How many forms of outbound transfer of personal data are there? When will the personal data of Vietnamese citizens be transferred abroad?
Vietnam: How many forms of outbound transfer of personal data are there?
On April 17, 2023, the Government issued Decree 13/2023/ND-CP on protection of personal data. This Decree provides for personal data protection and responsibilities of relevant agencies, organizations and individuals for protection of personal data.
Accordingly, in Clause 14, Article 2 of Decree 13/2023/ND-CP, the definition of Outbound transfer of personal data is as follows:
Definition of terms
...
14. “Outbound transfer of personal data” refers to an act of using cyberspace, electronic devices, equipment, or other forms to transfer personal data of a Vietnamese citizen to a location outside the territory of the Socialist Republic of Vietnam or using a location outside the territory of the Socialist Republic of Vietnam to process personal data of a Vietnamese citizen. To be specific:
a) An organization, enterprise or individual transfers personal data of a Vietnamese citizen to an overseas organization, enterprise or management department in order to process the data for the purposes agreed upon by the data subject;
b) The personal data of a Vietnamese citizen is processed by automatic systems outside the territory of the Socialist Republic of Vietnam of the Personal Data Controller, Personal Data Controller-cum-Processor, Personal Data Processor for the purposes agreed upon by the data subject.
Accordingly, there are 02 forms of outbound transfer of personal data as follows:
- An organization, enterprise or individual transfers personal data of a Vietnamese citizen to an overseas organization, enterprise or management department in order to process the data for the purposes agreed upon by the data subject;
- The personal data of a Vietnamese citizen is processed by automatic systems outside the territory of the Socialist Republic of Vietnam of the Personal Data Controller, Personal Data Controller-cum-Processor, Personal Data Processor for the purposes agreed upon by the data subject.
How many forms of outbound transfer of personal data are there? When will the personal data of Vietnamese citizens be transferred abroad? (Image from the Internet)
When will the personal data of Vietnamese citizens be transferred abroad?
Pursuant to the provisions of Clause 1, Article 25 of Decree 13/2023/ND-CP as follows:
Outbound transfer of personal data
1. A Vietnamese citizen’s personal data shall be transferred abroad in case where the Sender makes a dossier on assessment of impact of outbound transfer of personal data and carries out the procedures specified in Clauses 3, 4 and 5 of this Article. The senders include the Personal Data Controller, the Personal Data Controller-cum-Processor, the Personal Data Processor and the Third Party.
Thus, according to the aforesaid provisions, a Vietnamese citizen’s personal data shall be transferred abroad in case where the Sender makes a dossier on assessment of impact of outbound transfer of personal data
In which, the senders includes:
- the Personal Data Controller,
- the Personal Data Controller-cum-Processor,
- the Personal Data Processor
- the Third Party
Vietnam: What is the dossier on assessment of impact of outbound transfer of personal data?
Pursuant to the provisions of Clause 2, Article 25 of Decree 13/2023/ND-CP as follows:
Outbound transfer of personal data
...
2. A dossier on assessment of impact of outbound transfer of personal data includes:
a) Contact information and details of the Sender and the Receiver;
b) Full name and contact details of an organization or individual under the Sender involved in sending and receiving a Vietnamese citizen’s personal data;
c) Description and explanation about objectives of the processing of a Vietnamese Citizen’s personal data after the personal data is transferred abroad;
d) Description and clarification of type of personal data to be transferred abroad;
dd) Description and explanation about the observance of regulations on protection of personal data in this Decree, detailed measures for protecting personal data;
e) Assessment of impact of personal data processing; undesirable consequences and damage that may occur, measures for reducing or removing such consequences and damage.
g) Consent of the data subject according to regulations in Article 11 of this Decree when he/she is informed of the mechanism for feedback and complaint in case of arising problems or requests;
h) Document that shows obligations and responsibilities between the Senders and the Receivers for processing of a Vietnamese Citizen’s personal data.
Thus, the dossier to assess the impact of Outbound transfer of personal data includes the documents according to the above-said regulations.
Accordingly, records must always be available to serve the inspection and evaluation activities of the Ministry of Public Security.
The party transferring data abroad shall send 01 original of the dossier to the Ministry of Public Security (Department of Cybersecurity and High-Tech Crime Prevention) within 60 days from the date of processing of personal data. .
Decree 13/2023/ND-CP takes effect from July 1, 2023.
See the full Decree 13/2023/ND-CP here.
LawNet