Vietnam’s Personal Data Protection Decree: What Businesses Need to Prepare?

Since Vietnam’s Decree 13/2023/ND-CP on personal data protection took effect, the question “is our customer data being collected and stored the right way” has stopped being theoretical. For a business collecting phone numbers, emails, and even financial information through ad forms, websites, and Zalo every day, this needs a concrete answer, not a general “probably fine” feeling.

This post isn’t a substitute for professional legal advice – every business has different data collection and processing specifics, so a lawyer or compliance specialist needs to evaluate your actual situation. But there are a few foundational principles any business collecting customer data should understand, and a properly built data system can make compliance far easier than trying to patch things together later.

Why this is no longer something that can wait

Before a clear regulatory framework existed, many businesses collected customer data out of habit – the more information the better, stored indefinitely, shared across departments or partners without any clear process. Under the current legal framework, that approach now carries real compliance risk, not just brand reputation risk.

A few foundational principles worth knowing

The first principle is consent: personal data needs to be collected with the data subject’s clear consent, and the purpose of collection needs to be stated upfront – you can’t collect for one purpose and then quietly use it for another. The second principle is purpose limitation and retention: data should only be kept as long as necessary for the stated purpose, not held indefinitely “just in case.”

The third principle is the data subject’s rights: customers have the right to know how their data is being used, and in many cases the right to request deletion or correction. The fourth principle is security responsibility: businesses need reasonable technical and administrative measures to protect data from unauthorized access, and a process for handling breaches when they happen.

Why scattered data makes compliance much harder

When customer data lives scattered across places – part in the CRM, part in Zalo history, part in individual department spreadsheets – responding to a simple request like “please delete all my data” becomes nearly impossible to do thoroughly, because nobody’s certain where else that data still exists. This is actually a further consequence of the duplicate data problem covered in an earlier post – the more scattered copies there are, the harder it is to control and stay compliant.

How a unified data source makes compliance easier

When customer data is consolidated into a single source in the CRM, applying these principles becomes far more achievable: consent can be logged with a timestamp right at the point of collection, rules can be set up to automatically delete data after a period of inactivity, and when a deletion or correction request comes in, it only needs to happen in one place instead of being tracked down across multiple systems.

How R HUB approaches this

When building a Lead Data Platform for a client, R HUB designs the system with data consolidated into one source with clear access controls, instead of leaving data scattered across tools nobody’s tracking – a technical foundation that makes compliance easier to manage, though the ultimate legal responsibility still rests with the business itself and should be confirmed by the appropriate legal counsel.

Where to start if you’ve never audited your compliance

The practical first step is an inventory: list every place customer data is currently being collected and stored – website forms, CRM, spreadsheets, chat apps – because you can’t manage what you haven’t fully mapped out. The next step is consulting a lawyer or compliance specialist to evaluate your current state against Decree 13’s requirements, since every business model has different points worth attention.

If you want to rebuild your customer data system around a more consolidated, easier-to-control structure, book a 30-minute conversation with R HUB and we’ll look at how your data is currently organized.