Vietnam Decree 13 personal data protection: what to prepare

Vietnam decree 13 personal data rules are still a draft: Government Resolution 13/NQ-CP of 7 February 2023 approved the text, but no decree has been issued yet. The number 13 in this article is the resolution's number. Even so, firms that hold customer or staff data in Vietnam can start preparing now.

This article explains what is law today, what the draft is expected to add, and a short list of steps. It is general information, not legal advice.

What is law today

In April 2023 Vietnam had no decree that dealt only with personal data. Rules sat in several texts. Two examples are Decree 52/2013/ND-CP on e-commerce and Decree 72/2013/ND-CP on internet services and online information. Law firms noted that the draft decree seemed to overlap with these older texts, and that it was not clear how the ministry would reconcile the differences.

Consent is the usual starting point. Under current rules, a business may use personal data to sign or carry out an online contract, such as an e-commerce purchase, without asking for separate consent. That rule comes from the Information Technology Law and Decree 52. Outside those online cases, the safer habit is to ask for clear consent and keep a record of it.

Sources: Rouse, "Vietnam: draft decree on personal data protection issued for public consultation", 16 February 2021; Tilleke & Gibbins, "Vietnam's personal data protection decree takes important step toward issuance", 8 February 2023.

Where the draft stands on 15 April 2023

The Ministry of Public Security first put out a draft personal data decree for public comment in February 2021. A later version was approved by Government Resolution 27 in March 2022. On 7 February 2023 the Government approved the latest version through Resolution 13/NQ-CP. The next day, the National Assembly's Committee for Defense and Security reviewed it. Members found it well prepared but made many comments.

The Minister of Public Security must now revise the text and consult the Standing Committee of the National Assembly. When the draft text was approved, it had not been published, and no date for issue was announced. Treat any date you hear as a guess.

What the draft is expected to change on consent

Consent stays the core rule. The February 2023 resolution lists five cases where data may be handled without consent. They are: saving a life or health in an emergency; disclosure required by law; work by state bodies on defence, security, public order, disasters, epidemics or crime; carrying out a contract with the person; and support for state agency tasks set by sector laws.

The contract case is new, and its limits are unclear. A lawyer who reviewed it compared it to a similar basis in European law, and said it could be read widely or narrowly. The European "legitimate interests" basis is not in the list. The draft also uses the terms "data controller" and "data processor", which Vietnamese law has not used before.

Sources: Tilleke & Gibbins, 8 February 2023, on Resolution 13/NQ-CP.

Sensitive data and impact reports

The text approved in 2023 was not public, so earlier drafts are the best guide. The 2021 draft named kinds of sensitive data. They included health, genetic and biometric data, political and religious views, financial data, location data and criminal records held by law enforcement. It asked for an impact assessment report before sensitive data was handled or sent abroad. The report would cover the purpose, the risks and the steps to limit harm.

That draft also set fines of VND 50 million to 100 million for many breaches. For repeat breaches it allowed a fine of up to 5 percent of revenue. It proposed a new body, the Personal Data Protection Committee, under the Ministry of Public Security. Later versions may differ on every one of these points, so do not plan around the numbers. Plan around the ideas: know your sensitive data, and be ready to show your risk work.

Sources: Rouse, 16 February 2021, on the draft decree published by the Ministry of Public Security.

A practical list to prepare

Start with a data map. Write down what personal data you hold, where it came from, where it is stored and who can reach it. Mark any data about health, money, location or biometrics as sensitive.

Next, review your consent wording. The 2021 draft would have required consent in a form that can be printed or copied, so a written record is a good habit. Is it clear, specific and recorded? Can you show who agreed, when and to what? If you rely on a contract as your reason, keep a note of why the data is needed for that contract.

Then look at transfers. List every vendor, cloud service or group company that receives data outside Vietnam. Check what consent covers each one. The 2021 draft also proposed that transfers abroad need the data subject's consent and written approval from the new committee. Finally, name one person to follow the draft and to answer staff questions. Review your plan when the Government issues the final text, because the details may change.

This article is general information about the law and not legal advice. If your company handles personal data in Vietnam, ask a Vietnamese data protection lawyer to check the final decree against your own practices.

Sources: Rouse, 16 February 2021; Tilleke & Gibbins, 8 February 2023.