Vietnam Decree 13/2023

Vietnam personal data protection decree - cross-border transfer DPIA, consent, data subject rights.


Short name	VN D13
Region	Asia-Pacific
Country or scope	Vietnam
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers VN D13

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 11 controls from Safeguard's control catalog for VN D13.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for VN D13 and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`VN-D13-26` Personal Data Protection Measures	Regulated entities must apply management and technical measures to protect personal data throughout processing, implying verifiable integrity of the software systems that handle the data (Decree 13/2023/ND-CP, Art. 26)	Scan
`VN-D13-24` Impact Assessment Dossier	Controllers and processors must prepare and maintain a personal data processing impact assessment dossier from the start of processing, which requires an enumerated account of the processing systems and their software components (Decree 13/2023/ND-CP, Art. 24)	Scan
`VN-D13-25` Cross-Border Transfer Assessment Documentation	Transferring Vietnamese citizens' personal data abroad requires a transfer impact assessment dossier kept available for inspection, demanding formally identified, timestamped technical documentation of the transferring systems (Decree 13/2023/ND-CP, Art. 25)	Scan
`VN-D13-23` Breach Notification Readiness	Violations of personal data protection regulations must be notified to the Ministry of Public Security (A05) within 72 hours; assessing scope and cause that quickly requires each deployed component to be individually identifiable (Decree 13/2023/ND-CP, Art. 23)	Scan
`VN-D13-PROC` Processor and Third-Party Responsibility	Personal data processors and third parties bear defined protection responsibilities to the controller, so the controller must know which suppliers stand behind the components of its processing stack (Decree 13/2023/ND-CP, controller/processor responsibility articles)	Scan
`VN-D13-VER` Version Knowledge for Incident Assessment	The 72-hour breach reporting duty and impact-assessment obligations jointly require knowing the exact versions of software in use to evaluate exposure to a given vulnerability (Decree 13/2023/ND-CP, Arts. 23-24)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`VD13-ART2`	Definitions and Scope
`VD13-ART3`	Personal Data Protection Principles
`VD13-ART11`	Right to Know
`VD13-ART12`	Right to Consent
`VD13-ART13`	Right to Access and Correction
`VD13-ART14`	Right to Erasure and Restriction
`VD13-ART17-19`	Controller Obligations: Notice and Consent Capture
`VD13-ART20-22`	Processor Obligations and Sub-Processing
`VD13-ART23-24`	Cross-Border Transfer DPIA: Assessment
`VD13-ART25-26`	Cross-Border Transfer: Regulatory Approval
`VD13-ART38`	Sensitive Personal Data Handling

Policy templates

Written for VN D13:

Cross-Border Personal Data Transfer Policy (Vietnam Decree 13)
Sensitive Personal Data Handling Policy (Vietnam Decree 13 Article 38)
Data Controller Obligations Policy (Vietnam Decree 13 Articles 17-22)

And 22 from the standard set, adapted to VN D13.