In an era dominated by digital connectivity and information sharing, the protection of personal data has become a critical concern globally. Vietnam, as a rapidly developing economy in Southeast Asia, has recognized the importance of safeguarding personal data through comprehensive regulations. The cornerstone of this regulatory framework is Decree 13/2023/ND-CP, which outlines key principles and obligations concerning the collection, use, and storage of personal data within Vietnam’s jurisdiction as well as transmission abroad. For foreign investors and businesses eyeing opportunities in Vietnam, understanding these regulations is not just prudent but essential for compliance and fostering trust among customers. This article delves into Decree 13, its implications, and actionable insights for businesses operating or planning to operate in Vietnam.

Spotlight on Decree 13/2023/ND-CP

Introduction to Decree 13

Decree 13, issued by the Government of Vietnam, signifies a significant step towards aligning the country’s data protection practices with international standards while addressing the specific needs of its digital economy. Officially titled “Decree on Personal Data Protection,” its provisions are designed to protect individuals’ rights while enabling responsible data-driven innovation. Decree 13/2023/ND-CP took effect from 1 July 2023.

Defining Personal Data, and Data Processing related Entities

Under Decree 13, personal data is defined to encompass any information associated with an individual or used to identify an individual. This is information in the form of symbols, letters, numbers, images, sounds, or equivalences on the electronic environment. Personal data includes general personal data and sensitive personal data.

Data Subject means an individual to whom the data relates, while a Data Controller is an organization or individual that decides purposes and means of processing personal data, and Data Processor is an organization or individual that processes data on behalf of the Personal Data Controller via a contract or agreement with the Personal Data Controller.

Key Principles and Scope

At its core, Decree 13 emphasizes transparency, fairness, and accountability in the handling of personal data with broad scope. It applies to all entities, both foreign and domestic entities involving in data processing in Vietnam, that collect, process, or otherwise handle personal data.

Decree 13 establishes several fundamental principles of data protection:

Lawfulness, Knowledge and Consent: Personal data processing must be based on legitimate grounds and obtained with the consent of the data subjects unless otherwise permitted by law.

Purpose Limitation: Data collection, processing, updating, supplementation should have specific, legitimate purposes disclosed to data subjects at the time of collection.

Data storage: Personal data retains it for no longer than necessary.

Security and Confidentiality: Measures must be in place to protect personal data from unauthorized access, disclosure, alteration, or destruction.

Accountability: Data controllers and processor are responsible for demonstrating compliance with these principles and other obligations stipulated in Decree 13.

Creating and notification on records of assessment of personal data processing impact

The Personal Data Controller, the Personal Data Processor, and the Personal Data Controller-cum-Processor shall document and store the records on assessment of impact of personal data processing from the time of starting to process personal data. Such documentation must be notified A05 – The Department of Cybersecurity and Hi-tech Crime Prevention under The Ministry of Public Security and the Ministry of Public Security within 60 days from the date of processing of personal data.

Actions for Compliance and Best Practices

Understanding Your Obligations: For foreign investors and businesses operating in Vietnam, compliance with Decree 13 involves several key actions:

• Data Mapping and Audit: Conduct a comprehensive audit to understand what personal data your organization collects, processes, and stores, including the purposes for which it is used.
• Consent Mechanisms: Review and update consent mechanisms to ensure they meet Decree 13 standards, particularly regarding clarity, specificity, and ease of withdrawal.
• Establishment of Documentation of Assessment of Personal Data Processing Impact for internal record and submission to the authority.
• Data Protection Policies: Develop and implement robust data protection policies and practices that align with Decree 13’s principles. This includes appointing a data protection officer if required.
• Security Measures: Invest in cybersecurity measures to protect personal data from breaches and unauthorized access. Encryption, access controls, and regular security assessments are crucial components.
• Vendor Management: Ensure that third-party vendors and partners handling personal data comply with Decree 13. Implement contractual obligations and conduct due diligence to mitigate risks.

Employee Training and Awareness

Promoting a culture of data protection within your organization is essential. Conduct regular training sessions to educate employees on their responsibilities under Decree 13 and raise awareness about the importance of data privacy.

Response to Data Breaches

Develop and test incident response procedures to promptly address and mitigate the impact of data breaches. Compliance with Decree 13 requires timely notification of affected individuals and relevant authorities when breaches occur.

Conclusion

Decree 13/2023/ND-CP represents Vietnam’s commitment to safeguarding personal data in an increasingly digital landscape. For foreign investors and businesses, understanding and complying with these regulations are essential steps towards sustainable growth and market success in Vietnam. As Vietnam continues to evolve its regulatory framework, staying informed and proactive will be key to navigating the dynamic landscape of data protection in the country.

While Vietnam operates under a civil law system, foreign investors accustomed to common law jurisdictions can navigate regulatory nuances by seeking local legal expertise. Engaging with legal counsel familiar with Decree 13 ensures proactive compliance and strategic decision-making.

Phuong Vo is Managing Partner at Alitium Vietnam, providing market entry and professional support for foreign investors in Vietnam. Contact Phuong via Alitium.com for further assistance and advice.