On 31/12/2025, the Government issued Decree 356/2025/ND-CP detailing and guiding the implementation of the Personal Data Protection Law (Law No. 91/2025/QH15). The Decree takes effect on 1/1/2026 and replaces Decree 13/2023/ND-CP, the document many enterprises have been familiar with over the past few years. This article summarizes the points enterprises need to update right away.
The most notable point: the 72-hour incident notification deadline
When a violation of personal data protection rules is discovered (for example, a leak or loss of data), the data controller or the controller-processor must:
- Notify the Department of Cybersecurity and High-Tech Crime Prevention (A05, Ministry of Public Security) no later than 72 hours after the violation occurs, using the prescribed form (Form No. 08 issued with the Decree).
- Notify the affected data subjects within 72 hours of discovering the violation, or make a public announcement in certain cases.
- Prepare and retain the violation record for at least 5 years from the date the incident is fully remedied, for inspection and audit purposes.
The 72-hour timeframe already appeared in Decree 13/2023, but Decree 356/2025 sets out the procedure, forms and mandatory notification content more clearly and in more detail.
Response deadlines for data subject requests
Unlike Decree 13/2023, which only provided general rules, Article 5 of Decree 356/2025 sets a specific deadline for each type of request. For example, the data controller must respond within 2 working days to a data subject's request to withdraw consent or to restrict or object to the processing of their data.
Sector-specific rules
The Decree adds specialized requirements that Decree 13/2023 did not have:
- Finance and banking (Article 8): when sensitive data is found exposed or lost, credit institutions must notify the specialized authority and the data subject within no more than 72 hours; when requesting consent, they must state the purpose (including credit scoring and ranking), the retention period and the source of the data.
- Big-data processing (Article 9): multi-factor authentication (password combined with OTP, digital signature or biometrics) and strict access authorization are mandatory.
- AI systems and virtual universes (Article 10): data subjects have the right to request correction of personal data processed by these systems.
- Data sharing and transactions: a shift from a "prohibition" mindset to conditional management: paid transfer of data is allowed but requires technical systems that ensure clear consent for each transfer, and data must be de-identified before being traded on a data exchange.
Personal data protection staff
The Decree sets out competency conditions for staff appointed by an organization to be in charge of personal data protection: at least 2 years of experience in related fields (legal, information technology, cybersecurity, data security, risk management, compliance control and so on) and having completed training in legal knowledge and professional skills in personal data protection.
What should enterprises do before 1/1/2026 (or right now, if they have not had time to prepare)?
- Review the records and policies built under the old Decree 13/2023 and compare them with the new points above.
- Build or update an Incident Response Plan. 72 hours is a short window that must be prepared for in advance; it cannot be handled in time by waiting until the incident happens.
- For enterprises in finance and banking or big-data processing, separately review the additional requirements in Articles 8 and 9.
These are also topics covered in AISA's free compliance assessment, helping enterprises quickly self-review before going into detailed legal advice.
How much does technology help?
The 72-hour incident notification requirement is only feasible when the enterprise knows exactly which documents / data were affected, who accessed them and when. This is precisely the data that document-centric security platforms such as the product record in access logs, significantly shortening the time to establish the scope of an incident compared with manual lookup.
