Why HR carries the most risk
Step 1 / 4·From decree to law: what changed
0/4 steps done
Learning objectives — after this module you will:
- Know the legal timeline: from Decree 13/2023 to Law 91/2025/QH15
- Tell basic personal data apart from sensitive personal data
- Inventory the data your HR function actually holds
From decree to law: what changed
Understand why this is not a minor update.
Since 2023, personal data protection in Vietnam was governed by Decree 13/2023/ND-CP. A decree is sub-statutory: narrower in scope, weaker in sanctions. On 26 June 2025 the National Assembly passed the Personal Data Protection Law No. 91/2025/QH15, effective 1 January 2026, together with Decree 356/2025/ND-CP, which implements it and replaces Decree 13/2023.
In other words, the subject has been elevated from decree level to LAW level. That brings a wider scope, more specific obligations, tougher sanctions and a clearer supervision mechanism. For businesses, the wait-and-see window has closed — the law is already in force.
Practitioner guidance, not legal advice
This course helps you understand the obligations and build internal procedures. It does NOT replace legal advice for your specific situation. For high-risk decisions — cross-border data transfers, large-scale breach response, disputes with employees — work with a lawyer. Content is current as of August 2026; check the source texts before you act.
Key takeaway: Personal data protection is now statutory (Law 91/2025/QH15), effective 1 January 2026, with Decree 356/2025 replacing Decree 13/2023.