Data Protection in Vietnam

Collection and processing in Vietnam

According to Vietnamese laws, the main legal basis for the processing of personal information (that means the performance of one or some acts of collecting, editing, utilizing, storing, providing, sharing or spreading personal information in cyberspace for commercial purpose) is a prior explicit consent given by the data subject. Consent requirements are among the most important regulations under the PDPD, and also among the most remarkable / novel changes brought about by the PDPD compared to the existing legal regime on data privacy.

Under the PDPD, the consent obtained from the data subjects must be clear, affirmative and in strict compliance with the consent form under the PDPD.

The PDPD sets out that consent must be voluntarily made based on the data subject's full understanding of (i) the purpose of the personal data processing; (ii) the type of personal data to be processed; (iii) the entities authorized to process personal data; (iv) the data subject's rights and obligations; and (v) the data to be processed that is sensitive personal data, if any. In addition, consent must be expressed clearly and specifically in writing, by voice, by ticking a consent box, by text message, by selecting consent technical settings, or via other actions which demonstrates the same. Moreover, consent must be expressed in a format that can be printed out or reproduced in writing, including in electronic or verifiable formats.

Importantly, the PDPD also explicitly points out that silence or non-response by the data subject is not construed as consent. Furthermore, consent must be made for a single purpose. That is to say, multiple purposes need to be demonstrated in a way that data subjects can give consent to one or more of them.  Additionally, the data subjects may also opt to provide partial or conditional consent.

However, the PDPD stipulates that the processing of personal data could be carried out without consent in the following circumstances:

  • In urgent cases where it is necessary to immediately process relevant personal data to protect the life or health of the data subject or others. The controller, processor, controller-processor and third party are responsible for proving such situation;
  • Where the public disclosure of personal data is in accordance with the law;
  • When the processing of data is performed by competent state agencies in the event of a state of emergency related to national defense, national security, social order and safety, major disaster, or dangerous epidemic; when there is a threat to security and national defense but not to the extent that a state of emergency must be declared; or when the processing is to prevent and combat riots and terrorism, crimes, and violations of the law;
  • When the processing is to fulfill the contractual obligations of the data subject with relevant agencies, organizations, and individuals as prescribed by law; or
  • When the processing is to serve the activities of state agencies prescribed by sector-specific laws.

In addition, the PDPD allows data subjects to withdraw their consent given. However, such consent withdrawal shall not affect the lawfulness of the processing to which consent was given before it was withdrawn. The withdrawal of consent shall be expressed in a format that can be printed and reproduced in writing, including in electronic or verifiable format.

In addition, the traders and organizations collecting and using consumers' personal information on E- commerce websites shall not require the consumers / subjects' prior consent in the following cases:

  • Collecting personal information that has been publicized on E-commerce websites;
  • Collecting personal information to sign or perform contract of sale and purchase of goods and services;
  • Collecting personal information to calculate the price and charge of use of information, products and services on the network environment; or
  • Collection of personal information for performing other obligations in accordance with the law.

Continue reading

  • no results

Previous topic
Back to top