Legal Update on Personal Data Protection

On 7 February 2023, the Government issued Resolution 13/NQ-CP approving the latest draft version of the Personal Data Protection Decree ("PDP Decree") and the report which contains the comments of the Standing Committee of the National Assembly ("SCNA"). It further directed the Ministry of Public Security (the agency tasked with drafting the PDP Decree) to update the draft PDP Decree after taking into accountthe SCNAs comments before re-submitting it for the SCNAs approval. However, the official timeline and the latest draft PDP Decree have not been made public.

The PDP Decree goes further to set out permitted basis for processing personal data of a data subject without the data subjects consent namely:

1. to protect the health or life of the data subject or other persons;.
2. when disclosure is required by law;
3. in case of state emergency related to national defense and security; social order and safety; major disaster and dangerous epidemic; when there is a threat that does not necessitate a declaration of emergency or to prevent and combat riots, terrorism, crime or a violation of the law;
4. when necessary for the performance of contractual obligations of the data subject;
5. when required by the state authority under specialized laws.

The significant developments that emerged from the Resolution as compared to the previously published draft are: 

1. the addition of contractual necessity as a lawful basis for processing without consent;
2. the introduction of the concepts of "data processor", "data controller" and "data controller and processor"; the prior published draft PDP Decree allocated the liability and compliance requirements without distinguishing between the different roles that data handlers could have.

The developments examined above, are indicative of ongoing debate and policy thinking presumably to facilitate the interoperability between the Vietnamese data protection laws and those of other jurisdictions. It is anticipated that the final version whilst retaining most of the major features of the previously published draft will carry significant revisions. An official timeline for the issuance of the PDP Decree is not available but reports indicate that its issuance could be as early as March 2023 with an effective date in July 2023.

Organizations which have been following the Vietnamese regulatory developments or which are already compliant with other data protection laws (such as the GDPR) and hoping to assess their compliance with such laws, would, nevertheless, need to take implementation steps including updating their privacy policy and consent mechanisms for personal data processing and internal data compliance policies. For organizations that operate outside of Vietnam or may export personal data outside of Vietnam, it will also be important to assess the extra-territorial application of the PDP Decree and implement appropriate cross border data transfer mechanisms. Although the latest version of the PDP Decree has not been made public yet, organization should start preparing themselves as the transition period is expected to be short and the authorities to be actively enforcing the new provisions.

For any assistance with data protection laws in Vietnam or any other queries regarding how Vietnams data protection regime may impact you, please contact us.