PDPD
Personal Data Protection Decree (Decree 13/2023)
Vietnam
In force since July 2023
Asia & Africa
Who must comply
Agencies, organizations and individuals that process personal data of people in Vietnam, including foreign parties processing such data.
Penalties
Penalties are set by implementing rules and can include administrative fines, with proposals for fines up to 5% of prior-year revenue for serious violations.
Key obligations
- Obtain clear, affirmative and recorded prior consent
- Provide notice of purpose before processing
- Honor access, correction, deletion and withdrawal rights
- Carry out and file impact assessment dossiers
- Meet cross-border transfer assessment requirements
How ConsentX helps
Affirmative, recorded opt-in consent capture
Prior-script blocking before processing
Withdrawal and rights request workflow
Consent receipts and evidence dossiers
Region rule engine tuned for Vietnam
Get PDPD ready with ConsentX
This page is a plain-English summary for general information and is not legal advice. Confirm your obligations with qualified local counsel.
How to comply with PDPD using ConsentX
- 1
Scan your website
Run a free scan to find every cookie and tracker on your site, so you know exactly what needs consent under PDPD.
- 2
Show a geo-aware consent banner
Add the ConsentX banner. It detects each visitor region and shows the consent experience that PDPD requires, automatically.
- 3
Block trackers until consent
Keep non-essential cookies and trackers blocked until the visitor agrees, so nothing fires before consent.
- 4
Record tamper-evident proof
Every choice is stored as a tamper-evident consent receipt you can produce in a PDPD audit.
- 5
Handle data requests on time
Use the built-in DSAR workflow with SLA timers to answer access, deletion and opt-out requests within the legal deadline.
Frequently asked questions
Does Vietnam's decree allow implied consent?+
No. Consent must be clear and affirmative, and silence or non-action does not count as valid consent.
What records does Vietnam's PDPD require?+
Consent must be in a form that can be printed or reproduced, and controllers must prepare impact assessment dossiers.