Article 01
Overview of Decree 13/2023/ND-CP
Decree 13/2023/ND-CP on personal data protection was issued by the Government on April 17, 2023, and took effect on July 1, 2023. It is currently the highest-level legal instrument in Vietnam governing the processing of personal data.
The Decree applies to all domestic and foreign organizations and individuals that process the personal data of Vietnamese citizens — including enterprises that use software such as DearPulse.
Article 02
DearPulse's Role
Within the framework of Decree 13/2023, DearPulse and the Customer have distinct roles:
Customer (Enterprise) — Data Controller
- Determines the purposes, scope, and means of data processing
- Bears primary legal responsibility to the Data Subject
- Must obtain the consent of the Data Subject (employee)
- Configures thresholds, access rights, and retention periods
DearPulse — Data Processor
- Processes data on behalf of the Customer under contract
- Provides technical tools to help the Customer achieve compliance
- Secures data by applying appropriate technical and organizational measures
- Supports the Customer in responding to Data Subject requests
- Signs a Data Processing Agreement (DPA) with the Customer
Article 03
Decree 13/2023 Compliance Features in DearPulse
- A Terms of Use screen with a mandatory checkbox during DearAgent installation — satisfying the “demonstrable consent” requirement (Article 11)
- AES-256 encryption at rest and TLS 1.3 in transit — satisfying data protection requirements (Article 26)
- Granular role-based access control (RBAC) — satisfying the principle of necessity and minimality (Article 7)
- An immutable audit log for every instance of sensitive data access
- Configurable automatic retention periods (6–12 months), with automatic deletion upon expiry
- Tools to export/delete personal data in response to Data Subject requests
- Two-factor verification for access to sensitive data (such as decrypting keylogs)
- Data Protection Impact Assessment (DPIA) support reports — available to Enterprise customers
Article 04
Compliance Checklist for Customers
To ensure compliance with Decree 13/2023 when using DearPulse, Customers should take the following steps:
Before Deployment
- Update internal labor regulations and employment contracts to include provisions on performance monitoring
- Hold an internal communication session on the deployment of DearPulse, its purpose, and its scope
- Designate a personal data processing focal point (a DPO or equivalent) within the organization
- Sign a Data Processing Agreement (DPA) with DearPulse
During Deployment
- Install DearAgent on each machine in the presence of the employee, who reads and accepts the terms themselves
- Configure the minimum data collection scope necessary and avoid enabling unneeded features
- Create role-based administrator accounts — do not share a single account
- Retain evidence of employee consent for presentation when required
During Ongoing Use
- Periodically review access rights and remove accounts no longer in use
- Respond to employee requests to view, correct, or delete data within 72 hours
- Report any data breach incidents to the Ministry of Public Security within 72 hours as required by Article 23
- Conduct a DPIA annually or whenever there is a major change in data collection practices
Article 05
Data Breach Response Process
DearPulse operates an incident response process aligned with the ISO 27035 standard:
- Incident detection through 24/7 monitoring systems
- Classification of severity and scope of impact
- Containment, mitigation, and recovery
- Notification of affected Customers within 24 hours of detection
- Support for Customers in reporting to the Ministry of Public Security under Article 23 of Decree 13/2023
- Root-cause analysis and process improvement
Article 06
Supporting Data Subject Rights
DearPulse provides tools to help Customers respond to Data Subject (employee) requests under Article 9 of Decree 13/2023:
- Right to be informed: providing documentation describing how data is collected
- Right of access: exporting personal data files in a standard format
- Right to rectification: updating employee information in the system
- Right to erasure: deleting all of an employee's personal data
- Right to restrict processing: temporarily suspending data collection for a specific individual
- Right to object: configuring exclusions for certain data types
Article 07
Compliance Contact
- DearPulse DPO: dpo@dearpulse.net
- Compliance email: compliance@dearpulse.net
- Legal entity: DEARTECH SOFTWARE COMPANY LIMITED (CÔNG TY TNHH DEARTECH SOFTWARE) — Vietnam
Need clarification on a term?
Contact DearPulse through the official channels below.