New regulation of Vietnam on personal data protection measures

Personal data protection measures

According to the Decree, regulations personal data protection measures are as follows:

 - Personal data protection measures are applied at the start and throughout the personal data processing procedure.

 - Personal data protection measures include:

 + Management measures performed by organizations or individuals related to personal data processing;

 + Technical measures performed by organizations or individuals related to personal data processing;

 + Measures performed by competent state management agencies according to Decree No. 13/2023/ND-CP and relevant laws;  

 + Investigation and prosecution measures performed by competent state agencies;

 + Other measures according to the law.

 Basic personal data protection

 Decree No. 13/2023/ND-CP prescribes basic personal data protection as follows:

 - Apply measures mentioned in Clause 2 Article 26 of Decree No. 13/2023/ND-CP.

 - Develop, promulgate regulations on personal data protection, and specify tasks to be performed according to Decree No. 13/2023/ND-CP.

 - Encourage the application of personal data protection standards conformable with fields, professions, and operations related to personal data processing.

 - Inspect cybersecurity for systems, instruments, and equipment serving the processing of personal data before processing, permanently deleting, or destroying devices containing personal data.

Sensitive personal data protection

 - Apply measures mentioned in Clause 2 Article 26 and Article 27 of Decree No. 13/2023/ND-CP.

 - Designate departments for personal data protection and personnel in charge of personal data protection, and exchange information on departments and individuals in charge of personal data protection with Specialized Agencies for Personal Data Protection. If the personal data control party, personal data control and processing party, data processing party, or third party is an individual, exchange information of the individual in charge.

 - Notify the owner of the sensitive personal data of the processing of his/her data, excluding cases prescribed in Clause 4 Article 13, Article 17, and Article 18 of Decree No. 13/2023/ND-CP.

 Decree No. 13/2023/ND-CP of the Government of Vietnam comes into force as of July 1, 2023.

>> CLICK HERE TO READ THIS ARTICLE IN VIETNAMESE