The Ministry of Public Security has completed the draft Law on Personal Data Protection (“Draft Law”) and is currently in the process of soliciting opinions on the Draft Law.
The Draft Law proposes many specific policies and solutions to enforce personal data protection regulations in Vietnam, including the following notable contents:
– Specific regulations on the protection of personal data in labor recruitment of enterprises:
+ Only information in the list of published recruitment contents or the employee’s dossier can be requested.
+ Information provided in the employee’s dossier must be processed under the law and with the data subject’s consent.
+ Employee dossiers are stored for a period as prescribed by law and must be deleted when no longer required or upon the expiration of the prescribed period.
– Specific cases considered as transferring personal data abroad:
+ Sharing personal data with recipients outside the territory of Vietnam.
+ Sharing personal data at conferences, seminars, meetings, or discussions abroad.
+ Sending documents or emails containing personal data to recipients outside the territory of Vietnam.
+ Publishing personal data on the internet so that it can be received by people outside the territory of Vietnam.
+ Providing personal data to other organizations, enterprises, or individuals for business activities.
+ Providing personal data to fulfill legal obligations abroad or according to the laws of the host country.
The party transferring data abroad is the organization or individual, conducting the above activities must prepare a Dossier for assessing the impact of transferring personal data abroad.
– Regulations on cases requiring immediate updates to the dossier for assessing the impact of personal data processing and the dossier for assessing the impact of transferring personal data abroad:
+ When the company is dissolved or merged.
+ When there are changes in information about the Personal Data Protection Organization and the Personal Data Protection Expert.
+ When new business sectors and services arise or the business of services and products related to personal data registered in the Dossier for assessing the impact of personal data processing, and the Dossier for assessing the impact of transferring personal data abroad.
The Law on Personal Data Protection is expected to take effect on January 01st, 2026.
