Legislation on Personal Data Protection Regulations
To address the urgent need for a legal framework for personal data protection in Vietnam, the Government issued Decree 13/2023/ND-CP on Personal Data Protection (“Decree 13”) in April 2023. However, after more than a year of practical application, several provisions of Decree 13 have proven to be unclear, causing difficulties for individuals, businesses, and authorities in protecting personal data. Additionally, when issuing Decree 13, the Government acknowledged that it was only a temporary solution for personal data protection.
Given the complexity and scope of personal data protection activities, the Government believes that personal data protection should be regulated by a law enacted by the National Assembly. Therefore, the Draft Law on Personal Data Protection (“Draft“) is currently being developed to consolidate personal data protection regulations into a single law and clarify some ambiguous provisions. Key points of the Draft Law include:
Clarifying the frequency of updating data processing impact assessment and data transfer abroad records
The regulations in Decree 13 only set a general principle that: “after submitting data processing impact assessment records and data transfer abroad assessment records to the Ministry of Public Security, the data controller must update and resubmit these records if there are any changes”.
The above regulation is not practical, as the amount of personal data controlled by a business may change daily or even hourly, such as fluctuations in the number of employees each day in large companies. Therefore, with such frequency, complying with the regulation on updating impact assessment records each time there is a change is impossible for many businesses.
To address this issue, the Draft has proposed specific regulations on the frequency with which personal data controllers must update impact assessment records. Specifically, after submitting the personal data impact assessment records to the regulatory authority, data processors are required to update the records every six months.
However, businesses are still required to immediately update assessment records in certain exceptional cases, including: when the company is dissolved or merged; when there is a change in information about the individual or organization appointed by the data processor to protect personal data; and when registering to add or remove business activities related to personal data services.
Supplementing the principle of obtaining consent from data subjects for each company in a group
In addition to the basic principles of personal data protection outlined in Decree 13, the Draft Law proposes additional principles as follows:
Parent companies, subsidiaries, and each company within an economic group or corporation must independently responsible for protecting personal data in accordance with the law. Consent given by a data subject to one company does not imply consent for all companies within the economic group or corporation to process personal data.
If the Draft is approved, businesses must note that if an individual is a customer of multiple companies within the the businesses’s group, each member company must obtain consent for personal data processing from that individual. Consent given to a sister company will not be valid for other companies in the group.
Clarifying cases of transferring personal data abroad
The current regulations in Decree 13 do not specifically list cases considered as transferring personal data abroad, leading to inconsistencies in implementation and application among businesses as well as authorities. To address this limitation, the Draft proposes to clearly define cases considered as transferring data abroad.
Besides obvious cases such as sending documents or emails containing personal data to recipients outside Vietnam, sharing or disclosing information containing personal data at conferences, seminars, or meetings organized abroad; or publishing personal data online, making it accessible to individuals outside Vietnam, is also considered as transferring personal data abroad.
Clarifying regulations on personal data protection in employee monitoring and recruitment
This is also a new provision added to the Draft, aimed at establishing personal data protection requirements for employers in the recruitment process.
Accordingly, employers may only request employees to provide information listed in the publicly announced recruitment content or employee records. Additionally, employee records are to be stored for a limited period and must be deleted when no longer required or when the designated period ends.
This provision requires businesses to be more transparent in their labor oversight processes and to exercise tighter control over employees’ personal data.
Overall, the Draft’s proposals seek to clarify principles and procedures in the area of personal data protection. If approved by the National Assembly, the Draft is expected to address many of the issues and limitations of Decree 13, helping both businesses and regulatory agencies to achieve consistency in compliance and the application of personal data protection regulations. The Draft is scheduled to be submitted for approval at the October 2025 session of the National Assembly.
