The Decree on the Protection of Personal Data (PDPD) reformed Vietnam's privacy jurisprudence, representing the first comprehensive data protection law. The PDPD was issued by the Ministry of Public Security (MPS) in April 2023, and soon after, on July 1, 2023, came into effect.
The PDPD regulates the legal basis of data processing of Vietnamese nationals, which is driven by consent. The PDPD also introduces controller and processor obligations, and data processing principles similar to the GDPR and provides strict requirements in relation to outbound data transfers. Interestingly, the PDPD introduces certain novel data subject rights, including the right to complain, denounce, and initiate lawsuits, claim damages, and self-defense.
Even though the PDPD has entered into effect, micro, small, medium-sized, and start-up enterprises have the option to be exempted from the PDPD for the first two years of registration when establishing a business; however, this exemption does not apply to enterprises directly engaged in personal data processing activities.
The PDPD is Vietnam's first step toward consolidating regulations on personal data. The PDPD requires entities and individuals involved in personal data processing activities in Vietnam to adopt a more proactive approach, including, conducting impact assessments, obtaining proper consent, and implementing management and technical measures to protect personal data. However, because a proper enforcement framework does not yet exist and because additional guidance, which is expected to be issued soon, is lacking, it is difficult for both the authorities and affected entities and individuals to fully comply with the PDPD.
As published by OneTrust DataGuidance
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
