Vietnam recently issued a draft decree on Personal Data Protection, which will go into effect soon. What impact does this have on Vietnamese investors and businesses?
This century marks a new turning point in human history. We are witnessing the rapid development of telecommunication and the internet. Such progress ushers in a new era of science and technology, contributing to the advancement of the 4.0 Revolution. However, this development poses significant risks to the right to privacy, particularly the right to personal data protection.
The Importance of Personal Data in the Fourth Industrial Revolution
The right to personal data is at the heart of a person’s right to privacy. Such a right is a fundamental human right that safeguards a person’s independence and vogue. This right allows us to create a barrier between ourselves and others, which distinguishes us and allows us to control the flow of information as well as the interaction between others. Create our status in the community, which will be null and void if the right is violated. As a result, personal data protection helps to ensure a democratic, civilized, and sustainable society.
Because of the rapid advancement of technology, the majority of information is now stored in physical and cloud storage. This means that there is always the risk of information breach, resulting in data loss. As a result, personal data protection must be prioritized.
The impact on Vietnamese investors and businesses
Sensitive personal data is subject to additional requirements
Prior to processing, sensitive personal data must be registered with the Personal Data Protection Commission (PDPC) under the Draft. Processors must prepare an application that meets the PDPC’s requirements and submit it for registration approval.
From the date of receipt of a valid application, the PDPC will process the application within 20 working days. This requirement would be extremely burdensome for businesses.
Enterprises must appoint personnel in charge of personal data protection and report this information to the Personal Data Protection Commission (PDPC).
New Data Transfer Regulations Cross-Border
The Draft Decree also mentions new regulations for cross-border personal data transfers. Personal data of Vietnamese citizens can be transferred outside of Vietnam’s borders if all four conditions are met:
a) the data subject consents to the transfer;
b) the original data is stored in Vietnam;
c) A document proving that the country, territory, or a specific area within the country or territory to which it is moving has issued regulations on personal data protection at a level equal to or higher than that specified in the draft decree;
d) Having the written consent of the Personal Data Protection Commission (PDPC).
Personal data has long played an important role for many foreign investors, ranging from finance, insurance, and banking to technology and storage. This development indicates that privacy will become increasingly secure in Vietnam, requiring different requirements to acquire personal data.