Labour Regulations Update in May 2023

I. Decree 13/2023/ND-CP on the personal data protection

On 17 April 2023, the Government issued the Decree No. 13/2023/ND-CP on protection of personal data in Vietnam the first time and shall take effect from 1 July 2023 (hereinafter referred to as “Decree 13”). Accordingly, Decree 13 has certain important points that Clients need to attentively comply with as follows:

• Scope of Application:

  Decree 13 applies to (i) Vietnamese agencies, organizations and individuals (operating in Vietnam and abroad); (ii) Foreign agencies, organizations and individuals in Vietnam or foreign agencies, organizations and individuals directly participating in or related to personal data processing activities in Vietnam.

• Decree 13 stipulates some specific definitions related to data processing:

  • Personal data is information in the form of symbols, letters, numbers, images, sounds or similar form on an electronic habitat that is associated with a particular person or used to identify a particular person. Personal data includes basic personal data and sensitive personal data.

  • Personal data processing is one or more activities that affect personal data, such as: collecting, recording, analyzing, confirming, storing, correcting, disclosing, combining, accessing, retrieving, recovering, encrypting, decrypting, copying, sharing, transmitting, providing, transferring, deleting, destroying personal data or other related actions.

• Data subject rights

  Decree 13 stipulates that data subject has the following rights (i) to be known; (ii) agree; (iii) access; (iv) withdraw consent; (v) delete data; (vi) restrict data processing; (vii) provide data; (viii) object data process; (ix) complain, denounce, sue; (x) claim for damages; (xi) self-protect.

• Consent of the personal data subject to the personal data process

  Unless otherwise provided by law, all activities in the personal data process require the consent of the personal data subject. Accordingly, Decree 13 stipulates the contents that data subjects need know and the form of expressing consent is as follows:

  • The consent of the data subject is only valid when the data subject voluntarily and fully knows the following contents: (i) The type of personal data to be processed; (ii) Purpose of processing personal data; (iii) Organizations and individuals are allowed to process personal data; (iv) The data to be processed is sensitive personal data (if any); and (v) Rights and obligations of data subject.

  • The consent of the data subject must be expressed clearly, specifically in writing, by voice, by ticking the consent box, in the syntax of consent by text message, by selecting consent settings or by another action to show the consent.

Noted that this consent must be expressed in a format that can be printed, copied in writing, including in electronic or verifiable formats. In particular, the data subject’s silence or non-response is not considered as consent.

• Cases where the consent of the personal data subject is not required for the processing of personal data, such as:
  The disclosure of personal data in accordance with the law; fulfilment of the contractual obligations of the data subject with relevant agencies, organizations and individuals in accordance with the law.

• Notification of the processing of personal data:

  • The Personal Data Controller, Personal Data Controller-cum-Processor must notify the data subject of the processing of personal data before proceeding with the personal data processing. The notification is made once and includes the following contents: (i) Purpose of processing; (ii) The type of personal data used in connection with the purpose of processing; (iii) Handling method; (iv) Information about other organizations and individuals related to processing purposes; (v) Consequences, unexpected damages are likely to occur; and (vi) Data processing start and end time.

  • The notification to the data subject must be presented in a format that can be printed, copied in writing, including in electronic or verifiable formats.
  • The notification is not required in the following cases: The data subject knows and fully agrees with the contents from points i – vi Section 6(a) hereof before agreeing to let the Personal Data Controller, Personal Data Controller-cum-Processor collect personal data.

• Providing personal data to other individuals and organizations

  The Personal Data Controller, Personal Data Controller and Processor can provide the data subject’s personal data for other organizations and individuals with the consent of the data subject, unless otherwise provided by law.

• Notification of violation of personal data protection regulations
  • In case of detecting a violation of personal data protection regulations, the Personal Data Controller, Personal Data Controller and Processor shall notify the Ministry of Public Security (Department of Cyber Security and Hi-Tech Crime Prevention and Control) within 72 hours after the violation occurs according to the Form.
  • The Personal Data Processor must notify the Personal Data Controller as quickly as possible after detecting a violation of the regulations on personal data protection.
  • The Personal Data Controller, Personal Data Controller and Processor must make a Written Confirmation of the violation of personal data protection regulations.

• Assessment of the impact of personal data processing

  • The Personal Data Controller, the Personal Data Controller and Processor shall make and keep its Personal Data Processing Impact Assessment Record from the time of starting processing personal data.

  • The Personal Data Processor shall make and keep the Personal Data Processing Impact Assessment Record in case of performing contract with the Personal Data Controller.

Note: Personal Data Processing Impact Assessment Record must always be available to serve the inspection and assessment activities of the Ministry of Public Security and must be sent to the Ministry of Public Security 01 original copy according to Form No. 04 in the Appendix of the Decree 13 within 60 days from the date of processing of personal data.

