New Regulations on Personal Data Protection
Personal Data Protection Set for Overhaul
Vietnam’s first overarching legislation on personal data protection has moved a step closer in recent months. In March, the government published Resolution No. 27/NQ-CP (“Resolution 27”) approving the dossier of the final draft Personal Data Protection Decree (the “PDPD”).
It comes after the draft PDPD was put out for public consultation back in 2021, including proposed regulations on processing and protecting personal data and the roles and responsibilities of the Personal Data Protection Committee.
The final version of the draft PDPD has not been made public so far. However, Resolution 27 includes some notable content. First, it provides a list of the circumstances in which personal data processing can be carried out without the consent of the person concerned. This would be allowed in the following cases:
- In emergencies that threaten human life, health, or safety. Data controllers, processors, or third-parties will determine what constitutes emergencies in this situation.
- When data is disclosed in accordance with the law.
- When data processing is required for reasons of national defense or security.
- When data processing is required in the activities of competent state authorities.
- When data processing is subject to an investigation relating to violations of the law.
It is probable that these provisions will be reflected in the final draft PDP. Therefore, it is advisable that enterprises and individuals follow them in advance of its publication.
Second, Resolution 27 confirms that the PDPD falls within the purview of the National Assembly (“NA”) or its Standing Committee. Therefore, under Resolution 27, the Minister of Public Security has been assigned to seek the consent of the NA before the final PDPD is promulgated.
Third, Resolution 27 also requires the Ministries of Justice and Public Security to work together to develop a new Law on Personal Data Protection – to be discussed and voted on at the NA at a later stage.
It is worth noting that, as per Decision No. 06/QD-TTg of the Prime Minister dated 6 January 2022, personal data regulations will be considered for upgrade from decree to law-level in 2024. Therefore, the PDPD is likely to be a short-term measure and one which will be upgraded in the near future.
For more information about personal data protection regulations in Vietnam, just contact the APFL team on: contact@apflpartners.com
