When is the personal data of Vietnamese citizens transferred abroad? What is the dossier on assessment of impact of outbound transfer of personal data in Vietnam?
How many forms of outbound transfer of personal data are there?
According to the provisions of Clause 14, Article 2 of Decree No. 13/2023/ND-CP on the definition of outbound transfer of personal data as follows:
Definition of terms
…
“Outbound transfer of personal data” refers to an act of using cyberspace, electronic devices, equipment, or other forms to transfer personal data of a Vietnamese citizen to a location outside the territory of the Socialist Republic of Vietnam or using a location outside the territory of the Socialist Republic of Vietnam to process personal data of a Vietnamese citizen. To be specific:
a) An organization, enterprise or individual transfers personal data of a Vietnamese citizen to an overseas organization, enterprise or management department in order to process the data for the purposes agreed upon by the data subject;
b) The personal data of a Vietnamese citizen is processed by automatic systems outside the territory of the Socialist Republic of Vietnam of the Personal Data Controller, Personal Data Controller-cum-Processor, Personal Data Processor for the purposes agreed upon by the data subject.
Thus, there are 02 forms of outbound transfer of personal data as follows:
- An organization, enterprise or individual transfers personal data of a Vietnamese citizen to an overseas organization, enterprise or management department;
- The personal data of a Vietnamese citizen is processed by automatic systems outside the territory of the Socialist Republic of Vietnam of the Personal Data Controller, Personal Data Controller-cum-Processor, Personal Data Processor.
When is the personal data of Vietnamese citizens transferred abroad? What is the dossier on assessment of impact of outbound transfer of personal data in Vietnam?
When is the personal data of Vietnamese citizens transferred abroad?
Pursuant to the provisions of Clause 1, Article 25 of Decree No. 13/2023/ND-CP as follows:
Outbound transfer of personal data
1. A Vietnamese citizen’s personal data shall be transferred abroad in case where the Sender makes a dossier on assessment of impact of outbound transfer of personal data and carries out the procedures specified in Clauses 3, 4 and 5 of this Article. The senders include the Personal Data Controller, the Personal Data Controller-cum-Processor, the Personal Data Processor and the Third Party.
Thus, according to the aforesaid provisions, a Vietnamese citizen’s personal data shall be transferred abroad in case where the Sender makes a dossier on assessment of impact of outbound transfer of personal data.
In which, the senders include:
- The Personal Data Controller;
- The Personal Data Controller-cum-Processor;
- The Personal Data Processor;
- The Third Party.
What is the dossier on assessment of impact of outbound transfer of personal data in Vietnam?
Pursuant to the provisions of Clause 2, Article 25 of Decree No. 13/2023/ND-CP as follows:
Outbound transfer of personal data
…
2. A dossier on assessment of impact of outbound transfer of personal data includes:
a) Contact information and details of the Sender and the Receiver;
b) Full name and contact details of an organization or individual under the Sender involved in sending and receiving a Vietnamese citizen’s personal data;
c) Description and explanation about objectives of the processing of a Vietnamese Citizen’s personal data after the personal data is transferred abroad;
d) Description and clarification of type of personal data to be transferred abroad;
dd) Description and explanation about the observance of regulations on protection of personal data in this Decree, detailed measures for protecting personal data;
e) Assessment of impact of personal data processing; undesirable consequences and damage that may occur, measures for reducing or removing such consequences and damage.
g) Consent of the data subject according to regulations in Article 11 of this Decree when he/she is informed of the mechanism for feedback and complaint in case of arising problems or requests;
h) Document that shows obligations and responsibilities between the Senders and the Receivers for processing of a Vietnamese Citizen’s personal data.
Thus, the dossier on assessment of impact of outbound transfer of personal data includes the documents according to the above-said regulations.
According to that, a dossier on assessment of impact of outbound transfer of personal data shall be always available in order to serve inspection and assessment by the Ministry of Public Security.
The Sender shall send 01 authentic copy of the assessment to the Ministry of Public Security (Department of Cybersecurity and Hi-tech Crime Prevention) according to Form No. 06 in the Appendix of this Decree within 60 days from the date of processing of personal data.
Decree No. 13/2023/ND-CP takes effect from July 1, 2023.
LawNet