Vietnam: What are the procedures for notifying the submission of the dossier on assessment of impact of outbound transfer of personal data?

Main Content

• What does the dossier on assessment of impact of outbound transfer of personal data in Vietnam include?
• What are the procedures for notifying the submission of the dossier on assessment of impact of outbound transfer of personal data in Vietnam?
• How many methods for carrying out the procedures for notifying the submission of the dossier on assessment of impact of outbound transfer of personal data in Vietnam are there?

What does the dossier on assessment of impact of outbound transfer of personal data in Vietnam include?

Pursuant to Article 25 of Decree 13/2023/ND-CP as follows:

Outbound transfer of personal data

1. A Vietnamese citizen’s personal data shall be transferred abroad in case where the Sender makes a dossier on assessment of impact of outbound transfer of personal data and carries out the procedures specified in Clauses 3, 4 and 5 of this Article. The senders include the Personal Data Controller, the Personal Data Controller-cum-Processor, the Personal Data Processor and the Third Party.

2. A dossier on assessment of impact of outbound transfer of personal data includes:

a) Contact information and details of the Sender and the Receiver;

b) Full name and contact details of an organization or individual under the Sender involved in sending and receiving a Vietnamese citizen’s personal data;

c) Description and explanation about objectives of the processing of a Vietnamese Citizen’s personal data after the personal data is transferred abroad;

d) Description and clarification of type of personal data to be transferred abroad;

dd) Description and explanation about the observance of regulations on protection of personal data in this Decree, detailed measures for protecting personal data;

e) Assessment of impact of personal data processing; undesirable consequences and damage that may occur, measures for reducing or removing such consequences and damage.

g) Consent of the data subject according to regulations in Article 11 of this Decree when he/she is informed of the mechanism for feedback and complaint in case of arising problems or requests;

h) Document that shows obligations and responsibilities between the Senders and the Receivers for processing of a Vietnamese Citizen’s personal data.

...

Thus, the dossier on assessment of impact of outbound transfer of personal data in Vietnam includes:

- Contact information and details of the Sender and the Receiver;

- Full name and contact details of an organization or individual under the Sender involved in sending and receiving a Vietnamese citizen’s personal data;

- Description and explanation about objectives of the processing of a Vietnamese Citizen’s personal data after the personal data is transferred abroad;

- Description and clarification of type of personal data to be transferred abroad;

- Description and explanation about the observance of regulations on protection of personal data in this Decree, detailed measures for protecting personal data;

- Assessment of impact of personal data processing; undesirable consequences and damage that may occur, measures for reducing or removing such consequences and damage.

- Consent of the data subject according to regulations in Article 11 of this Decree when he/she is informed of the mechanism for feedback and complaint in case of arising problems or requests;

- Document that shows obligations and responsibilities between the Senders and the Receivers for processing of a Vietnamese Citizen’s personal data.

What are the procedures for notifying the submission of the dossier on assessment of impact of outbound transfer of personal data in Vietnam?

According to the instructions at the Public Service Information Portal in Vietnam, the procedures for notifying the submission of the dossier on assessment of impact of outbound transfer of personal data in Vietnam shall follows these steps:

Step 1: Prepare 01 set of dossier as follows:

- Notification of submission of the dossier on assessment of impact of outbound transfer of personal data (for individuals) - 01 (one) original

- Notification of submission of the dossier on assessment of impact of outbound transfer of personal data (for organizations) - 01 (one) original

- Dossier on assessment of impact of outbound transfer of personal data - 01 (one) original

- Certificate of operation registration/establishment decision or citizen ID card/identity card/passport of the applicant - 01 (one) copy

- Decisions or documents related to the assignment of the department in charge of personal data protection of the applicant - 01 (one) copy

- Contracts or documents relating to the agreement on the processing of personal data with the parties (if any) - 01 (one) copy

- Other documents (appendices to tables calculating costs and benefits of solutions) - (copies)

Step 2: The applicant shall access the Public Service Information Portal on personal data protection (according to the announcement of the Ministry of Public Security) or download form No. 06 issued with Decree 13/2023/ND-CP.

Step 3: The applicant shall provide information according to instructions on the Public Service Information Portal on personal data protection (as notified by the Ministry of Public Security) or declare according to form No. 05 issued with the Decree 13/2023/ND-CP.

The content of the dossier on assessment of impact of outbound transfer of personal data is specified in Clause 2, Article 25 of Decree 13/2023/ND-CP.

Step 4: The applicant shall submit documents through the Public Service Information Portal on personal data protection (according to the announcement of the Ministry of Public Security) or send documents with information to the Department of Cyber​​security and Hi-tech Crime Prevention under the Ministry of Public Security.

Step 5: Department of Cyber​​security and Hi-tech Crime Prevention under Ministry of Public Security shall respond with information on the results of preparing the dossier on assessment of impact of outbound transfer of personal data.

Time to receive applications: Office hours from Monday to Friday (except holidays and Tet according to regulations).

How many methods for carrying out the procedures for notifying the submission of the dossier on assessment of impact of outbound transfer of personal data in Vietnam are there?

According to the instructions at the Public Service Information Portal, the procedures for notifying the submission of the dossier on assessment of impact of outbound transfer of personal data in Vietnam are carried out through the following 03 methods:

- Submit directly to the Department of Cyber​​security and Hi-tech Crime Prevention under under the Ministry of Public Security.

- Access the National Service Information Portal on personal data protection (according to the announcement of the Ministry of Public Security).

- Receive dossiers through public postal services according to regulations in Decision 45/2016/QD-TTg on receiving dossiers and returning results of administrative procedures through public postal services.