Article · June 15, 2026
From Decree 13/2023 to Law 91/2025: What to know by 01/01/2026
Compare Decree 13/2023 and the PDPL (Law 91/2025): key changes businesses need before 01/01/2026.
⚠ This article is pending legal review before publication.
Quick answer
The Personal Data Protection Law (Law 91/2025/QH15) replaces Decree 13/2023 from 01/01/2026. Businesses that have complied with ND13 need to update several key points on scope of application, data subject rights, and breach notification obligations.
Similarities between ND13 and Law 91
- Require a legal basis when processing data (consent, contract, legal obligation...)
- Special protection for sensitive data
- Data subject rights (access, rectification, erasure, objection)
- Data breach notification obligations
Key changes
| Topic | Decree 13/2023 | Law 91/2025 | |
|---|---|---|---|
| Effective date | 01/07/2023 | 01/01/2026 | |
| Legal hierarchy | Decree | Law (higher) | |
| Cross-border data transfer | Specific conditions | Additional new mechanisms | |
| Penalties | Current sanctioning decree | New penalty framework under Law 91 |
Transition checklist for businesses
Review the legal bases for processing under the new provisions of Law 91
Update the Privacy Policy to reflect new data subject rights
Review cross-border data transfer agreements with partners
Update DSAR procedures to the timelines set in Law 91
Seek legal advice to confirm full compliance
⚠ Note: This content requires legal review before implementation. Consult a specialist lawyer before making major changes.
Source: Nghị định 13/2023/ND-CP, Luật 91/2025/QH15 — thuvienphapluat.vn
Get started — no account needed.
Ready to comply with PDPL?