A data privacy policy within a company serves as a fundamental framework for protecting sensitive information belonging to both the enterprise and its customers. Every company should develop a clear policy that complies with applicable legal regulations. Such a policy enables effective data management, helps prevent legal risks, and safeguards customer rights. Regular compliance and periodic review of the policy are optimal measures to ensure data security within the enterprise.

I. The Impact of a data privacy policy in a company

A data privacy policy plays a crucial role in protecting sensitive information, including customer data, employee data, and other critical business information. A well-defined policy allows enterprises to control the collection, storage, processing, and sharing of data, thereby reducing the risk of data breaches or unauthorized use.

In addition, a data privacy policy contributes to enhancing the reputation of the enterprise and building trust among customers and business partners. Compliance with such policies also helps companies meet legal requirements, minimize the risk of regulatory violations, and mitigate potential legal consequences.

II. Understanding the data privacy policy in a company

1. What role does a data privacy policy in a company play in protecting sensitive information?

Pursuant to Clause 4 Article 2 of Decree No. 13/2023/ND-CP, sensitive personal data includes information relating to political opinions, religious beliefs, health conditions, private life, ethnic origin, genetic and biological characteristics, sexual life, criminal records, financial information, and personal location data.

A company’s data privacy policy establishes procedures and technical measures designed to protect such information, preventing unauthorized access, data leakage, or misuse.

Proper implementation of a lawful policy helps companies safeguard the legitimate rights of individuals, comply with personal data protection regulations, minimize legal risks, and enhance the credibility of the enterprise.

2. What elements are typically included in a company’s data privacy policy?

To ensure the protection of personal and sensitive data, a company’s data privacy policy must comply with the principles and provisions of Decree No. 13/2023/ND-CP. Basic elements generally include:

  • Principles of personal data processing: Personal data must be processed lawfully, for registered purposes, within limited scope, and must be updated when necessary. The purchase or sale of personal data is strictly prohibited unless otherwise provided by law (Article 3 of Decree No. 13/2023/ND-CP).
  • Notification to data subjects: The company must clearly notify data subjects of the purposes of processing, types of data used, processing methods, relevant organizations or individuals involved, possible consequences, and the data retention period before processing takes place (Article 13 of Decree No. 13/2023/ND-CP).
  • Data protection measures: The company must implement managerial, technical, investigative, procedural, and other lawful measures to protect data throughout the processing lifecycle (Article 26 of Decree No. 13/2023/ND-CP).
  • Employee rights and responsibilities: It is necessary to clearly define the duties and responsibilities of departments and individuals regarding data confidentiality and protection.
  • Incident and violation handling procedures: It is requested to provide guidance on how to detect, report, and address violations related to personal data.
  • Training and awareness programs: It is important to regularly train employees on data protection practices and update them on relevant legal regulations.

These elements enable companies to protect sensitive information, comply with legal requirements, minimize legal risks, and maintain credibility with customers and partners.

3. How can the effectiveness of a company’s data privacy policy be evaluated?

To evaluate the effectiveness of a data privacy policy, a company must prepare and maintain a Personal Data Processing Impact Assessment Dossier in accordance with Article 24 of Decree No. 13/2023/ND-CP. Such a dossier includes essential information regarding the Personal Data Controller and Data Processor, the purpose of processing, types of personal data involved, organizations or individuals receiving the data, cases of cross-border data transfer, the duration of processing, expected timelines for data deletion or destruction, data protection measures, as well as assessments of potential consequences and mitigation measures.

Evaluation of effectiveness may be conducted through:

  • Periodic review of the impact assessment dossier to ensure that it remains complete and updated whenever there are changes in data processing activities.
  • Comparison between actual practices and the privacy policy to identify non-compliance, remaining vulnerabilities, and levels of risk.
  • Reporting to regulatory authorities by submitting the original impact assessment dossier to the Ministry of Public Security (Department of Cybersecurity and High-Tech Crime Prevention) within 60 days from the commencement of data processing.
  • Updating the dossier upon request from competent authorities to ensure compliance with legal requirements.

Through these assessments, companies can identify vulnerabilities, enhance personal data protection, ensure legal compliance, and minimize legal risks.

III. Legal regulations related to data privacy policies in companies

1. Must a company’s data privacy policy comply with legal regulations?

A company’s data privacy policy must strictly comply with applicable legal provisions to ensure lawful and secure personal data processing. Specifically:

  • Clause 6 Article 3 of Decree No. 13/2023/ND-CP requires that personal data be protected and secured throughout the entire processing process, including the prevention of violations, loss, destruction, or damage resulting from incidents through appropriate technical measures.
  • Article 26 of Decree No. 13/2023/ND-CP provides that data protection measures must be implemented from the beginning and throughout the processing process, including managerial measures, technical safeguards, measures implemented by state authorities, investigative and procedural measures, and other measures prescribed by law.
  • Clause 1 Article 38 of Decree No. 13/2023/ND-CP stipulates that Personal Data Controllers are responsible for implementing and updating organizational and technical measures to ensure that data processing activities comply with legal requirements.
  • Article 15 of the Law on Data 2024 provides that data governance includes the development of policies, plans, programs, procedures, and standards to manage data effectively and continuously, ensuring completeness, accuracy, integrity, consistency, standardization, security, confidentiality, and timeliness.