• Transfer of personal data abroad

  • Personal data of Vietnamese citizens is transferred abroad in case that the Party transferring data abroad (i) prepares and maintains a Dossier of assessment of the impact of transferring personal data abroad (hereinafter referred to as “Dossier”); (ii) sends 01 original of the Dossier to the Ministry of Public Security within 60 days from the date of processing of personal data; (iii) sends a written notice to the Ministry of Public Security of the data transfer and contact details of the organization or individual in charge after the data transfer takes place successfully; and (iv) completes the Dossier of assessment of the impact of transferring personal data abroad in case the dossier is not complete and accurate in accordance with the regulations at the request of the Ministry of Public Security (if any).
  • Based on the specific situation, the Ministry of Public Security shall decide to inspect the transfer of personal data abroad once a year, unless it detects any violation against the law on protection of personal data in this Decree or an incident of disclosure or loss of personal data of Vietnamese citizens occurs.
  • The Ministry of Public Security shall decide to request the Party transferring data abroad to stop transferring the personal data abroad in case (i) When it is discovered that the transferred personal data is used for activities violating the interests, national security of the Socialist Republic of Vietnam; (ii) The party transferring data abroad does not update or supplement the Dossier of assessment of the impact of transferring personal data abroad when there is a change in the content of the dossier sent to the Ministry of Public Security; (iii) The Party transferring data abroad does not complete the Dossier of assessment of the impact of transferring personal data abroad in case the dossier is not complete and accurate in accordance with the regulations at the request of the Ministry of Public Security; (iv) An incident of disclosure or loss of personal data of Vietnamese citizens occurs.

• Personal data protection department and individual designation
  An enterprise has the responsibility to designate the individual and department to protect the personal data. Micro-enterprises, small enterprises, medium-sized enterprises, start-up enterprises (except those directly engaged in the business of processing the personal data) have the right to choose to be exempted from regulations on appointment of individuals and department to protect the personal data during the first 2 years since the establishment of the enterprise.

II. Drafted circular amending circular 105/2020/TT-BTC guiding on tax registration and circular 19/2021/TT-BTC guiding on e-transactions in the field of tax

With the draft content of this Circular, the Taxpayers should take noted that:

• Taxpayers who are individuals or representatives of households who are granted personal identification numbers in accordance with the law on citizen identification shall continue to use the issued tax code until the tax authorities notify them to use the personal identification numbers as the tax code.
• The tax authority shall notify the taxpayer of using the personal identification number instead of the issued tax code when the taxpayer registers to change their personal information to the personal identification number according to the Circular 105/2020/TT-BTC, or the tax authority automatically converts the issued tax code to the personal identification numbers to use instead of the tax code as prescribed.
• From the date the taxpayer receives the Notification using the personal identification number as the tax code, the taxpayer shall use such personal identification number instead of the tax code when carrying out tax procedures, including the supplement and adjustment of tax obligations arising under the previously issued tax code. At the same time, the tax authority monitors and manages all data of taxpayers, data for registration of dependent reduction based on family circumstances using personal identification numbers.

The using an individual identification number instead of a tax code was specified in clause 7, Article 5 of the Law on tax administration no. 38/2019/QH14 dated 13 June 2019 as follows “When the personal identification number is issued to all citizens, the personal identification number shall be used instead of the tax code”.

III. Official letter 1483/TCT-KK of the general department of taxation dated 24 April 2023 implementation of tax payment using ID code

On 24 April 2023, the General Department of Taxation issued the Official Letter 1483/TCT-KK on the implementation of tax payment using ID code. Accordingly, the General Department of Taxation guides the Tax Departments of the provinces and centrally-run cities, the Tax Department of large enterprises to implement the following contents:

• Issuance and notification of the ID-payment-code to the taxpayers.
• Provide the information of ID-payment-code to the collection coordination organization.
• The usage of ID-payment-code.

The provision of ID-payment-code for Taxpayers, provision of electronic tax payment services using ID-payment-code at the General Department of Taxation’s Web Portal, upgrading the application system to meet the tax management of the Taxpayers’ obligation by ID take effect from 10 May 2023.

The payment to the state budget using ID-payment-code through the State Treasury, the National Public Service Portal, the bank, the General Department of Taxation will continue to provide instructions for the enterprises/ collection coordination organizations in completing the procedures, the application using ID- payment-code and notify the tax authorities, taxpayers information and implementation.

IV. Circular 09/2023/TT-BYT dated 05 May 2023 amendments the circular 14/2013/TT-BYT guiding on medical examination

On 5 May 2023, the Ministry of Health issued the Circular 09/2023/TT-BYT (“Circular 09”) amending a number of contents of the Circular 14/2013/TT-BYT guiding on medical examination. Accordingly, Circular 09 amends and supplements the following two important points:

• Issuing a new form of periodic health examination Book.
• Periodic health examination must follow the contents recorded in the new periodic health examination Book.

For female employees, during regular health check-ups, they are entitled to gynecological examination, cervical cancer screening, breast cancer screening, uterine adnexal ultrasound – appendages (when indicated by the examination doctor).

Circular 09 takes effect from 20 June 2023.

V. Decree 24/2023/ND-CP dated 14 May 2023 regulating base wage from 01 July 2023

On 14 May 2023, the Government issued Decree 24/2023/ND-CP (“Decree 24”) stipulating the base wage for cadres, civil servants, public employees and armed forces.

Accordingly, from 1 July 2023, the base wage will increase as follows:

The increase in the base wages will lead to an increase in the contribution of social insurance, health insurance, trade union funds and trade union fees.

Specifically, from 1 July 2023, the maximum salary (capped salary) used as a basis for compulsory social insurance and health insurance contributions will increase from VND 29,800,000/month to VND 36,000,000/month (equivalent to 20 times the base wage). The contribution of 2% of the monthly trade union funds (this 2% amount is of the salary fund as the basis for paying social insurance premiums for employees) of the employer will also because the salary fund as the basis for paying social insurance premiums for employees increases.

In addition, the increase in the base wage also leads to an increase in the levels of allowances for employees such as a one-time allowance for childbirth, convalescence, health rehabilitation, etc.

Decree 24 takes effect from 1 July2023.

Contact information

For further information on the latest labor regulation updates, please kindly contact us at: