Vietnam: Dossier on assessment of impact of outbound transfer of personal data

Dossier on assessment of impact of outbound transfer of personal data (Image from the Internet)

1. What is personal data?

According to Clause 1, Article 2 of Decree 13/2023/ND-CP of Vietnam's Government, 'personal data” refers to electronic information in the form of symbols, letters, numbers, images, sounds, or equivalences associated with an individual or used to identify an individual. The personal data includes general personal data and sensitive personal data.

2. Dossier on assessment of impact of outbound transfer of personal data

The dossier on assessment of impact of outbound transfer of personal data is specifically stipulated at Clause 2, Article 25 of Decree 13/2023/ND-CP and includes:

- Contact information and details of the Sender and the Receiver;

- Full name and contact details of an organization or individual under the Sender involved in sending and receiving a Vietnamese citizen’s personal data;

- Description and explanation about objectives of the processing of a Vietnamese Citizen’s personal data after the personal data is transferred abroad;

- Description and clarification of type of personal data to be transferred abroad;

- Description and explanation about the observance of regulations on protection of personal data in Decree 13/2023/ND-CP, detailed measures for protecting personal data;

- Assessment of impact of personal data processing; undesirable consequences and damage that may occur, measures for reducing or removing such consequences and damage.

- Consent of the data subject according to regulations in Article 11 of Decree 13/2023/ND-CP when he/she is informed of the mechanism for feedback and complaint in case of arising problems or requests;

- Document that shows obligations and responsibilities between the Senders and the Receivers for processing of a Vietnamese Citizen’s personal data.

3. Rules for protection of personal data

According to the regulations in Article 3 of Decree 13/2023/ND-CP, the rules for protection of personal data include:

- The personal data shall be processed as prescribed by law.

- The data subject shall be entitled to receive information related to the processing of his/her personal data, unless otherwise provided for by law.

- The personal data shall be processed for the purposes that have been registered and declared by the Personal Data Controller, the Personal Data Processor, the Personal Data Controller-cum-Processor and the Third Party.

- The collected personal data shall be appropriate for the scope and purposes of processing.  The purchase or sale of personal data shall be prohibited in any form, unless otherwise provided for by law.

- The personal data shall be updated and added for the processing purposes.

- The personal data shall be protected and secured throughout the processing. To be specific, the personal data shall be protected from violations against regulations on protection of personal data and prevention of loss, destruction or damage caused by incidents and use of technical measures.

- The personal data shall be stored within a period of time that is appropriate for the processing purposes, unless otherwise provided for by law.

- The Personal Data Controller and the Personal Data Controller-cum-Processor shall comply with the rules for data processing specified in Clauses 1 through 7 of this Article and prove their compliance.

Vo Tan Dai

>> CLICK HERE TO READ THIS ARTICLE IN VIETNAMESE