What are the cases of outbound transfer of personal data of Vietnamese citizens? When will the outbound transfer of personal data be inspected?
What are the cases of outbound transfer of personal data of Vietnamese citizens?
In cases of outbound transfer personal data of Vietnamese citizens, it is prescribed in Clause 1, Article 25 of Decree 13/2023/ND-CP as follows:
Outbound transfer of personal data
1. A Vietnamese citizen’s personal data shall be transferred abroad in case where the Sender makes a dossier on assessment of impact of outbound transfer of personal data and carries out the procedures specified in Clauses 3, 4 and 5 of this Article. The senders include the Personal Data Controller, the Personal Data Controller-cum-Processor, the Personal Data Processor and the Third Party.
2. A dossier on assessment of impact of outbound transfer of personal data includes:
a) Contact information and details of the Sender and the Receiver;
b) Full name and contact details of an organization or individual under the Sender involved in sending and receiving a Vietnamese citizen’s personal data;
c) Description and explanation about objectives of the processing of a Vietnamese Citizen’s personal data after the personal data is transferred abroad;
d) Description and clarification of type of personal data to be transferred abroad;
dd) Description and explanation about the observance of regulations on protection of personal data in this Decree, detailed measures for protecting personal data;
e) Assessment of impact of personal data processing; undesirable consequences and damage that may occur, measures for reducing or removing such consequences and damage.
g) Consent of the data subject according to regulations in Article 11 of this Decree when he/she is informed of the mechanism for feedback and complaint in case of arising problems or requests;
h) Document that shows obligations and responsibilities between the Senders and the Receivers for processing of a Vietnamese Citizen’s personal data.
3. A dossier on assessment of impact of outbound transfer of personal data shall be always available in order to serve inspection and assessment by the Ministry of Public Security.
The Sender shall send 01 authentic copy of the assessment to the Ministry of Public Security (Department of Cybersecurity and Hi-tech Crime Prevention) according to Form No. 06 in the Appendix of this Decree within 60 days from the date of processing of personal data.
4. The Sender shall notify the Ministry of Public Security (Department of Cybersecurity and Hi-tech Crime Prevention) of information about the data transfer and contact details of the organization or individual in charge of such transfer in writing after the personal data is successfully transferred.
5. The Ministry of Public Security (Department of Cybersecurity and Hi-tech Crime Prevention) shall make assessment and request the Sender to complete the dossier on assessment of impact of outbound transfer of personal data in case the assessment is not complete and accurate according to regulations.
...
A Vietnamese citizen’s personal data shall be transferred abroad in case where the Sender makes a dossier on assessment of impact of outbound transfer of personal data and carries out the procedures specified in Clauses 3, 4 and 5 of Article 25 above.
Note: The senders include the Personal Data Controller, the Personal Data Controller-cum-Processor, the Personal Data Processor and the Third Party.
What are the cases of outbound transfer of personal data of Vietnamese citizens? When will the outbound transfer of personal data be inspected?
Vietnam: When will the outbound transfer of personal data of Vietnamese citizens be inspected?
The frequency of checking the transfer of personal data abroad is specified in Clause 7, Article 25 of Decree 13/2023/ND-CP as follows:
Outbound transfer of personal data
...
7. According to specific situation, the Ministry of Public Security shall decide to inspect the outbound transfer of personal data once a year, unless it detects violations against the law on protection of personal data in this Decree or a Vietnamese citizen's personal data is leaked or lost.
...
Accordingly, according to specific situation, the Ministry of Public Security shall decide to inspect the outbound transfer of personal data once a year, unless it detects violations against the law on protection of personal data in this Decree or a Vietnamese citizen's personal data is leaked or lost.
When will the outbound transfer of personal data of Vietnamese citizens be stopped?
Cases of stopping the outbound transfer of personal data of Vietnamese citizens are specified in Clause 8, Article 25 of Decree 13/2023/ND-CP as follows:
Outbound transfer of personal data
...
8. The Ministry of Public Security shall decide to request the Sender to stop transferring personal data abroad in the following cases:
a) It is detected that the transferred personal data is used for activities that violate the interests and national security of the Socialist Republic of Vietnam.
b) The Sender does not comply with regulations in Clause 5 and Clause 6 of this Article;
c) A Vietnamese citizen's personal data is leaked or lost.
Thus, the outbound transfer of personal data of Vietnamese citizens is stopped in the cases specified in Clause 8, Article 25 above.
LawNet