On 7 February 2023, the Government issued Resolution 13/NQ-CP approving the latest draft version of the Personal Data Protection Decree ("PDP Decree") and the report which contains the comments of the Standing Committee of the National Assembly ("SCNA"). It further directed the Ministry of Public Security (the agency tasked with drafting the PDP Decree) to update the draft PDP Decree after taking into accountthe SCNAs comments before re-submitting it for the SCNAs approval. However, the official timeline and the latest draft PDP Decree have not been made public.
The PDP Decree goes further to set out permitted basis for processing personal data of a data subject without the data subjects consent namely:
- to protect the health or life of the data subject or other persons;.
- when disclosure is required by law;
- in case of state emergency related to national defense and security; social order and safety; major disaster and dangerous epidemic; when there is a threat that does not necessitate a declaration of emergency or to prevent and combat riots, terrorism, crime or a violation of the law;
- when necessary for the performance of contractual obligations of the data subject;
- when required by the state authority under specialized laws.
The significant developments that emerged from the Resolution as compared to the previously published draft are:
- the addition of contractual necessity as a lawful basis for processing without consent;
- the introduction of the concepts of "data processor", "data controller" and "data controller and processor"; the prior published draft PDP Decree allocated the liability and compliance requirements without distinguishing between the different roles that data handlers could have.
The developments examined above, are indicative of ongoing debate and policy thinking presumably to facilitate the interoperability between the Vietnamese data protection laws and those of other jurisdictions. It is anticipated that the final version whilst retaining most of the major features of the previously published draft will carry significant revisions. An official timeline for the issuance of the PDP Decree is not available but reports indicate that its issuance could be as early as March 2023 with an effective date in July 2023.
For any assistance with data protection laws in Vietnam or any other queries regarding how Vietnams data protection regime may impact you, please contact us.