[Legal Update] "Vietnam Draft Personal Data Protection Law"

Vietnam Draft Personal Data Protection Law

October 2, 2024

On September 24, the Vietnamese government opened the public comment period for the draft Personal Data Protection Law which is scheduled to be enacted in October 2025 to take effect from January 2026. 

 

Key takeaways

 

-  Data Protection Trustworthiness Rating (by qualified entities) is a new requirement for the assessment of the impact on personal data processing and the assessment of the impact on cross-border personal data transfer. These assessments must be updated every 6 months and upon the occurrence of certain changes. 

-  Authorized PDP entities and experts must be appointed by entities that handle basic personal data and sensitive personal data. SMEs and start-ups are granted a two-year transition period before being required to comply with this requirement. 

-  A set of conditions and requirements established for being licensed to practice as (i) PDP entities, (ii) PDP experts, (iii) Data Protection Rating agencies (i.e. the entities assess the trustworthiness of entities engaging personal data protection as services) and (iv) Data processing. 

-  Strict PDP obligations when processing personal data in particular business sectors (e.g., behavioral targeted advertising, other targeted advertising, big data processing, artificial intelligence, cloud computing, banking and finance, social networks, and OTT streaming) or when dealing with particular information (e.g., health and insurance data, location data, biometric data, credit data, children's data, and employee’s data).