Decree No. 356/2025/ND-CP ('Decree
356'), effective from 1 January 2026, provides
comprehensive guidance for implementing certain provisions of the
Personal Data Protection Law ('PDPL').
Compared with Decree No. 13/2023/ND-CP, Decree 356 marks a clear
shift from a principle-based framework to more specific, concrete
compliance requirements that are practically enforceable and
verifiable.
This update outlines the key provisions of Decree 356 that
organisations should comply without delay.
I. Highlights of Decree 356
1. Stricter compliance obligations for handling
sensitive personal data
Decree 356 provides a wider non-exhaustive list of sensitive
personal data as compared to previous regulations.1
Notably:
