In this newsletter, Grant Thornton Vietnam would like to update the highlights of Decree 13/2023/ND-CP (effective from July 1, 2023) on protection of personal data.
New definitions/concepts: “basic personal data”, “sensitive personal data”, “personal data processor” and “personal data controller”
Applicable objects: relevant domestic or foreign organizations/individuals.
The consent of the data subject:
- Silence/non-response is not considered as consent.
- Expressed in a format that can be printed and reproduced in writing.
Principles of personal data protection: explicit, for the right purpose, limited storage time.
Data subjects: 11 rights and 5 obligations
Sanctions: discipline, administrative penalties, and criminal prosecution.
Personal data protection measures include: management, technical, state management, Investigation/ procedure measures
Outbound transfer of personal data: The Ministry of Public Security checks dossiers on assessment of impact
Agency in charge of protecting personal data: Department of Cybersecurity and Hi-tech Crime Prevention - Ministry of Public Security
Notification of personal data processing: Perform once before proceeding, the format could be printed and reproduced in writing.
Services related to the protection of personal data rights Grant Thornton Vietnam can support:
- Services for creating and consulting on personal information protection policies and internal security policies;
- Services for consulting on adjusting labor contracts, economic contracts, and privacy policies;
- Services of preparing dossiers on impact assessment of personal data protection and registering with the Ministry of Security;
- Other consulting services related to personal data protection.
