Navigating Vietnam's New Data Protection Landscape: Decree No.13/2023/ND-CP dated 17 April 2023 on the protection of personal data (“Decree No. 13/2023/ND-CP”).
In a significant stride towards enhancing cybersecurity and fortifying data protection measures, Vietnam Government has introduced Decree No.13/2023/ND-CP becoming effective from 1st July 2023. This Decree mandates enterprises in the country acting as Personal Data Controller (PDC), Personal Data Processor (PDP), or both (PDCP) to prepare and submit an impact assessment dossier related to their data processing activities. The submission is directed to the Cybersecurity Department under the Ministry of Public Security (MPS), marking a pivotal moment for businesses in the digital era.
The Submission Process:
Enterprises are now required to meticulously prepare and submit their impact assessment dossiers, with these documents undergoing rigorous review by the MPS. Keeping these dossiers updated is imperative, requiring submitting entities to promptly address any changes or comply with the MPS's requests.
Challenges Encountered by Enterprises:
The implementation of the Decree No.13/2023/ND-CP has brought challenges, particularly for enterprises heavily involved in extensive private data processing, such as those in the banking, retail, F&B, software development sectors. A few notable hurdles include:
Identifying Third-Party Involvement:
Enterprises grapple with the intricate challenge of discerning entities involved in private data processing. This complexity is further heightened by the necessity to recognize the role played by local tax bureaus and social insurance agencies, which are to be treated as transferees of private data from enterprises. This recognition becomes crucial during the preparation and submission of dossiers for tax declarations or social insurance contributions. Many enterprises are unaware of this aspect, adding an extra layer of complexity to compliance efforts.
Retaining a Local Team:
Confusion looms over the requirement for enterprises to retain a dedicated team working full-time in Vietnam specifically for overseeing personal data processing. This mandate poses a dilemma, particularly for foreign-owned companies that often prioritize maintaining their IT teams overseas. Striking a balance between compliance and operational efficiency becomes a strategic imperative, adding complexity to decision-making processes.
Impact on Various Aspects:
The comprehensive report mandated by the Decree 13/2023/ND-CP, detailing the impact of private data processing on legal systems, administrative procedures, and broader social issues (health, education, etc.), introduces a multifaceted challenge for enterprises unfamiliar with addressing such concerns. The intricacies of preparing a report that covers these diverse aspects demand a thorough understanding of the implications, placing an additional burden on organizations aiming for compliance excellence.
SB Law: Your Trusted Partner in Compliance:
Recognizing the intricate nature of these challenges, SB Law, a professional law firm, stands as a beacon of support for enterprises navigating the legal and administrative complexities of Decree No.13/2023/ND-CP. Our team is equipped to provide comprehensive assistance, including preparing and submitting the requisite reports and offering follow-up services with the MPS to ensure the provision of necessary updates and explanations.
As your dedicated legal solutions provider, SB Law understands the dynamic regulatory landscape and is committed to ensuring your organization seamlessly adapts to these new requirements.
For inquiries or assistance, please reach out to us. At SB Law, we are here to empower your organization to not only comply with regulations but also safeguard your data processing activities effectively.
