Your quick guide to burning questions you might have about the new PDPD. Who is affected? What do you need to do? Is it compatible with the use of offshore technology such as cloud storage services? And more.
Vietnam’s first-ever comprehensive legal framework dedicated to personal data protection introduces new rules that capture a wide range of entities.
The new rules – officially titled Decree No. 13/2023/ND-CP and referred to as the Personal Data Protection Decree (or PDPD) – were issued on 17 April 2023 and took effect from 1 July 2023.
The PDPD covers:
- any agency, organization, or individual – whether local or foreign – engaged in the collection and processing of Vietnamese personal data
- onshore and offshore personal data processing and transfers (anyone transferring Vietnamese citizens’ personal data to a foreign country must submit an offshore transfer impact assessment dossier to the competent State authority).
The PDPD follows hot on the heels of another key new cyberspace regulation in Vietnam, Decree 53 dated 15 August 2022 on the Law on Cybersecurity (12 June 2018). Understandably, it has triggered a range of queries from potentially affected clients, not least those who use, or are considering the use of, offshore technology like cloud storage services for the handling of their data.
What kind of data is covered, what are the notification and disclosure duties for data controllers and processors, when does data need to be deleted, and is the PDPD even compatible with the use of technology such as offshore cloud services at all?
This legal alert briefly addresses each of these questions. Many of the PDPD’s provisions are cast in broad terms – they and their intended implementation are not necessarily clear in all respects. Further guidance on these matters is likely to be forthcoming. But we consider that a path for compliance with the PDPD can nevertheless be navigated in the meantime, including for the use of offshore cloud storage services.
Of course, the specifics of your circumstances are important. If you would like to discuss those circumstances and your particular path, please contact Kevin Hawkins, Partner at kevin.hawkins@dfdl.com.
For further information on this subject, we recommend referring to other articles available “Vietnam: Data-Driven Duties”.
To read the full alert, please click on the download button below.
The information provided is for information purposes only and is not intended to constitute legal advice. Legal advice should be obtained from qualified legal counsel for all specific situations.
