION ORGANIZATION

Article 41. Regulations on the application of Clause 2 and Clause 3 of Article 38 of the Law on Personal Data Protection

1. Small enterprises and start-up enterprises have the right to choose whether or not to comply with the provisions of Article 21, Article 22, and Clause 2 of Article 33 of the Personal Data Protection Law for a period of 5 years from the effective date of the Personal Data Protection Law, except for small enterprises and start-up enterprises that provide personal data processing services, directly process sensitive personal data, or process personal data from the point when they reach a scale of 100,000 or more data subjects based on the accumulated results of the total amount of personal data processed.

2. Business households and ultra-small enterprises are not required to comply with the provisions of Article 21, Article 22, and Clause 2 of Article 33 of the Personal Data Protection Law, except for business households and ultra-small enterprises that provide personal data processing services, directly process sensitive personal data, or process personal data from the time their scale reaches 100,000 personal data subjects or more based on the accumulated total amount of personal data processed.

Article 42. Effectiveness and enforcement responsibility

1. This Decree takes effect from January 1, 2026.

2. Decree No. 13/2023/NĐ-CP dated April 17, 2023, of the Government on personal data protection shall cease to be effective from the date this Decree takes effect.

3. Amendment of Clause 2, Article 16 of Decree No. 165/2025/NĐ-CP dated June 30, 2025, of the Government detailing a number of articles and enforcement measures of the Data Law as follows:

“2. The protection of core data and important data which are personal data is carried out in accordance with the provisions of the Law on Personal Data Protection and the detailed guiding documents. In the case of cross-border transfer or processing of core data and important data that are personal data, the data controller of core data and important data must conduct a personal data processing impact assessment and a cross-border personal data transfer impact assessment in accordance with the law on personal data protection; it is not required to conduct a risk assessment or an impact assessment for cross-border data transfer or processing under the provisions of this Decree.”

In the case of cross-border transfer and processing of core data, important data which are personal data, the controllers of core data and important data shall carry out an assessment file on the impact of personal data processing, and an impact assessment of cross-border personal data transfer in accordance with the provisions of the law on personal data protection; it is not required to conduct risk assessment or assessment of cross-border data transfer and processing under the provisions of this Decree.

4. The Ministry of Public Security is responsible for guiding, inspecting, and urging the implementation of this Decree.

5. The ministers of ministries, the heads of ministerial-level agencies and agencies under the Government, the chairpersons of the People's Committees of provinces and centrally-run cities, and related agencies, organizations, and individuals are responsible for implementing this Decree.

ON BEHALF OF THE GOVERNMENT DEPUTY PRIME MINISTER

Nguyễn Hòa Bình