The laws of Vietnam have introduced a general requirement for the reporting and notification of actual or suspected personal information security incidents. A data breach reporting / notification requirement in Vietnam will be triggered if the data incident falls within any of the following scenarios:

• Scenario 1. The affected data system is located in Vietnam.
• Scenario 2. The incident occurs to providers of the following services:
  • telecommunication services;
  • data storage and sharing in cyberspace;
  • services providing national or international domain names to service users in Vietnam;
  • e-commerce;
  • online payment;
  • payment intermediary;
  • connecting transportation in cyberspace;
  • social networks and social media;
  • online games; and
  • other services that provide, manage and operate information in cyberspace in the form of messages, voice calls, video calls, email, or online chatting.
• Scenario 3. The incident causes “significant loss” to the legitimate rights and interests of the affected Vietnamese persons.

Under Scenario 1, where there is a data security incident, organizations must promptly take relevant measures to mitigate and notify relevant data subjects and / or relevant competent State authorities, as the case may be, in a timely manner, e.g. 5 days after detection of the security incident, and must provide an update on the incident status when it is completely resolved. Affected organizations and individuals must be notified of the data incident if the incident falls under Scenario 2 or Scenario 3.

In the case of an incident under Scenario 1 that is beyond the control of the organization, the operator of the information system must immediately prepare an initial report on the incident to report such incident to the relevant agencies and a final report on response to the incident within five days after finishing responding to the incident. Moreover, if the information system of a trader, organization or individual engaged in e-commerce is attacked causing risk of loss of consumer’s information, the data controller must notify the authorities within 24 hours after the detection of incident.

Normally, the data controller would be required to give relevant notifications to the following State authorities:

• • Local police agency (i.e. A05 under the MPS with regard to offshore service providers, provincial police department where the head office of data controller is located); and
  • VNCERT/CC.

That said, the government is reviewing the notification requirements in Scenarios 1 – 3 above. Thus, the foregoing procedure may be subject to change in the near future. 

• Scenario 4: The PDPL sets out a reporting requirement that upon detection of any violation against regulations on personal data protection which may cause harm to national defense, national security, social order and safety, or infringe upon the life, health, honor, dignity, or property of a data subject, the controller, controller-processor, or third party must notify the specialized personal data protection authority no later than 72 hours from the time the violation is detected. In cases where a data processor detects a violation, it must promptly notify the data controller or the data controller-processor.

The information to be notified will include:

• A description of the nature of the violation of personal data protection regulations, including: time, location, acts committed, organizations and individuals involved, types of personal data, and the quantity of data concerned;
• Contact details of the personal data protection department or personnel, or of the organization or individual providing personal data protection services;
• A description of the possible consequences and damage resulting from the violation of personal data protection regulations; and
• A description of the measures taken to address and mitigate the harm caused by the violation of personal data protection regulations. 

Thereafter, the controller, controller-processor, or the third party shall prepare written minutes confirming the occurrence of the violation of the regulations on personal data protection, and coordinate with the A05 to handle the violation. In practice, as the 72-hour timeframe is very tight, more often than not, data controllers find it very challenging to comply with this timeframe. 

In addition to the four scenarios mentioned above, data breach notification requirements are also imposed by sector-specific laws / regulation, such as laws / regulations governing financial services, e-commerce services, etc.