Decree 13/2023/ND-CP on personal data protection is one of the most important legal instruments that enterprises operating in Vietnam need to understand, whatever sector they are in. This article summarizes the points enterprises should understand before starting an internal review.
Who does the Decree apply to?
Decree 13/2023 applies to organizations and individuals that process personal data in Vietnam, including enterprises headquartered abroad that process the personal data of people in Vietnam. "Processing personal data" is understood broadly: collecting, storing, using, sharing and deleting data all fall within its scope.
Key obligations enterprises should note
At a high level, enterprises typically need to review the following groups of topics:
- Lawful basis for processing: determine clearly why the enterprise may collect and use a specific kind of personal data (for example, the data subject's consent, performance of a contract, or a legal obligation).
- Rights of data subjects: individuals have the right to be informed, to access, to correct, to withdraw consent and, in some cases, to request deletion of their data.
- Data protection measures: apply appropriate technical and organizational measures to protect personal data from unauthorized access, use or disclosure.
- Incident notification and response: have a process for detecting, handling and notifying when an incident involving personal data occurs.
- Third-party management: control the sharing of personal data with partners, suppliers or other data processors.
Where should an enterprise start?
A practical approach is to start with identification: what kinds of personal data the enterprise collects, where, and for what purposes. Once there is an overall picture, the enterprise checks each group of obligations above to identify the gaps to close.
This is also the approach taken in AISA's free compliance assessment, a reference tool that helps enterprises quickly self-review 7 related topic groups before going into detailed legal advice.
How does technology help?
In terms of technical protection measures, document-centric data security platforms such as the product help enterprises control access rights, log usage and limit the sharing of personal data contained in documents. This is one part of the overall picture and does not replace building internal policy and obtaining legal advice.
