Vietnam: What does a dossier on assessment of impact of personal data processing include? What is the notification template for submission of the dossier on assessment of impact of personal data processing?
- What does a dossier on assessment of impact of personal data processing in Vietnam include?
- In 2023, what is the notification template for submission of the dossier on assessment of impact of personal data processing in Vietnam?
- What is the notification template for the update or amendment of the dossier on the assessment of impact of personal data processing in Vietnam?
What does a dossier on assessment of impact of personal data processing in Vietnam include?
Under Decree 13/2023/ND-CP on personal data protection, the Decree provides for personal data protection and responsibilities of relevant agencies, organizations and individuals for protection of personal data.
According to Article 24 of Decree 13/2023/ND-CP, a dossier on assessment of impact of personal data processing in Vietnam includes:
(1) For the dossier of the Personal Data Controller and the Personal Data Controller-cum-Processor
The Personal Data Controller and the Personal Data Controller-cum-Processor shall make and store their dossiers on assessment of impact of personal data processing from the time of starting to process personal data.
A dossier on assessment of impact of personal data processing includes:
- Contact information and details of the Personal Data Controller and the Personal Data Controller-cum-Processor;
- Name and contact details of the organization or employee assigned to protect personal data of the Personal Data Controller and the Personal Data Controller-cum-Processor;
- Processing purposes;
- Types of personal data to be processed;
- Data-receiving organization or individual, including the organization or individual that is located or lives outside the territory of the Socialist Republic of Vietnam;
- Cases of outbound transfer of personal data;
- Duration of processing of personal data; estimated duration of deletion or destruction of personal data (if any);
- Description of measures for protecting personal data;
- Assessment of impact of personal data processing; undesirable consequences and damage that may occur, measures for reducing or removing such consequences and damage.
(2) For the dossier of the Personal Data Processor
The Personal Data Processor shall make and store the dossier on the assessment of impact of personal data processing in case the Personal Data Processor executes a contract with the Personal Data Controller.
A dossier on assessment of impact of personal data processing includes:
- Contact information and details of the Personal Data Processor;
- Name and contact details of the organization or employee assigned to protect personal data of the Personal Data Processor;
- Description of processing of personal data and types of personal data to be processed under a contract with the Personal Data Controller;
- Duration of processing of personal data; estimated duration of deletion or destruction of personal data (if any);
- Cases of outbound transfer of personal data;
- General description of measures for protecting personal data;
- Undesirable consequences and damage that may occur, measures for reducing or removing such consequences and damage.
The dossier on assessment of impact of personal data processing of the Personal Data Controller, the Personal Data Controller-cum-Processor or the Personal Data Processor shall be made in writing that is valid.
.png)
In 2023, what is the notification template for submission of the dossier on assessment of impact of personal data processing in Vietnam?
According to the provisions of Article 24 of Decree 13/2023/ND-CP, the dossier on assessment of impact of personal data processing shall be always available in order to serve inspection and assessment by the Ministry of Public Security and the Ministry of Public Security shall receive 01 authentic copy within 60 days from the date of processing of personal data.
Thus, the notification template for submission of the dossier on assessment of impact of personal data processing in Vietnam is Template No. 04 in the Appendix issued with Decree 13/2023/ND-CP.
Download the notification template for submission of the dossier on assessment of impact of personal data processing in Vietnam: here
What is the notification template for the update or amendment of the dossier on the assessment of impact of personal data processing in Vietnam?
Under the provisions in Clause 6, Article 24 of Decree 13/2023/ND-CP:
Assessment of impact of personal data processing
...
6. The Personal Data Controller, the Personal Data Controller-cum-Processor and the Personal Data Processor shall update and amend their dossiers on assessment of impact of personal data processing when there is any change of contents submitted to the Ministry of Public Security (Department of Cybersecurity and Hi-tech Crime Prevention) according to Template No. 05 in the Appendix of this Decree.
Thus, the notification template for the update or amendment of the dossier on the assessment of impact of personal data processing in Vietnam is Template No. 05 in the Appendix issued with Decree 13/2023/ND-CP.
Download the notification template for the update or amendment of the dossier on the assessment of impact of personal data processing in Vietnam: here
Decree 13/2023/ND-CP takes effect from July 1, 2023.
LawNet