Therefore, a data privacy policy is not merely an internal document but forms part of the overall data governance framework, ensuring that all personal data processing activities within the company are lawful, secure, and effective.

2. What obligations does a company have in notifying customers about its data privacy policy?

A company is required to inform customers about the processing of their personal data before collecting, using, storing, or sharing such information to ensure transparency and compliance with personal data protection laws.

Specifically, pursuant to Article 13 of Decree No. 13/2023/ND-CP, the Personal Data Controller or Personal Data Processor must notify the data subject once regarding matters such as the purpose of processing, types of data used, processing methods, relevant organizations or individuals involved, potential consequences, and the duration of data processing before initiating such processing.

Fulfilling such a notification obligation helps customers understand how the company collects and uses their data, enhances their control over personal information, and enables the enterprise to comply with legal regulations while reducing legal risks related to data processing.

3. Can a company be taken sanctions for violating its data privacy policy?

Pursuant to Article 8 of the Personal Data Protection Law 2025, if a company violates its data privacy policy, depending on the nature, severity, and consequences of the violation, it may take the following sanctions:

  • Administrative fines: The maximum administrative fine for violations in the sector of personal data protection may reach 3 billion VND. If the violation involves the purchase or sale of personal data, the fine may reach up to ten (10) times the unlawful revenue generated from the violation. Violations relating to cross-border data transfers may result in fines of up to 5% of the company’s revenue in the preceding year.
  • Criminal liability: If individuals within the enterprise intentionally disclose, trade, or unlawfully use personal data, or allow data to be compromised on a large scale causing significant damage, they may be prosecuted under Article 288 of the Criminal Code 2015 (as amended and supplemented in 2017) for the offense of illegally providing or using information on computer or telecommunications networks.
  • Civil liability for damages: The company may also be required to compensate individuals or organizations for damages caused by the violation in accordance with Article 584 of the Civil Code 2015.

Failure to comply with a data privacy policy therefore not only increases information security risks but may also expose the company to strict legal sanctions, significant financial consequences, reputational damage, and disruption of business operations.

IV. Questions related to data privacy policies in companies

1. Who is responsible for verifying the validity of a company’s data privacy policy?

The primary responsible party is the Personal Data Controller, as provided under Article 38 of Decree No. 13/2023/ND-CP. The controller must apply appropriate organizational and technical measures to demonstrate that data processing complies with legal requirements, record and maintain logs of processing activities, review and update security measures, and cooperate with competent authorities when necessary.

Additionally, the Personal Data Processor also participates in monitoring and compliance under contractual arrangements, ensuring that data processing is conducted in accordance with agreed terms, applying protective measures, assuming liability for damages arising from violations, deleting or returning data after processing is completed, and cooperating with regulatory authorities.

Accordingly, verification of the effectiveness of a data privacy policy involves coordination between the Personal Data Controller and the Personal Data Processor to ensure that data is managed safely, transparently, and in compliance with legal regulations.

2. How can a company ensure that its data privacy policy is properly implemented?

To effectively implement a data privacy policy, companies must identify and manage risks arising from data processing activities in accordance with Article 25 of the Law on Data 2024. These risks include privacy risks, cybersecurity threats, access management risks, and other risks associated with data processing.

The data owner must conduct risk assessments, implement appropriate protection measures, promptly address incidents, and notify relevant parties when necessary. For core or important data, periodic risk assessments should be conducted in coordination with specialized cybersecurity and information security units under the Ministry of Public Security, the Ministry of National Defense, or other relevant authorities.

Therefore, implementing a privacy policy requires not only internal regulations but also continuous risk assessment, technical protection measures, and coordination with competent authorities to ensure lawful and secure data processing.

3. Can a data privacy policy help reduce legal risks? Why?

A data privacy policy ensures that the collection, processing, and storage of personal data comply with applicable laws such as Decree No. 13/2023/ND-CP, the Law on Data 2024, and the Personal Data Protection Law 2025. When the policy is properly implemented, the company has a legal basis to demonstrate compliance with data protection obligations, thereby reducing the likelihood of administrative sanctions, criminal liability, or compensation claims.

At the same time, compliance with such policies strengthens customer trust, reduces disputes, and mitigates legal risks arising from data breaches or misuse.

4. Can customers claim compensation if a company fails to comply with its data privacy policy?

Pursuant to Clause 10 Article 9 of Decree No. 13/2023/ND-CP, if a company fails to comply with its data privacy policy, the data subject (customer) has the right to claim compensation for damages in accordance with applicable laws, unless otherwise agreed between the parties or otherwise provided by law. This provision helps protect the lawful rights and interests of customers and ensures that companies are held accountable for risks or losses involving personal data.

V. Are you looking for a reputable law firm to assist with data privacy policy issues?

If you are experiencing difficulties in developing, reviewing, or addressing legal issues related to a company’s data privacy policy; with a team of experienced lawyers, NPLaw is willing to assist. We provide legally compliant advice, support in drafting policies, ensure compliance with data protection regulations, minimize legal risks, and protect the legitimate interests of enterprises. With deep expertise in data law and cybersecurity regulations, NPLaw accompanies clients to ensure effective and secure data protection practices. Let us help you resolve all legal concerns in a professional and efficient manner.

The information above is provided for reference purposes only. If you require detailed advice regarding a specific case, please contact NPLaw Law Firm for immediate consultation.