Decree No.13/2023/ND-CP of Vietnamese Government on Protection of Personal Data


        The Vietnamese Government has just issued Decree 13 with the first official regulations related to the protection of personal data. So according to this decree how will our personal data be protected from July 1, 2023 when this Decree takes effect. First of all, it should be understood that personal data and information in the form of alphanumeric symbols, audio, or similar forms on the electronic medium are associated with a particular person or help identify a particular person. Personal data includes basic personal data and sensitive personal data.

Basic personal data includes first name, middle name and birth name, other name if any, date of birth date of death or disappearance, gender, place of birth, place of birth registration, place of permanent residence, place of temporary residence, current place of residence shop, contact address, nationality, personal photo, phone number, identity card number, personal identification number, passport number, driver's license number, license plate number, personal tax code number, social insurance number, social security number, health insurance card number, marital status, information about family relationship, parent and child, information about an individual's digital account, personal data reflecting historical activity in social network of other information that is tied to a particular person or helps to identify a particular job.
    Sensitive personal data is personal data associated with an individual's privacy, which, when violated, will directly affect an individual's legitimate rights and interests, including political views, opinions, religions, health status and private life recorded in the medical record do not include information about blood type, information related to racial origin, ethnic origin, information about inherited or acquired genetic characteristics of the individual , information about an individual's physical attributes, biological characteristics, information about an individual's sex life, sexual orientation, criminal data, and criminal behavior are collected and stored by institutions, law enforcement agencies, customer information of credit institutions, foreign bank branches, payment intermediary service providers, and other authorized organizations, including customer identification information as prescribed by law, account information, deposit information, information about deposited assets, transaction information, etc and other personal data that is required specifically by law that requires necessary security measures.
      Each person has the right to make decisions about his or her personal data, including the following 11 rights:
    1. Right to know. You have the right to be informed about the processing of your personal data.
    2. The right to consent. You have the right to agree or disagree with the processing of your personal data except in some special cases. Your consent must be clearly expressed in writing by voice or by ticking the agree box, the syntax of consent in the messages, especially unresponsive silence is not called consent.
    3. Access rights. You have access to view corrections or request corrections of your personal data
    4. Right to withdraw consent. Even though you have agreed to allow the processing of your personal data, you still have the right to withdraw that consent
    5. Right to erase data. you may delete or request deletion of your personal data, but in some cases will not be entitled to request deletion of data such as personal data that has been made public in accordance with the law, data is processed to serve legal needs for scientific research, statistics,
    6. Right to restrict data processing. You are requested to limit the processing of your personal data; the restriction of data processing is carried out immediately within 72 hours, i.e. 3 days after your request with all the personal data that you request to be restricted.
    7. Right to provide data. You are required to request the personal data controller, controller and processor of personal data to provide yourself with your personal data.
    8. Right to object to data processing. You may object to the personal data controller, personal data controller and processor processing your personal data in order to prevent or limit the disclosure of personal data or its use for advertising and marketing purposes. The controller of personal data, the controller and processor of personal data fulfills the request of the data holder within 72 hours after receiving the request, unless otherwise provided for by law.
    9. Right to complain, denounce, sue. You have the right to complain, denounce and sue in accordance with the law about the illegal exploitation and use of your personal data.
    10. Right to claim damages. You have the right to claim damages in the event of a breach related to the protection of your personal data.
    11. Right to self-defense. You have the right to self-protect your personal data in accordance with regulations. Also according to this decree in certain cases, the processing of personal data is still carried out without your consent. That is, in cases of urgent need for immediate processing of relevant personal data, important to protect the life and health of data subjects or others, the disclosure of personal data in accordance with the law. In the event of an emergency, when there is a risk of threatening national security or the case of crime prevention and violation of the law to perform your contractual obligations with agencies, organizations and individuals as prescribed and finally to serve the activities of competent state agencies in accordance with specialized laws.
    Entering the digital era, all personal data in cyberspace becomes a valuable resource that could be easily collected, traded and used to commit different types of crimes and infringement upon human rights, civil rights. Therefore, The Decree 13/2023/ND-CP of Vietnam taking effect on July 1st 2023 will not only play a vital role in personal data protection nationwide effectively but also urge its stakeholders to elevate their responsibility in the enforcement of these regulations.

Post a Comment