Decree 13/2023 on Personal Data Protection (PDPD) has stirred a lot of excitement among legal professionals in Vietnam. Recently, such excitement met with the cold hard realities of the difficulties in fulfilling even the basic administrative procedures under PDPD. In particular, in July 2023, the Ministry of Public Security (MPS)  published the required contents of the file for assessment of the impact of personal data processing and the file for assessment of the impact of offshore transferring personal data. The levels of details and analysis required to prepare these files are very demanding. For example, the MPS require these files to include the following information and documents:

• Details of the department and people in charge of personal data protection including establishment decision and documents setting out the authorities of the personal data protection department;

• Details of the related data processor or data controller;

• Details of the type of personal data to be collected and processed;

• Details of the consent and the manner that such consent is obtained;

• The amount of personal data to be processed including volume and number of data subject involved;

• Description of how personal data is to be protected including the organization structure and technical structure involved;

• Analysis of the impact to cover both quantitative and qualitative analysis, positive and negative impact, measures to mitigate negative impact, analysis of the current situation, impact on the rights of the data subject, economic impact, social impact, impact on administrative procedure and legal framework; and

• Description of the method in which opinion on the impact analysis is collected and how such opinion is processed.  

It seems that one would need to have special training and education to complete these files. And the MPS has substantial discretion to ask companies to redo their impact assessment.

Written by Nguyen Quang Vu.