Regulations on rights and obligations of data subjects in Vietnam

Regulations on rights and obligations of data subjects in Vietnam (Internet image)

Government of Vietnam issued Decree 13/2023/ND-CP dated 17/4/2023 protecting personal data.

1. Who is the data subject?

According to Clause 6, Article 2 of Decree 13/2023/ND-CP, the data subject refers to an individual to whom the data relates.

Personal data refers to electronic information in the form of symbols, letters, numbers, images, sounds, or equivalences associated with an individual or used to identify an individual. The personal data includes general personal data and sensitive personal data.

(Clause 1, Article 2 of Decree 13/2023/ND-CP)

2. Regulations on rights and obligations of data subjects in Vietnam

2.1. Data subject’s rights in Vietnam

Specifically, Article 9 of Decree 13/2023/ND-CP stipulates the rights of data subjects as follows:

(1) Right to be informed: The data subject has the right to be informed of his/her personal data processing, unless otherwise provided for by law.

(2)  Right to give consent: The data subject has the right to give consent to the processing of his/her personal data, other than cases specified in Article 17 of Decree 13/2023/ND-CP.

(3) Right to access personal data: The data subject has the right to access his/her personal data in order to look at, rectify or request rectification of his/her personal data, unless otherwise provided for by law.

(4) Right to withdraw consent: The data subject has the right to withdraw his/her consent, unless otherwise provided for by law.

(5) Right to delete personal data: The data subject has the right to delete or request deletion of his/her personal data, unless otherwise provided for by law.

(6) Right to obtain restriction on processing:

- The data subject has the right to obtain restriction on the processing of his/her personal data, unless otherwise provided for by law.

- The restriction on the processing of personal data shall be implemented within 72 hours after receiving request of the data subject, and all personal data that the data subject requests the restriction, unless otherwise provided for by law.

(7) Right to obtain personal data: The data subject has the right to request the Personal Data Controller and the Personal Data Controller-cum-Processor to provide him/her with his/her personal data, unless otherwise provided for by law.

(8) Right to object to processing

- The data subject has the right to object to the Personal Data Controller and the Personal Data Controller-cum-Processor processing his/her personal data in order to prevent or restrict the ddisclosure of personal data or the use of personal data for advertising and marketing purposes, unless otherwise provided for by law.

- The Personal Data Controller and the Personal Data Controller-cum-Processor shall comply with the data subject’s request within 72 hours after receiving the request, unless otherwise provided for by law.

(9) Right to file complaints, denunciations and lawsuits: The data subject has the right to file complaints, denunciations and lawsuits as prescribed by law.

(10) Right to claim damage: The data subject has the right to claim damage as prescribed by law when there are violations against regulations on protection of his/her personal data, unless otherwise agreed by parties or unless otherwise prescribed by law.

(11) Right to self-protection: The data subject has the right to self-protection according to regulations in the Civil Code, other relevant laws and Decree 13/2023/ND-CP, or request competent agencies and organizations to implement civil right protection methods according to regulations in Article 11 of the Civil Code.

2.2. Data subject’s obligations in Vietnam

The personal data subject have the following obligations:

- Protect his/her own personal data; request relevant organizations and individuals to protect his/her personal data.

- Respect and protect others’ personal data.

- Fully and accurately provide his/her personal data when he/she consents to the processing.

- Participate in dissemination of personal data protection skills.

- Comply with regulations of law on protection of personal data and prevent violations against regulations on protection of personal data.

(Article 10 of Decree 13/2023/ND-CP)

Decree 13/2023/ND-CP takes effect from July 1, 2023.

>> CLICK HERE TO READ THIS ARTICLE IN VIETNAMESE