05 Measures for protecting personal data in Vietnam

05 Measures for protecting personal data in Vietnam (Internet image)

Regarding this issue, LawNet would like to answer as follows:

On April 17, 2023, the Government of Vietnam issued Decree 13/2023/ND-CP to protect personal data.

1. What is Personal Data?

According to Clause 1, Article 2 of Decree 13/2023/ND-CP, personal data refers to electronic information in the form of symbols, letters, numbers, images, sounds, or equivalences associated with an individual or used to identify an individual. The personal data includes general personal data and sensitive personal data.

2. Measures for protecting personal data in Vietnam

Specifically, in Clause 2, Article 26 of Decree 13/2023/ND-CP, measures for protecting personal data include:

(1) Management measure adopted by an organization or individual related to processing of personal data;

(2) Technical measure adopted by an organization or individual related to processing of personal data;

(3) Measure adopted by a competent authority according to regulations in this Decree and relevant law;

(4) Investigation and procedure measures adopted by a competent authority;

(5) Other measures as prescribed by law.

Measures for protecting personal data shall be adopted from the beginning of and throughout the processing of personal data.

3. Rules for protection of personal data in Vietnam

According to Article 3 of Decree 13/2023/ND-CP, the rules for protection of personal data include:

- The personal data shall be processed as prescribed by law.

- The data subject shall be entitled to receive information related to the processing of his/her personal data, unless otherwise provided for by law.

- The personal data shall be processed for the purposes that have been registered and declared by the Personal Data Controller, the Personal Data Processor, the Personal Data Controller-cum-Processor and the Third Party.

- The collected personal data shall be appropriate for the scope and purposes of processing.  The purchase or sale of personal data shall be prohibited in any form, unless otherwise provided for by law.

- The personal data shall be updated and added for the processing purposes.

- The personal data shall be protected and secured throughout the processing.

To be specific, the personal data shall be protected from violations against regulations on protection of personal data and prevention of loss, destruction or damage caused by incidents and use of technical measures.

- The personal data shall be stored within a period of time that is appropriate for the processing purposes, unless otherwise provided for by law.

- The Personal Data Controller and the Personal Data Controller-cum-Processor shall comply with the rules for data processing specified in Clauses 1 through 7 of Article 3 of Decree 13/2023/ND-CP and prove their compliance.

4. State management of personal data protection in Vietnam

The Government shall ensure uniform state management of personal data protection.

Contents of state management include:

- Requesting competent authorities to promulgate or promulgate within its jurisdiction legal documents, and directing and organizing the implementation of legal documents on protection of personal data.

- Formulating and organizing the implementation of strategies, policies, schemes, projects, programs and plans for protection of personal data.

- Providing guidance on measures, procedures and standards of protection of personal data for agencies, organizations and individuals in accordance with law.

- Disseminating and educating the law on protection of personal data; communicating and disseminating skills and knowledge about protection of personal data.

- Developing and providing training and refresher training for officials, public employees and persons assigned to protect personal data.

- Inspecting the observance of law on protection of personal data; handling complaints, denunciations and violations against regulations on protection of personal data as prescribed by law.

- Compiling statistics, and giving information and reports on protection of personal data and the observance of law on personal data protection to competent authorities.

- Encouraging international cooperation in protection of personal data.

(Article 5 of Decree 13/2023/ND-CP)

Decree 13/2023/ND-CP takes effect from July 1, 2023.

>> CLICK HERE TO READ THIS ARTICLE IN VIETNAMESE