In this newsletter, Grant Thornton Vietnam would like to update the highlights of Decree 13/2023/ND-CP (effective from July 1, 2023) on protection of personal data.

New definitions/concepts: “basic personal data”, “sensitive personal data”, “personal data processor” and “personal data controller”

Applicable objects: relevant domestic or foreign organizations/individuals.

The consent of the data subject:

  • Silence/non-response is not considered as consent.
  • Expressed in a format that can be printed and reproduced in writing.

Principles of personal data protection: explicit, for the right purpose, limited storage time.

Data subjects: 11 rights and 5 obligations

Sanctions: discipline, administrative penalties, and criminal prosecution.

Personal data protection measures include: management, technical, state management, Investigation/ procedure measures

Outbound transfer of personal data: The Ministry of Public Security checks dossiers on assessment of impact

Agency in charge of protecting personal data: Department of Cyber​​security and Hi-tech Crime Prevention - Ministry of Public Security

Notification of personal data processing: Perform once before proceeding, the format could be printed and reproduced in writing.

Services related to the protection of personal data rights Grant Thornton Vietnam can support:

  • Services for creating and consulting on personal information protection policies and internal security policies;
  • Services for consulting on adjusting labor contracts, economic contracts, and privacy policies;
  • Services of preparing dossiers on impact assessment of personal data protection and registering with the Ministry of Security;
  • Other consulting services related to personal data protection.