2026 marks a turning point in cybersecurity governance in Vietnam. Decree 13/2023/ND-CP on personal data protection has been supplemented with detailed guidelines, the Cybersecurity Law continues to tighten, and new AI governance requirements are taking shape.
Decree 13/2023/ND-CP: 2026 Updates
The personal data protection decree has been supplemented with specific guidance on: mandatory Impact Assessment for sensitive data processing, Data Protection Officer requirements for large enterprises, and data breach notification timeline shortened to 48 hours.
- Mandatory Data Protection Impact Assessment (DPIA) for all sensitive data processing
- Appointing a Data Protection Officer (DPO) for enterprises with over 1000 employees
- Data breach notification within 48 hours to authorities
- Cross-border data transfer requires Impact Assessment and approval
Critical Information Infrastructure Requirements
Organizations operating critical information infrastructure (finance, energy, telecommunications, healthcare) must comply with stricter security requirements: mandatory annual penetration testing, 24/7 SOC monitoring, and periodically tested incident response plans.
AI Governance: Emerging Trends
Vietnam is drafting an AI governance legal framework, referencing the EU AI Act. Expected to include: AI system classification by risk level, transparency requirements for AI decisions, and audit requirements for high-risk AI deployments.
# Compliance checklist - DNA assessment
compliance_check:
decree_13_2023:
- dpia_completed: false
- dpo_appointed: false
- breach_notification_process: false
- cross_border_assessment: false
cybersecurity_law:
- annual_pentest: true
- soc_monitoring: false
- incident_response_plan: true
- ir_plan_tested: false
ai_governance:
- ai_inventory: false
- risk_classification: false
- transparency_docs: false
How DNA Helps with Compliance
DNA provides comprehensive compliance services for Vietnamese enterprises: penetration testing per Decree requirements, DPIA assessment, security architecture review, and consulting on building security programs that meet regulations.
warning Enterprises violating Decree 13/2023 can be fined up to 100 million VND per violation. DNA recommends starting compliance assessment immediately to avoid risks.