Vietnam: How to personal data in case of full division, partial division, merger, consolidation or dissolution of an enterprise?
How to personal data in case of full division, partial division, merger, consolidation or dissolution of an enterprise?
Pursuant to Article 16 of Decree No. 13/2023/ND-CP on on storage, deletion and destruction of personal data in Vietnam as follows:
Storage, deletion and destruction of personal data in Vietnam
1. The data subject has the right to request the Personal Data Controller and the Personal Data Controller-cum-Processor to delete his/her personal data in the following cases:
a) The data subject no longer finds the data necessary for the purposes for which it was collected under his/her consent and he/she accepts any damage that may be caused by the deletion;
b) The data subject withdraws consent;
c) The data subject objects to the processing of his/her personal data and the Personal Data Controller and the Personal Data Controller-cum-Processor do not have sound reasons for continuation in the processing;
d) The personal data is processed for purposes other than those that the data subject gives the consent or the processing of personal data is a violation against regulations of law;
dd) The personal data shall be deleted as prescribed by law.
2. The personal data shall not be deleted at the request of the data subject in the following cases:
a) The deletion of personal data is prohibited by law;
b) The personal data is processed by the competent state agency with a view to serving operations by such agency as prescribed by law.
c) The personal data has been disclosed as prescribed by law.
d) The personal data is processed with a view to serving law, scientific research and statistics as prescribed by law;
dd) The personal data shall not be deleted in the event of a state of emergency on national defense, security, social order and safety, major disasters, or dangerous epidemics; when there is a risk of threatening security and national defense but not to the extent of declaring a state of emergency; to prevent and combat riots and terrorism, to prevent and combat crimes and law violations according to regulations of law;
e) It is required to respond to emergent cases that threaten the life and health or the safety of the data subject or other persons.
3. In case of full division, partial division, merger, consolidation or dissolution of an enterprise, the personal data shall be transferred in accordance with law.
4. In case of full division, partial division or merger of an agency, organization or administrative unit, and reorganization or transformation of ownership of a state-owned enterprise, the personal data shall be transferred in accordance with law.
5. The deletion of personal data shall be implemented within 72 hours after receipt of the data subject’s request, and all personal data collected by the Personal Data Controller and the Personal Data Controller-cum-Processor, unless otherwise provided for by law.
6. The Personal Data Controller, the Personal Data Controller-cum-Processor, the Personal Data Processor and the Third Party shall store personal data in forms in conformity with their operations and adopt measures for protecting the personal data as prescribed by law.
7. The Personal Data Controller, the Personal Data Controller-cum-Processor, the Personal Data Processor and the Third Party shall permanently delete personal data in the following cases:
a) The personal data is processed for unintended purposes or they have accomplished their processing purposes under the consent of the data subject;
b) The storage of personal data is no longer necessary for their operations.
c) The Personal Data Controller, the Personal Data Controller-cum-Processor, the Personal Data Processor and the Third Party are dissolved or no longer operate or declare bankruptcy or terminate their business activities in accordance with the law.
Thus, according to the above content, in case of full division, partial division, merger, consolidation or dissolution of an enterprise, the personal data shall be transferred in accordance with law.
Vietnam: How to personal data in case of full division, partial division, merger, consolidation or dissolution of an enterprise?
Is it illegal to transfer personal data without consent?
Pursuant to Article 22 of Decree No. 13/2023/ND-CP as follows:
Illegally collecting, transferring, purchasing and selling personal data in Vietnam
1. Organizations and individuals related to the processing of personal data shall adopt measures for protecting personal data in order to prevent illegal collection of personal data from their systems and service equipment.
2. Installation of software systems, implementation of technical measures or organization of collection, transfer, purchase or sale of personal data without the consent of the data subject is a violation of law.
Thus, according to the above regulations, the transfer of personal data without the consent of the data subject is determined to be a violation of the law.
When does the new regulation on personal data processing apply?
Pursuant to Article 43 of Decree No. 13/2023/ND-CP as follows:
Effect
1. This Decree comes into effect from July 01, 2023.
2. Micro-enterprises, small enterprises, medium-sized enterprises, startup companies have the right to opt for exemption from regulations on appointment of individuals and departments to protection of personal data for the first 2 years from the date of establishment.
3. With regard to micro-enterprises, small enterprises, medium-sized enterprises, startup companies that directly engage in the processing of personal data, regulations in Clause 2 of this Article shall not be applied.
Thus, the regulations on personal data processing in Decree No. 13/2023/ND-CP takes effect from July 1, 2023.
LawNet
