VIETNAM

Vietnam does not have a comprehensive law on personal data protection and so personal data is not yet truly protected. Witness the rise of online services that collect and process big data from private sources. Protecting personal data presents a sigificant challenge and is in conflict with another government objective which is to provide national cybersecurity. Insuring cybersecurity can conflict with the protection of individual privacy.

The need for consolidated legislation to provide personal data protection is well recognised. Based on Decision No. 06/QD-TTg, a new law is planned to be issued sometime in 2024. In the interim, the government issued Decree 13/2023/ND-CP on personal data protection (Decree 13), which took effect on 01 July 2023.

Decree 13 makes major additions to Vietnam’s personal data protection framework: (i) designates the Department of Cybersecurity and Prevention of Cyber-Crimes under the Ministry of Public Security to oversee the enforcement and application of personal data regulations, including Decree 13; (ii) creates a unified definition/classification of personal data (including basic and sensitive data); (iii) establishes a framework for cross-border data transfers; and (iv) introduces international concepts such as ‘data controller’ and ‘data processor’, and provides a full set of rules regarding their rights and obligations.

Fundamentally, Decree 13 pursues a soft management approach toward personal data processing/transfer. That is, no prior approval by or registration with the authorities is required. Instead, only an impact assessment of personal data processing/transfer activities must be maintained by data controllers/processors and be reported to the authorities after the processing/transfer occurs.

In line with this development, the Government has also set up a legal framework for cybersecurity, which has an impact on personal data.

Compromises between perfect privacy and perfect cybersecurity are inevitable. New Decree 53/2022/ND-CP introduces regulations on data localisation (ie, storing data inside the country) and mandatory physical establishment in Vietnam of offshore companies that provide certain services in Vietnam (eg, telecommunications, e-commerce, social networks, online games, telephone/video calls, emails, etc.).

Specifically, and subject to certain triggering conditions (eg, violation of the Cybersecurity Law), a foreign service provider (of regulated services) must establish a local branch or a representative office and must store certain regulated data in Vietnam. The data it must store in these circumstances is the personal data of customers in Vietnam and data created by Vietnam-based customers (for example, credit card information, IP addresses and registered phone numbers).

How to regulate and protect personal data is a growing issue, and it is clear that the Vietnamese government intends to develop more rigorous measures to protect privacy. Vietnam, however, must act prudently to avoid imposing administrative burdens on service providers and, thus, restrict its citizens’ access to necessary online services.

Vietnam needs to find a path to balance its objective to protect privacy and the imperative it sees to create a credible cybersecurity shield.

Writen by

Chu Bao Khanh, Associate

Russin & Vecchi

TIER 1

Established in October 2006, Indochine Counsel is one of the leading business law firms in Vietnam. The firm provides professional legal services for corporate clients making investments and doing business in Vietnam. The legal practitioners at Indochine Counsel are well qualified and possess substantial experience from both international law firms and domestic law firms. The firm boasts more than 45 legal professionals working at the main office in Ho Chi Minh City and a branch office in Hanoi. Indochine Counsel’s objective is to provide quality legal services and add value to clients through effective customized legal solutions that work specifically for the client. The firm represents local and international clients in a broad range of matters including transactional work and cross-border transactions.

Frasers Law Company’s local and regional expertise makes it a leading firm for media law advice. The team’s sector specialisation includes broadcast and new media. In representative work lawyers advised on a joint venture proposal with a local state-owned telecommunications company for joint satellite operation in a case involving cross-border elements, television broadcasting and pay-television.

Russin & Vecchi is well recognized among Vietnam’s top law firms, with its solid professional credentials and international clients. It is active in Telecoms, Media & Technology (TMT) and particularly in telecoms and technology. The team regularly advises inbound investors on TMT issues with clients coming from Australia, Japan, Singapore and elsewhere.

Tilleke & Gibbins works with multinational clients, many of which are US-based. In highlighted cases the firm acted for a publicly traded US video game company on local regulation, setting up an online game business and virtual currency issues. The team also acted for a US television network on requirements for foreign programming channels entering the local pay-television market.

TIER 2

Allens is one of the largest foreign firms. Present since 1993, the practice lawyers act for television broadcasters, pay television operators, radio stations and production companies. Lawyers also advise publishing clients, film producers and record companies. The TMT group works closely with the firm’s international network of lawyers.

APFL & Partners is best known for its corporate focus and dispute resolution. Highly regarded by competitors, the firm specialises in corporate sector-related work that includes mergers and acquisitions, joint ventures and restructuring. Lawyers work on a range of domestic cases and have been singled out by peers for their work on media and distribution cases.

YKVN lawyers combine local and international experience with TMT sector focus. The team assists with cross-border transactional cases, foreign investment, litigation and arbitration. Lawyers in the media group have extensive experience adviseing multinational clients on various matters connected with copyright and neighbouring rights.

TIER 3

Media lawyers at Duane Morris regularly advise clients on defamation and libel lawsuits, invasion of privacy and public disclosure laws. Lawyers have extensive knowledge of multiple segments of the media industry and work with actors, authors, film producers and record companies. The team also advises on gaming and related tax matters.

Leadco Legal Counsel acts for leading TMT clients in cases involving intellectual property, corporate law and regulatory matters. The firm assists with investment projects and transactions derived from convergence schemes. Acting for Globsis Telecom Technologies, the team assisted the software company in setting up a 100 per cent foreign-owned enterprise providing digital content on mobile devices.

TIER 4

With two decades of experience, Vilaf has an established position and is known for its advice to foreign investors. The firm’s industry focus stems from its telecoms work and convergence-related transactions. It is one of the largest practices nationally and highlighted by peers for litigation and arbitration skills.

IP specialist Vision & Associates litigates and advises on all matters connected with copyright and IP commercialisation. The firm has notable strength in cross-border and multi-jurisdictional transactions that include IP licensing, franchising, acquisitions and transfer. Other areas of focus include agreement negotiation and dispute resolution.