Vietnam: What is the deadline for submission of dossiers on assessment of the impact of personal data processing? What does the dossier on assessment of impact of personal data processing include?
- What does the dossier on assessment of impact of personal data processing in Vietnam include?
- What is the deadline for submission of dossiers on assessment of the impact of personal data processing in Vietnam?
- What is the latest Notice form for submission of dossiers on assessment of impact of personal data processing in Vietnam?
What does the dossier on assessment of impact of personal data processing in Vietnam include?
Pursuant to Article 24 of Decree 13/2023/ND-CP as follows:
(1) The Personal Data Controller and the Personal Data Controller-cum-Processor shall make and store their dossiers on assessment of impact of personal data processing from the time of starting to process personal data:
A dossier on assessment of impact of personal data processing in Vietnam includes:
- Contact information and details of the Personal Data Controller and the Personal Data Controller-cum-Processor;
- Name and contact details of the organization or employee assigned to protect personal data of the Personal Data Controller and the Personal Data Controller-cum-Processor;
- Processing purposes;
- Types of personal data to be processed;
- Data-receiving organization or individual, including the organization or individual that is located or lives outside the territory of the Socialist Republic of Vietnam;
- Cases of outbound transfer of personal data;
- Duration of processing of personal data; estimated duration of deletion or destruction of personal data (if any);
- Description of measures for protecting personal data;
- Assessment of impact of personal data processing; undesirable consequences and damage that may occur, measures for reducing or removing such consequences and damage.
(2) The Personal Data Processor shall make and store the dossier on the assessment of impact of personal data processing in case the Personal Data Processor executes a contract with the Personal Data Controller. A dossier on assessment of impact of personal data processing of the Personal Data Processor includes:
- Contact information and details of the Personal Data Processor;
- Name and contact details of the organization or employee assigned to protect personal data of the Personal Data Processor;
- Description of processing of personal data and types of personal data to be processed under a contract with the Personal Data Controller;
- Duration of processing of personal data; estimated duration of deletion or destruction of personal data (if any);
- Cases of outbound transfer of personal data;
- General description of measures for protecting personal data;
- Undesirable consequences and damage that may occur, measures for reducing or removing such consequences and damage.
What is the deadline for submission of dossiers on assessment of the impact of personal data processing in Vietnam?
Pursuant to Clause 4, Article 24, Decree 13/2023/ND-CP as follows:
Assessment of impact of personal data processing
...
4. The dossier on assessment of impact of personal data processing shall be always available in order to serve inspection and assessment by the Ministry of Public Security and the Ministry of Public Security (Department of Cybersecurity and Hi-tech Crime Prevention), inccluding 01 authentic copy according to Form No. 04 in the Appendix of this Decree, within 60 days from the date of processing of personal data.
According to the above regulations, from the date of processing of personal data, enterprises and related parties are obliged to prepare and keep dossiers on assessment of impact of personal data processing. The dossier on assessment of impact of personal data processing shall be always available in order to serve inspection and assessment by the Ministry of Public Security and the Ministry of Public Security.
The timelimit for submission of dossiers on assessment of impact of personal data processing in Vietnam is within 60 days from the date of processing of personal data.
In addition, Decree 13/2023/ND-CP comes into effect from July 1, 2023, applicable to acts occurring at the time Decree 13/2023/ND-CP comes into effect.
Thus, most enterprises will conduct personal data processing according to Decree 13/2023/ND-CP, the deadline for submission of dossiers on assessment of impact of personal data processing in Vietnam will be counted from July 1, 2023 (the effective date of Decree 13/2023/ND-CP), ie August 29, 2023 (60 days from July 1, 2023).
What is the latest Notice form for submission of dossiers on assessment of impact of personal data processing in Vietnam?
According to the provisions of Article 24 of Decree 13/2023/ND-CP, the dossier on assessment of impact of personal data processing shall be always available in order to serve inspection and assessment by the Ministry of Public Security and the Ministry of Public Security within 60 days from the date of processing of personal data.
In particular, the latest Notice form for submission dossiers on assessment of impact of personal data processing in Vietnam is Form No. 04 in the Appendix issued with Decree 13/2023/ND-CP:
Download the latest Notice form for submission dossiers on assessment of impact of personal data processing in Vietnam: here
LawNet