Instructions on processing personal data in certain cases in Vietnam

Instructions on processing personal data in certain cases in Vietnam (Internet image)

Instructions on processing personal data in certain cases in Vietnam

The content of the guidance is specified in Decree 13/2023/ND-CP dated April 17, 2023 on regulations on protection of personal data.

Personal data processing without the consent of data subject in Vietnam

- The personal data shall be processed to protect the life and health of the data subject or others in an emergency situation.  The Personal Data Controller, the Personal Data Controller-cum-Processor, the Personal Data Processor and the Third Party shall be responsible for proving such situation. 

- Disclosure of personal data in accordance with the law;

- Processing of personal data by competent regulatory authorities in the event of a state of emergency regarding national defense, security, social order and safety, major disasters, or dangerous epidemics; when there is a threat to security and national defense but not to the extent of declaring a state of emergency; to prevent and fight riots and terrorism, crimes and law violations according to the provisions of law;

- The personal data shall be processed to fulfill obligations under contracts the data subjects with relevant agencies, organizations and individuals as prescribed by law;

The personal data shall be processed to serve operations by regulatory authorities as prescribed by relevant laws.

Processing of personal data obtained from audio and video recording activities in public places in Vietnam

- Competent agencies and organizations may make audio and video recording and process personal data obtained from audio or video recording activities in public places in order to protect national security, social order and safety, legitimate rights and interests of organizations and individuals as prescribed by law without the consent of the data subjects.

When making audio and video recording, competent agencies and organizations shall notify the data subjects that such data subjects are being recorded, unless otherwise provided for by law.

Processing of personal data of individuals who are declared missing or deceased in Vietnam

- The processing of personal data related to the personal data of an individual who is declared missing or deceased is subject to the consent of his/her spouse or adult children, or his/her parents if he/she has no spouse or child, except for cases specified in Articles 17 and 18 of Decree 13/2023/ND-CP.

- In the absence of all the persons mentioned in Clause 1 of Article 18 of Decree 13/2023/ND-CP, it is considered that there is no consent.

Processing of children's personal data in Vietnam

- The children’s personal data shall be processed in the manner that the rights and the best interests of the children are protected.

- The processing of personal data of a child is subject to his/her consent if he/she is seven years old or above and the consent of his/her parents or guardian(s), except for cases specified in Article 17 of Decree 13/2023/ND-CP.

The Personal Data Controller, Personal Data Processor, Personal Data Controller-cum-Processor and the Third Party shall verify the age of the child before processing his/her personal data.

- The processing of the child’s personal data shall be stopped and the personal data shall be permanently deleted or destroyed in the following cases:

+ The personal data is processed for unintended purposes or the processing purposes have been accomplished under the consent of the data subject, unless otherwise provided for by law;

+ The child’s parent or guardian withdraws the consent to the processing of the child’s personal data, unless otherwise provided for by law;

+ There are sufficient grounds to prove that the processing of the child’s personal data affects legitimate rights and interests of the child at the request of the competent authority, unless otherwise provided for by law;

Duong Chau Thanh

>> CLICK HERE TO READ THIS ARTICLE IN VIETNAMESE