On 7 March 2023, the Government issued Resolution No. 27/NQ-CP to approve certain key contents of the draft decree on personal data protection ("PDP Decree"). The PDP Decree was issued on 17 April 2023, and it will come into effect from 1 July 2023.
The PDP Decree represents the first consolidated data protection regulation in Vietnam, and introduces significant changes to the existing (fragmented) regulatory environment for data protection in the country. Many of the provisions and concepts introduced by the PDP Decree were influenced by the European General Data Protection Regulation (GDPR).
The PDP Decree will have extraterritorial application. It regulates both Vietnamese and foreign agencies, organisations and individuals. For the latter, foreign agencies, organisations or individuals that directly participate in or otherwise involved in processing personal data in Vietnam will be regulated by the PDP Decree.
The PDP Decree regulates personal data as information in the form of symbols, letters, numbers, images, sounds or the like on an electronic medium that is associated with a particular person, or helps to identify a particular person. Similar to data protection laws of other jurisdictions, the PDP Decree now categorises personal data into basic personal data and sensitive personal data.
Processing of sensitive personal data attracts additional regulatory obligations. For example, prior to processing, it would require data subjects to be informed that the data being processed comprises sensitive personal data.
Key provisions of the PDP Decree relate to, among others:
- the rights for data subjects;
- general bases for processing personal data;
- consent requirements;
- notification prior to processing personal data;
- breach notification requirements;
- impact assessment for processing personal data;
- cross-border transfer of personal data;
- data protection officer and data protection department.
For more information, click here to read our Legal Update.
