What is included in a dossier on assessment of impact of outbound transfer of personal data in Vietnam?

When are the cases of outbound transfer of Vietnamese citizen’s personal data?

Pursuant to Clause 1, Article 25 of Decree 13/2023/ND-CP, a Vietnamese citizen’s personal data shall be transferred abroad in case where the Sender makes a dossier on assessment of impact of outbound transfer of personal data and carries out the following procedures:

- A dossier on assessment of impact of outbound transfer of personal data shall be always available in order to serve inspection and assessment by the Ministry of Public Security.

The Sender shall send 01 authentic copy of the assessment to the Ministry of Public Security (Department of Cyber​​security and Hi-tech Crime Prevention) according to Form No. 06 in the Appendix of Decree 13/2023/ND-CP within 60 days from the date of processing of personal data.

- The Sender shall notify the Ministry of Public Security (Department of Cyber​​security and Hi-tech Crime Prevention) of information about the data transfer and contact details of the organization or individual in charge of such transfer in writing after the personal data is successfully transferred.

- The Ministry of Public Security (Department of Cyber​​security and Hi-tech Crime Prevention) shall make assessment and request the Sender to complete the dossier on assessment of impact of outbound transfer of personal data in case the assessment is not complete and accurate according to regulations.

The senders include the Personal Data Controller, the Personal Data Controller-cum-Processor, the Personal Data Processor and the Third Party.

What is included in a dossier on assessment of impact of outbound transfer of personal data in Vietnam? (Internet image)

What is included in a dossier on assessment of impact of outbound transfer of personal data in Vietnam? 

Pursuant to Clause 2, Article 25 of Decree 13/2023/ND-CP, a dossier on assessment of impact of outbound transfer of personal data includes:

- Contact information and details of the Sender and the Receiver;

- Full name and contact details of an organization or individual under the Sender involved in sending and receiving a Vietnamese citizen’s personal data;

-  Description and explanation about objectives of the processing of a Vietnamese Citizen’s personal data after the personal data is transferred abroad;

- Description and clarification of type of personal data to be transferred abroad;

- Description and explanation about the observance of regulations on protection of personal data in Decree 13/2023/ND-CP, detailed measures for protecting personal data;

- Assessment of impact of personal data processing; undesirable consequences and damage that may occur, measures for reducing or removing such consequences and damage.

- Consent of the data subject according to regulations in Article 11 of Decree 13/2023/ND-CP when he/she is informed of the mechanism for feedback and complaint in case of arising problems or requests;

- Document that shows obligations and responsibilities between the Senders and the Receivers for processing of a Vietnamese Citizen’s personal data.

Some other regulations on the outbound transfer of personal data in Vietnam

(1) The Sender shall update and amend the dossier on assessment of impact of outbound transfer of personal data when there is any change of contents submitted to the Ministry of Public Security (Department of Cyber​​security and Hi-tech Crime Prevention) according to Form No. 05 in the Appendix of Decree 13/2023/ND-CP.  The duration for completion of the dossier on assessment for the Sender is 10 days from the date of request.

(2) According to specific situation, the Ministry of Public Security shall decide to inspect the outbound transfer of personal data once a year, unless it detects violations against the law on protection of personal data in Decree 13/2023/ND-CP or a Vietnamese citizen's personal data is leaked or lost.

(3) The Ministry of Public Security shall decide to request the Sender to stop transferring personal data abroad in the following cases:

+ It is detected that the transferred personal data is used for activities that violate the interests and national security of the Socialist Republic of Vietnam.

+ The Sender does not comply with regulations in (1) and (2);

+ A Vietnamese citizen's personal data is leaked or lost.

Mai Thanh Loi

>> CLICK HERE TO READ THIS ARTICLE IN VIETNAMESE