Does the Decree 13/2023/ND-CP on protection of personal data in Vietnam come into effect from July 01, 2023?
Is there the latest Decree on protection of personal data in Vietnam?
On April 17, 2023, the Government issued Decree 13/2023/ND-CP on the protection of personal data. The Decree provides for personal data protection and responsibilities of relevant agencies, organizations and individuals for protection of personal data.
In Clause 1, Article 2 of Decree 13/2023/ND-CP, the concept of personal data is defined as follows:
“Personal data” refers to electronic information in the form of symbols, letters, numbers, images, sounds, or equivalences associated with an individual or used to identify an individual. The personal data includes general personal data and sensitive personal data.
Accordingly, personal data personal information in the electronic environment, including: General personal data and sensitive personal data. Specifically:
(1) General personal data includes:
- Last name, middle name and first name, other names (if any);
- Date of birth; date of death or going missing;
- Gender;
- Place of birth, registered place of birth; place of permanent residence; place of temporary residence; current place of residence; hometown; contact address;
- Nationality;
- Personal image;
- Phone number; ID Card number, personal identification number, passport number, driver’s license number, license plate, taxpayer identification number, social security number and health insurance card number;
- Marital status;
- Information about the individual’s family relationship (parents, children);
- Digital account information; personal data that reflects activities and activity history in cyberspace;
- Information associated with an individual or used to identify an individual other than that specified in Clause 4 of this Article.
(2) Sensitive personal data includes:
- Political and religious opinions;
- Health condition and personal information stated in health record, excluding information on blood group;
- Information about racial or ethnic origin;
- Information about genetic data related to an individual's inherited or acquired genetic characteristics;
- Information about an individual’s own biometric or biological characteristics;
- Information about an individual’s sex life or sexual orientation.
- Data on crimes and criminal activities collected and stored by law enforcement agencies;
- Information on customers of credit institutions, foreign bank branches, payment service providers and other licensed institutions, including: customer identification as prescribed by law, accounts, deposits, deposited assets, transactions, organizations and individuals that are guarantors at credit institutions, bank branches, and payment service providers;
- Personal location identified via location services;
- Other specific personal data as prescribed by law that requires special protection.
Does the Decree 13/2023/ND-CP on protection of personal data in Vietnam come into effect from July 01, 2023? (Image from the Internet)
What are the rules for protection of personal data in Vietnam?
Pursuant to the provisions of Article 3 of Decree 13/2023/ND-CP as follows:
Rules for protection of personal data
1. The personal data shall be processed as prescribed by law.
2. The data subject shall be entitled to receive information related to the processing of his/her personal data, unless otherwise provided for by law.
3. The personal data shall be processed for the purposes that have been registered and declared by the Personal Data Controller, the Personal Data Processor, the Personal Data Controller-cum-Processor and the Third Party.
4. The collected personal data shall be appropriate for the scope and purposes of processing. The purchase or sale of personal data shall be prohibited in any form, unless otherwise provided for by law.
5. The personal data shall be updated and added for the processing purposes.
6. The personal data shall be protected and secured throughout the processing. To be specific, the personal data shall be protected from violations against regulations on protection of personal data and prevention of loss, destruction or damage caused by incidents and use of technical measures.
7. The personal data shall be stored within a period of time that is appropriate for the processing purposes, unless otherwise provided for by law.
8. The Personal Data Controller and the Personal Data Controller-cum-Processor shall comply with the rules for data processing specified in Clauses 1 through 7 of this Article and prove their compliance.
Thus, according to regulations, personal data is protected according to the above 07 principles.
The Personal Data Controller and the Personal Data Controller-cum-Processor shall comply with the rules for data and prove their compliance.
When does the Decree 13/2023/ND-CP on protection of personal data in Vietnam come into effect?
Regarding the effect, based on Article 43 of Decree 13/2023/ND-CP as follows:
Effect
1. This Decree comes into effect from July 01, 2023.
2. Micro-enterprises, small enterprises, medium-sized enterprises, startup companies have the right to opt for exemption from regulations on appointment of individuals and departments to protection of personal data for the first 2 years from the date of establishment.
3. With regard to micro-enterprises, small enterprises, medium-sized enterprises, startup companies that directly engage in the processing of personal data, regulations in Clause 2 of this Article shall not be applied.
Thus, according to the above regulations, Decree 13/2023/ND-CP on protection of personal data come into effect from July 1, 2023.
See the full Decree 13/2023/ND-CP here.
LawNet