Vietnam’s Protection of Personal Data

The regulatory authority is the Department of Cyber Security and Hi-Tech Crime Prevention of the Ministry of Public Security;

In case of processing of personal data of a child 7 years or older, consent must be obtained from both the child as well as the parent/guardian;

The Decree approves five cases of data processing without data subject consent: (1) to protect the life and health of data subjects or others in cases of emergency; (2) public disclosure of personal data under legal requirements; (3) processing done by relevant regulatory agencies for specific purposes such as investigations etc.; (4) to fulfill contractual obligations of the data subject with relevant agencies etc.; (5) processing done by relevant state agencies during emergencies such as prevention of violence, terrorism, etc;

Organizations are required to conduct an impact assessment before transferring any personal data outside of Vietnam. The importing and exporting parties are also required to have a contractual agreement in place that outlines the responsibilities of each party with respect to data transfers;

The regulatory authority must be informed of any violations under the Decree within 72 hours after the violation occurs. This notification should be in the prescribed form no. 3 of the appendix of the Decree.