Is it permissible for a third party to rectify personal data of a data subject in Vietnam?

What contents shall be notified to the data subject during the processing of personal data in Vietnam?

Pursuant to Clause 2 Article 13 of the Decree 13/2023/NĐ-CP stipulating notification of personal data processing as follows:

Notification of personal data processing

1. The notification shall be made once before the personal data is processed.

2. The following contents of the processing of personal data shall be notified to the data subject:

a) Processing purposes;

b) Type of used personal data related to the purposes specified in Point a Clause 2 of this Article;

c) Method of processing personal data;

d) Information on other organizations and individuals related to the processing purposes specified in point a Clause 2 of this Article;

dd) Undesirable consequences and damage that may occur;

e) Starting and ending time.

3. The notification to the data subject shall be expressed in a format that can be printed and reproduced in writing, including in electronic or verifiable format.

4. The Personal Data Controller and the Personal Data Controller-cum-Processor are not required to comply with regulations specified in Clause 1 of this Article in the following cases:

a) The data subject knows and fully consents to the contents specified in Clauses 1 and 2 of this Article before permitting the Personal Data Controller and the Personal Data Controller-cum-Processor to collect his/her personal data in accordance with regulations in Article 9 of this Decree;

b) The personal data is processed by the competent state agency with a view to serving operations by such agency as prescribed by law.

As regulations above, the following contents of the processing of personal data shall be notified to the data subject:

- Processing purposes;

- Type of used personal data related to the purposes specified in Point a Clause 2 of this Article;

- Method of processing personal data;

- Information on other organizations and individuals related to the processing purposes specified in point a Clause 2 of this Article;

- Undesirable consequences and damage that may occur;

- Starting and ending time.

Is it permissible for a third party to rectify personal data of a data subject in Vietnam?

Pursuant to Clause 1 Article 15 of the Decree 13/2023/NĐ-CP stipulating rectification of personal data as follows:

Rectification of personal data

1. A data subject has the right to:

a) Access his/her personal data in order to view and rectify it after the Personal Data Controller and the Personal Data Controller-cum-Processor collects the data under his/her consent, unless otherwise provided for by law.

b) Request the Personal Data Controller and the Personal Data Controller-cum-Processor to rectify his/her personal data in case he/she cannot directly rectify his/her personal data due to technical reason or other reasons.

2. The Personal Data Controller and the Personal Data Controller-cum-Processor shall rectify personal data of the data subject after obtaining his/her consent when possible or according to regulations of specialized law. In case it is impossible to rectify personal data, the Personal Data Controller and the Personal Data Controller-cum-Processor shall notify the data subject after 72 hours from the time of receipt of his/her request.

3. The Personal Data Processor and the Third Party may rectify the personal data of the data subject after the Personal Data Controller and the Controller and the Personal Data Processor consent in writing and obtain consent from the data subject.

As regulations above, a third party is permissible to rectify personal data of a data subject if:

- the Personal Data Controller and the Controller and the Personal Data Processor consent in writing;

- obtain consent from the data subject.

In which cases shall the personal data not be deleted at the request of the data subject in Vietnam?

Pursuant to Clause 2 Article 16 of the Decree 13/2023/NĐ-CP, the personal data shall not be deleted at the request of the data subject in the following cases:

- The deletion of personal data is prohibited by law;

- The personal data is processed by the competent state agency with a view to serving operations by such agency as prescribed by law.

- The personal data has been disclosed as prescribed by law.

- The personal data is processed with a view to serving law, scientific research and statistics as prescribed by law;

- The personal data shall not be deleted in the event of a state of emergency on national defense, security, social order and safety, major disasters, or dangerous epidemics; when there is a risk of threatening security and national defense but not to the extent of declaring a state of emergency; to prevent and combat riots and terrorism, to prevent and combat crimes and law violations according to regulations of law;

- It is required to respond to emergent cases that threaten the life and health or the safety of the data subject or other persons.

Note: Decree 13/2023/NĐ-CP is effective from 01/07/2023.

Best regards!