Draft Personal Data Protection and Data Laws Published
On 24 September, the government published the first draft of a new Personal Data Protection (“PDP”) Law. The new draft law, which was first announced on 29 February, will now be put out for public consultation until November. It comes after Decree No. 13/2023/ND-CP (“the PDP Decree”) entered into force in April 2023 – we wrote about it here and here – and is the latest step in the government’s efforts to modernize the Vietnamese legal framework and align it with international standards in personal data protection.
The draft PDP Law at a glance
Containing 68 articles, the draft PDP Law is more detailed than the 2023 PDP Decree in that it makes specific reference to individual industries such as marketing, insurance, healthcare, artificial intelligence, advertising, and recruitment. It also includes draft proposals for cross-border data sharing (including among entities in the same enterprise), the use of third-party service providers for data protection in companies, and new definitions for some of the terms used in the PDP Decree such as ‘sensitive personal data’.
Once implemented, the draft PDP Law will be applied to both foreign and domestic entities operating in Vietnam and Vietnamese entities and data subjects overseas, whose informed consent remains the overriding principle guiding the legislation. One proposal which will be of particular interest for companies is the proposed ratings based on their fulfilment of personal data protection requirements, with the most compliant given higher ratings.
The draft law also aims to close gaps in current legislation and provide greater clarification on how personal data should be protected and handled. In particular, once promulgated, the new law will prevail if there are conflicts between it and other regulations, such as the PDP Decree, that cover personal data. This is an important step, as there are almost 70 separate legal documents regulating various aspects of personal data protection. This has led to inconsistencies in interpretation and implementation, according to government reports published in 2023.
Tackling abuse of personal data
The new law is also needed to tackle rampant abuse and misuse of personal data, such as the unauthorized sale of contact information leading to unwanted sales calls and fraudulent communications. Such cases affected tens of millions of Vietnamese people in 2023 alone, according to the Ministry of Public Security (“MPS”).
For instance, one incident reported in Vietnam Law Magazine in September 2022 involved the sale of education data containing personal details of almost one-third of the population – including their names, ages, emails, phone numbers, grades, schools, and addresses. To give a sense of the scale of the issue, MPS estimated that hundreds of individuals and organizations were involved in the illegal trade of personal data in 2019 and 2020.
Next steps
It is anticipated that the new PDP Law will go before the National Assembly for ratification in Spring 2025 before entering into force in January 2026. It is important to note that the draft contains no transition period for large companies. However, micro-enterprises, start-ups, and SMEs will have two years to appoint a data protection department from the date of their incorporation.
Draft new Data Law
Meanwhile, earlier this month, the MPS published the draft of a new Data Law. One of the proposals under consideration in this new law is a regulated online platform, under MPS, to facilitate the legal sale and exchange of data. State-owned enterprises and so-called “public non-business units under state management” would be permitted to establish data-exchange platforms, and required to submit regular reports to MPS.
However, the draft Data Law stipulates that the data sold on this platform would not include personal data for which consent has not been given and, further, that sales must not infringe on the legitimate rights of individuals. The draft law, set to go before the National Assembly next month, also includes proposed safeguards to make sure that information remains private and measures to resolve complaints. The government plans to pilot five of these data-exchange platforms before the end of this decade.
The team at APFL Partners will continue to monitor these draft regulations and keep our clients updated on how changes to data protection legislation could impact their companies and commercial operations in Vietnam. To find out more about how to remain compliant, please contact our team on: contact@apflpartners.com
Disclaimer: This article and its content are for information only and are not given as legal or professional advice. they do not necessarily reflect all relevant legal provisions with respect to the subject matter. Readers should seek legal or professional advice before taking or refraining to take any action.
