⚠️ IMPORTANT WARNING — read before researching: Decree 13/2023/ND-CP EXPIRED on 01/01/2026 (under Clause 2, Article 42 of Decree 356/2025/ND-CP). Every guide on “personal data collection notices under Article 13 of Decree 13/2023” is now outdated — never cite Article 13 of Decree 13/2023 as current law. This article answers under the new framework: the Personal Data Protection Law 91/2025/QH15 (effective from 01/01/2026).
1. Why the question mentions Decree 13 but this article answers under Law 91/2025
The question “what contents must a personal data collection notice under Decree 13 include” dates from when Decree 13/2023 was in force (2023–2025) and its Article 13 was the common reference. Since 01/01/2026, Decree 13/2023 has been repealed, and the current framework consists of:
- The Personal Data Protection Law 91/2025/QH15 — effective from 01/01/2026.
- Decree 356/2025/ND-CP (31/12/2025) — guiding Law 91/2025; it issues 10 forms but no standalone “data collection notice” form.
- Decree 330/2026/ND-CP (19/8/2026) — administrative sanctions for personal data protection violations, with fines up to VND 3 billion.
2. No state-issued standard “data collection notice” form
Even under the new framework, the State has not issued a dedicated form for “personal data collection notices”. Organizations draft their own notice content but must include all information that Law 91/2025 requires data subjects to be told.
3. Notice contents under Articles 9.2, 11.1, and 4.1.a of Law 91/2025
Under these provisions, a personal data collection notice must cover:
3 pieces of information the data subject must clearly know:
- The purpose of personal data processing;
- The types of personal data collected and processed;
- The duration of data processing.
4 principles of consent (the basis for collecting and processing data):
- Voluntary;
- Specific;
- Clear;
- Informed.
Rights of the data subject (to be communicated in the notice), including:
- The right to withdraw consent;
- The right to request deletion of personal data;
- The right to lodge complaints when rights are infringed.
4. Transitional rule: data being processed before 01/01/2026
Article 39 of Law 91/2025 provides transitional rules for personal data processing activities already underway before 01/01/2026. Organizations should review notices and consent mechanisms deployed under Decree 13/2023 and adjust them to the new law requirements.
5. Sanctions (Decree 330/2026)
Decree 330/2026/ND-CP (19/8/2026) sets administrative sanctions for personal data protection violations with fines of up to VND 3 billion. Failing to provide the full required notice contents, or collecting and processing data without valid consent, are sanctionable acts.
Frequently asked questions
Can Article 13 of Decree 13/2023 still be applied?
No. Decree 13/2023 expired on 01/01/2026 (Clause 2, Article 42 of Decree 356/2025). All current references must follow Law 91/2025 and the new guiding decrees.
Does Decree 356/2025 provide a data collection notice form?
No. Decree 356/2025 issues 10 forms guiding Law 91/2025 but no standalone “data collection notice” form — businesses draft the content themselves under Articles 9.2, 11.1, and 4.1.a of Law 91/2025.
Must consent be re-obtained for data collected before 2026?
Review under the transitional provisions of Article 39 of Law 91/2025; where the old consent mechanism does not meet the four principles (voluntary, specific, clear, informed), it must be adjusted and supplemented.
Legal references
- Personal Data Protection Law 91/2025/QH15 (Articles 4, 9, 11, 39), effective 01/01/2026.
- Clause 2, Article 42 of Decree 356/2025/ND-CP (31/12/2025) — repealing Decree 13/2023.
- Decree 330/2026/ND-CP (19/8/2026) — administrative sanctions, fines up to VND 3 billion.
Need a personal data protection compliance review? The FLAT Law Firm team advises on the transition from Decree 13/2023 to Law 91/2025, reviewing data collection notices and consent mechanisms under current regulations. Contact us at contact us.
The information in this article is for general reference based on the laws in force at the time of writing (14/10/2026) and does not constitute legal advice for any specific case.
Transparency note: This article was drafted by the FLAT Law Firm AI content production system and has passed the AI content review council (AI Legal Council QA). It has not been reviewed by a licensed human lawyer.