What is the PDPD DSAR deadline?

Under Decree 13/2023/ND-CP on Personal Data Protection (PDPD), the standard response deadline is 10 days. The counting method is calendar days, starting from the day of receipt.

PDPD is enforced by Ministry of Public Security (Department of Cybersecurity). Maximum penalties: Up to VND 100M (approx. USD $4,100) for administrative violations; criminal liability possible.

🇻🇳PDPD

Vietnam — PDPD DSAR Deadline Calculator

Q: Can I extend a PDPD deadline?

No. PDPD does not provide for deadline extensions under standard circumstances.

Calculate your exact response deadline under Decree 13/2023/ND-CP on Personal Data Protection (PDPD).

Configure your DSAR

Select jurisdiction, request type, and date — results update instantly.

Jurisdiction

Your deadline will appear here

Select a jurisdiction and request type to get started

PDPD Overview

Full Name

Decree 13/2023/ND-CP on Personal Data Protection

Effective Since

2023-07-01

Regulatory Authority

Ministry of Public Security (Department of Cybersecurity)

Official Text

View law

Maximum Penalties

Up to VND 100M (approx. USD $4,100) for administrative violations; criminal liability possible

Request Types & Deadlines

Request Type	Deadline	Extension
Right of Access Art. 9 — Right to know and access personal data being processed	10 days	Not available
Right to Correction Art. 9 — Right to request correction of personal data	10 days	Not available
Right to Deletion Art. 9 — Right to request deletion or cessation of processing	10 days	Not available
Right to Portability Art. 9 — Right to request provision of personal data	10 days	Not available
Right to Object Art. 9 — Right to object to processing of personal data	10 days	Not available

Extension Rules

PDPD does not provide for deadline extensions under standard circumstances.

Special Rules & Common Mistakes

•Must respond to data subject rights requests within 10 calendar days (72 hours for breach notification)
•Breach notification to regulatory authority within 72 hours of discovery
•Decree 13 is the primary data protection decree — not a comprehensive law
•Cross-border data transfers require an impact assessment dossier
•Data processor and controller must store personal data domestically unless transfer conditions are met
•Ministry of Public Security oversees enforcement

Compare with Other Jurisdictions

Law	Deadline	Method	Extension
🇻🇳 Vietnam PDPD	10 days	calendar days	No
🇪🇺 EU GDPR	1 months	calendar months	+2 months
🇬🇧 UK GDPR	1 months	calendar months	+2 months
🇺🇸 CCPA	45 days	calendar days	+45 days