HomeIco

Home

 InternalIco

Internal
Deutsch|English
Insights Draft Law on Personal Data Protection

Draft Law on Personal Data Protection

PrintMailRate-it
​On September 24, 2024, the Vietnamese Government released the Draft Law on Personal Data Protection (Draft PDPL) for public consultation. This draft aims to enhance and clarify data protection regulations previously established in Decree No. 13/2023/ND-CP on Personal Data Protection (PDPD).
     

Key updates include:

  1. Expanded Scope: The Draft PDPL explicitly extends its scope to include agencies, organizations, and individuals processing the personal data of foreigners within Vietnam;
  2. Stricter Consent Requirements: The Draft PDPL restricts organizations from requiring consent for data transfers to unrelated services. For intra-group transfers, consent granted to a parent company does not automatically extend to subsidiaries. Each entity within the group is independently responsible for the protection of personal data;
  3. Sector-specific Requirements: The Draft PDPL sets clear standards across multiple sectors including marketing, big data, artificial intelligence, cloud computing, labor and recruitment, financial services, health and insurance, social network and OTT services; 
  4. Personal Data Protection Services: The Draft PDPL establishes new regulations and administrative procedures for personal data protection services, defining business categories like personal data protection organizations, certification organizations, and trust rating organizations;
  5. Appointment of Data Protection Department (DPD) and Data Protection Officer (DPO): Under the Draft PDPL, the obligation to appoint a DPD and DPO applies to all organizations handling personal data, whether basic or sensitive. Micro, small, and medium-sized enterprises (MSMEs) are granted with a two-year exemption from this requirement, except for MSMEs involved in data protection-related sectors; 
  6. Data Processing Impact Assessment (DPIA) and Cross-border Data Transfer Impact Assessment (TIA): The DPIAs and TIAs must be updated and resubmitted every six months, or immediately when certain changes occur (e.g., dissolution, merger, etc.).
     
The Draft PDPL is expected to be presented to Vietnam’s National Assembly by the end of 2024, with implementation by January 1, 2026. Businesses should prepare and align early to avoid disruptions and strengthen their market position in Vietnam’s increasingly regulated data environment.

From The Newsletter

Newsflash Asean 

Newsflash ASEAN​

Contact

Contact Person Picture

Michael Wekezer

Partner

+84 28 7307 2788

Send inquiry

How We Can Help
Skip Ribbon Commands
Skip to main content
Deutschland Weltweit Search Menu