Definitions in Vietnam
Definition of personal data
Under the PDPL, personal data is defined as digital data or information in other forms that identify or helps to identify a specific individual. Personal data is classified into two categories of “basic personal data” and “sensitive personal data”. Personal data, once de-identified, is no longer considered personal data.
“Basic personal data” is defined as personal data reflecting common personal details and background information, frequently used in transactions and social relations. Decree 356 further specifies the scope of basic personal data by providing a detailed list that includes:
- surname, middle name, and birth name, alias (if any);
- date of birth, date of death or date of going missing;
- gender;
- place of birth, place of birth registration, place of permanent residence registration, place of temporary residence registration, current residence, hometown, contact address;
- nationality;
- personal image;
- phone number, personal identification number, passport number, driver's license number, plate number;
- marital status;
- family relationship information (parents, children, spouse);
- digital account information; and
- information associated with an individual or used to identify an individual other than sensitive personal data.
Definition of sensitive personal data
Sensitive personal data is defined as personal data in association with individual privacy which, when being infringed, will directly affect the legal rights and interests of agencies, organizations, and individuals. Decree 356 further specifies the scope of sensitive personal data by providing a detailed list that includes:
- data revealing racial origin or ethnic origin;
- political, religious, and belief-related views;
- information on private life, personal secrets, and family secrets
- health conditions;
- biometric data and genetic characteristics;
- data revealing an individual’s sexual life or sexual orientation
- data about crime and violations of law collected and stored by law enforcement agencies;
- personal location data identified via location services;
- information on login names and passwords used to access an individual’s electronic identification account; images of ID cards, citizen ID cards, and 9-digit ID cards;
- login names and passwords for access to bank accounts;
- bank card information;
- data on transaction history of bank accounts;
- financial and credit information and information relating to customers’ activities and transaction histories in the areas of finance, securities, and insurance held by credit institutions, foreign bank branches, intermediary payment service providers, securities institutions, insurers, and other authorized organizations;
- data monitoring behavior and activities related to the use of telecommunications services, social networks, online communication services, and other services in cyberspace; and
- other specific personal data as specified by law to be kept confidential and subject to strict confidentiality measures.
Definition of data controller, data processor, data controller-processor and third party
The PDPL provides definitions and roles of different stakeholders involved in the collection and processing of personal data with their respective obligations, notably:
Data controller
A data controller is an agency, organization or individual that decides the purposes and means of processing personal data. The controller is responsible for serving privacy notices to and obtaining consent from the data subjects, preparing and filing to the authority a Data Processing Impact Assessment (“DPIA”) (in the capacity of data controller) and Cross-border Transfer Impact Assessment (“TIA”) (if considered as data transferor), notifying the authority of violations of regulations on personal data protection (including data breach), ensuring and honoring the data subjects’ rights, etc.
Data processor
A data processor is an agency, organization or individual that processes data as requested by the controller via a contract. Accordingly, the processor must receive and process personal data strictly in compliance with the contract or agreement with the controller. In particular, the law requires the processor only to receive personal data after concluding an agreement or contract on personal data processing with the controller and process personal data in compliance with the agreement or contract concluded with the controller. The processor is responsible for preparing and filing to the authority a DPIA (in the capacity of a data processor) and a TIA (if considered as data transferor), notifying the controller of violations of regulations on personal data protection (including data breach), etc.
Data controller-processor
A data controller-processor is an agency, organization or individual that decides the purposes and means of processing, and directly processes, personal data. Consequently, the controller-processor must comply with responsibilities of the controller and processor (if applicable).
Third party
A third party is defined as an organization or individual other than the data subject, data controller, data controller-processor, or the data processor that participates in the personal data processing according to the law.
Definition of personal data processing
Under the PDPL, “personal data processing”, or “processing” is rather broad. It refers to activities that impact personal data, including one or more of the following: collection, analysis, aggregation, encryption, decryption, modification, deletion, destruction, de-identification, provision, disclosure, transfer of personal data or other activities that affect personal data. With such wide and open-ended definition of personal data processing, it appears that all types of activities related to personal data could be considered processing personal data and subject to the requirements prescribed by the PDPL.
