Regulations on general and sensitive personal data protection measures in Vietnam

The Government of Vietnam issued Decree 13/2023/ND-CP on protection of personal data., which explains personal data, general personal data and personal data protection measures.

What is personal data?

Personal data refers to electronic information in the form of symbols, letters, numbers, images, sounds, or equivalences associated with an individual or used to identify an individual. The personal data includes general personal data and sensitive personal data.

General personal data includes:

- Last name, middle name and first name, other names (if any);

- Date of birth; date of death or going missing;

- Gender;

- Place of birth, registered place of birth; place of permanent residence; place of temporary residence; current place of residence; hometown; contact address;

- Nationality;

- Personal image;

- Phone number; ID Card number, personal identification number, passport number, driver’s license number, license plate, taxpayer identification number, social security number and health insurance card number;

- Marital status;

- Information about the individual’s family relationship (parents, children);

- Digital account information; personal data that reflects activities and activity history in cyberspace;

- Information associated with an individual or used to identify an individual other than that specified in Clause 4 of Article 2 of Decree 13/2023/ND-CP.

Regulations on general and sensitive personal data protection measures in Vietnam (Internet image)

Personal data protection measures in Vietnam

Measures for protecting personal data shall be adopted from the beginning of and throughout the processing of personal data.

Measures for protecting personal data include:

- Management measure adopted by an organization or individual related to processing of personal data;

- Technical measure adopted by an organization or individual related to processing of personal data;

- Measure adopted by a competent authority according to regulations in this Decree and relevant law;

- Investigation and procedure measures adopted by a competent authority;

- Other measures as prescribed by law.

General personal data protection measures in Vietnam

- Adopt measures mentioned in Clause 2 Article 26 of Decree 13/2023/ND-CP.

- Formulate and promulgate regulations on protection of personal data, which specify tasks to be performed in accordance with Decree 13/2023/ND-CP.

- Encourage application of standards of personal data protection in conformity with fields, industries and activities related to the processing of personal data.

- Inspect cybersecurity for systems, means and equipment for processing of personal data before processing, permanent deletion or destruction of devices containing personal data.

Sensitive personal data protection measures in Vietnam

- Adopt measures mentioned in Clause 2 Article 26 and Article 27 of Decree 13/2023/ND-CP.

- Appoint a department with the function of protecting personal data and personnel in charge of protection of personal data, and exchange information about the department and individual in charge of protection of personal data with the personal data protection authority. Exchange information about the individual in charge of protection in case the Personal Data Controller, the Personal Data Controller-cum-Processor, the Personal Data Processor or the Third Party is an individual. 

- Notify the data subject of the processing of his/her sensitive personal data, except for cases specified in Clause 4, Article 13, Article 17 and Article 18 of Decree 13/2023/ND-CP.

Mai Thanh Loi

>> CLICK HERE TO READ THIS ARTICLE IN VIETNAMESE