Vietnam PDPD: every control, and what you already have

36 controls 144 frameworks share controls with it Vietnam verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
Bahrain PDPL	3	measure it →
Barbados Data Protection Act 2019	3	measure it →
DAMA-DMBOK2	3	measure it →
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)	3	measure it →
FTC GLBA Safeguards Rule (16 CFR Part 314)	3	measure it →
ISO/IEC 27400:2022	3	measure it →
NIST Privacy Framework	3	measure it →
Peru DPL	3	measure it →
POPIA	3	measure it →
Qatar DPL	3	measure it →
Singapore Government Instruction Manual on ICT&SS Management (IM8)	3	measure it →
South Korea ISMS-P	3	measure it →

Every control

Code	Control	Also in
`VIETNAMPDP-1`	Scope, Categorisation, Lawful Basis	53
`VIETNAMPDP-2`	Consent and Notice	90
`VIETNAMPDP-3`	Data Subject Rights	97
`VIETNAMPDP-4`	Security and DPIA	0
`VIETNAMPDP-5`	Cross-Border Transfer Impact Assessment	0
`VIETNAMPDP-6`	DPO, Records, Breach, MPS Cooperation	0
`1-2`	Scope, application and definitions	0
`10`	Obligations of the data subject	0
`11`	Consent of the data subject	0
`12`	Withdrawal of consent	0
`13`	Notification before processing	0
`14`	Provision of personal data within 72 hours	0
`15`	Rectification of personal data	0
`16`	Storage, erasure and destruction of personal data	0
`17`	Processing without consent: the exhaustive grounds and the burden of proof	0
`18`	Audio and video recording in public places	0
`19`	Personal data of persons declared missing or deceased	0
`20`	Children's personal data	0
`21`	Personal data in marketing and advertising services	0
`22`	Prevention of unauthorised collection, transfer and trading of personal data	0
`23`	Notification of a breach of personal data protection regulation within 72 hours	0
`24`	Personal data processing impact assessment dossier	0
`25`	International transfer of Vietnamese citizens' personal data	0
`26-27`	Personal data protection measures and basic personal data protection	0
`28`	Protection of sensitive personal data and the protection department and officer	0
`29-31`	The agency in charge, the national portal, conditions and funding	0
`3`	Principles for personal data protection and demonstrated compliance	0
`32-37`	Responsibilities of ministries, agencies and provincial People's Committees	0
`38`	Responsibility of the controller	0
`39`	Responsibility of the processor	0
`4-8`	Handling of breaches, state management, applicable law, international cooperation and prohibited acts	0
`40-41`	Responsibilities of the controlling and processing entity and the third party	0
`42`	Responsibility of related institutions and individuals	0
`43-44`	Effect, the small-enterprise exemption and implementation responsibility	0
`9`	Rights of the data subject and the 72-hour restriction and objection duties	0
`REGIME`	Status: Decree 13 expired on 1 January 2026, replaced by the Law on Personal Data Protection 91/2025/QH15 and Decree 356/2025/ND-CP	0

Tell me when Vietnam PDPD files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

Sensitive data inventory
Age verification mechanism
COPPA compliance attestation
Age verification step before processing
Dual consent records (child from seven, parent or guardian)
Erasure on withdrawal or authority request
Breach response procedure with the 72-hour A05 notification on Form 03 and the four content items
Processor contracts requiring notice without undue delay
Breach confirmation records and A05 coordination log
Breach procedure with the 24-hour response start, the 72-hour URCDP notification and the data subject communication test

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

No age verification named by 7 frameworks
Processors with no notification duty named by 3 frameworks

What this page is

A control-level reference for Vietnam PDPD, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition