Tiếng Việt
中文 (中国)
日本語
On September 24, 2024, the Vietnamese government released the first draft of a new Law on Personal Data Protection (PDPL) for public consultation. This draft law marks a significant enhancement of Vietnam’s data protection framework, with stricter provisions compared to the current Personal Data Protection Decree (PDPD). Set to potentially take effect on January 1, 2026, the PDPL draft offers a comprehensive approach to data protection, addressing various sectors from marketing to financial services.
The draft PDPL is open for public feedback until November 24, 2024, providing stakeholders an opportunity to offer their input. The Ministry of Public Security (MPS), which developed the draft, emphasizes the law’s aim to strengthen Vietnam’s personal data protection regime in line with international standards.
Key Features of the Draft Law in Vietnam
Clear Definitions of Personal Data in Vietnam
The draft introduces new definitions and refines existing terms. It distinguishes between “basic personal data” (e.g., name, gender, phone number) and “sensitive personal data” (e.g., biometric data, location data). It also introduces concepts like “personal data protection expert” and “personal data protection credit rating,” further outlining the responsibilities of organizations handling personal data.
Expanded Scope
The draft PDPL applies to all Vietnamese entities, including organizations, individuals, and agencies both within and outside of Vietnam, as well as foreign entities processing personal data in the country. This broad jurisdiction ensures that Vietnamese data subjects’ information is protected domestically and internationally.
Stricter Consent Requirements
The PDPL mandates that controllers and processors of personal data obtain explicit and informed consent from data subjects, especially for sensitive personal data like health records or political views. Silence or non-response cannot be interpreted as consent, reinforcing Vietnam’s commitment to stringent data privacy standards. Cross-border data transfers also require clear consent under the new framework.
Data Protection Impact Assessments (DPIA) and Transfer Impact Assessments (TIA)
Organizations will be required to conduct DPIAs and TIAs every six months or whenever there is a significant change in data processing activities. This ensures that data protection measures are continuously reviewed and updated to meet regulatory demands.
Obligations for Enterprises
The PDPL imposes strict requirements for enterprises to appoint data protection departments, either internally or through outsourcing. These departments must include at least one personal data protection expert. While micro-enterprises, SMEs, and startups are exempt from this requirement for the first two years, they must comply with other obligations within the same timeframe as larger businesses.
No Data Sales Allowed
The draft PDPL explicitly prohibits the sale of personal data in any form, reinforcing the principle that personal data is not a tradable commodity. This provision is expected to strengthen consumer trust in how businesses handle sensitive information.
Data Breach Notifications
In the event of a data breach, organizations must notify authorities within 72 hours. This rule mirrors international standards and ensures timely responses to potential violations of personal data security.
New Certification Mechanisms
The draft law introduces a certification system that assigns ratings to businesses based on their personal data protection practices. This system will serve as a form of “credit rating,” allowing companies to demonstrate compliance and enhance their reputation.
Sector-Specific Provisions
- Marketing: Companies providing marketing services must obtain explicit consent from customers before processing their personal data for advertising purposes. The law allows data subjects to request the cessation of marketing activities using their data at any time.
- Financial and Credit Data: The PDPL introduces strict rules for financial institutions. These entities cannot share unencrypted credit data or personal financial information without consent. Financial assessments must follow specific legal guidelines, and institutions are prohibited from unlawfully trading or transferring credit information.
The draft PDPL is expected to be adopted by the National Assembly in May 2025. It does not provide a transition period for compliance, except for micro-enterprises, SMEs, and startups, which are only exempt from appointing a data protection department during their first two years. All other obligations must be met by the January 1, 2026, deadline, ensuring that organizations have time to adapt to the new framework.
ASL Law is a leading full-service and independent Vietnamese law firm made up of experienced and talented lawyers. ASL Law is ranked as the top tier Law Firm in Vietnam by Legal500, Asia Law, WTR, and Asia Business Law Journal. Based in both Hanoi and Ho Chi Minh City in Vietnam, the firm’s main purpose is to provide the most practical, efficient, and lawful advice to its domestic and international clients. If we can be of assistance, please email to [email protected].
ASL LAW is a top-tier Vietnamese law firm that provides in-depth legal advice in Vietnam and internationally. If you need any advice, don’t hesitate to get in touch with us for further information or collaboration.
