Vietnam’s first data privacy law to take effect on July 1, 2023
02 May 2023
Vietnam will soon have its very first data privacy law with the issuance of Decree No. 13/2023/ND on Protection of Personal Data (PDP Decree) on April 17, 2023.
According to the PDP Decree which will take effect on July 1, 2023, data processing activities include collection, recording, analysis, confirmation, storage, correction, disclosure, combination, access, retrieval, encryption, decryption, copying, sharing, transmission, provision, transfer, deletion, destruction and related actions.
The PDP Decree sets forth the rights of data subjects; conditions and forms of consent which include consent given in writing and through SMS, among others; the different types of personal sensitive data which also include a data subject’s health conditions and politically-related views; protective measures for basic personal data; new requirements for cross-border transfer of data; and corresponding responsibilities of the Department of Cybersecurity and Hi-tech Crime Prevention and other authorities, among others.
“Reflecting the EU’s GDPR in both the extra-territorial regulatory scope as well as stringent regulations, the PDP Decree will set a new standard for both onshore and offshore entities concerning how personal data shall be treated in Vietnam,” said Tran Manh Hung, head of IP & technology practice at BMVN in Hanoi, a member of Baker McKenzie Vietnam.
He added that the PDP Decree is among the Vietnamese authorities’ first attempts to regulate data and tech-related affairs.
“The government will soon officialize the draft decree on administrative sanctions in cybersecurity, which will enable the implementation of cybersecurity and data protection regulations. The Law on Personal Data Protection, which ranks higher than the PDP Decree in Vietnam’s hierarchy of norms, will also commence its drafting phase in 2024. Data privacy is also covered under several bills, such as those on e-transactions, telecommunications and consumer protection,” said Tran.
“Companies should therefore stay prepared for growingly stringent enforcement actions from the State,” he noted.
- Espie Angelica A. de Leon
