Decree 13/2023 for marketers: three things to remember

Vietnam's Decree 13/2023/ND-CP on personal data protection changed how marketing works in the country, but most articles about it are written for lawyers. The three points below are the ones that affect your daily work. This article is not legal advice.

Point 1 — the people described have the right to ask

A person whose personal data is being processed has the right to know, to see, to correct and to delete. Which means any list you hold may be asked to have one row removed.

The practical consequence: do not build a process that depends on a list you cannot partially delete. And if you use a third-party tool, ask them how they handle deletion requests.

CIA has a data request page for this. An account that has submitted a block request is refused before credits are charged — meaning a paying customer also cannot run an analysis on that person.

Point 2 — contact data is the most sensitive category

Email addresses and personal phone numbers are personal data. Collecting them by guessing, or buying them from somewhere, is the riskiest part of any marketing operation.

This is why CIA does not find email addresses, does not find personal phone numbers, and has no endpoint returning a list of people to contact. Phone numbers appear only for businesses in directories such as Google Maps, because that is the business's own public line. See what public data means.

Point 3 — public does not mean freely processable

The fact that something is publicly displayed does not automatically permit every use. Reading and analysing to make a business decision is different from building a database about each individual and then contacting them.

A practical line that is easy to remember: analysing a group is safer than targeting an individual. Reading 300 comments to learn what customers complain about is group analysis. Listing each commenter so you can contact them is something else.

Three things to do in daily work

Record the source of every list you hold. When a request comes, you need to know where the data came from.

Have a way to delete one row. Not only the whole table.

State in reports that figures are estimates from public data. It is honest and it protects you.

What to ask any tool you use

Four questions, and the answers should be on their own site:

1. Does it return email addresses or personal phone numbers?
2. Is there any endpoint that returns a list of people?
3. How are deletion requests handled?
4. Is the data official analytics or an estimate from public data?

A tool that cannot answer question 3 is a tool pushing risk onto you.

Frequently asked questions

Do I have to register anything? It depends on your scale and the kind of processing. Ask a lawyer for your situation; this article is not legal advice.

Does reading public comments need consent? See point 3 above on the difference between group analysis and individual targeting. For a specific situation, ask a lawyer.

How long does CIA keep data? See the privacy policy and the data request page.