Application of Personal Data Protection Laws to FDI companies

Foreign Direct Investment (FDI) companies with a multinational scale may face significant challenges in complying with personal data protection regulations in Vietnam, particularly when there are discrepancies between Vietnamese law and the global corporate policies.

In Vietnam, Decree 13/2023/ND-CP (“Decree 13“) is currently the only legal instrument governing personal data protection. These regulations are relatively new, causing companies, particularly Foreign Direct Investment companies, to encounter numerous uncertainties when applying them. Given their multinational scale, FDI company operating in Vietnam are often subject to the influence of group-wide corporate policies or, in other words, are directly or indirectly affected by the legal regulations of the jurisdiction where the parent company is headquartered. The question arises as to whether the application of the provisions of Decree 13 might create conflicts with the group’s general policies and the legal requirements of the country where the parent company is based. Through an analysis of certain provisions of Decree 13, PLF aims to provide FDI with some clarity on these concerns. 

1. When is an FDI company determined to be subject to the application of Decree 13? 

An FDI company is only considered subject to the application and compliance with Decree 13 when: 

1. engages in one or more personal data processing activities in Vietnam; or  
2. directly or indirectly involved in personal data processing activities in Vietnam. 

Thus, Decree 13 has a clear territorial nature, regulating personal data processing activities primarily within Vietnam’s territorial boundaries. Personal data includes basic information such as name, date of birth, gender, nationality, etc., as well as an individual’s image.

Additionally, sensitive personal data, which is closely tied to an individual’s privacy, such as health status, private life, political views, religion, and other information that, when violated, could directly affect the individual’s legal rights and interests, may also be subject to processing. 

In practice, it is almost inevitable for FDI companies to collect the personal data of Vietnamese citizens and foreign nationals in Vietnam, such as when entering into employment contracts with individuals in Vietnam or providing services to individuals in Vietnam. These activities inherently involve the processing of personal data, with the most common actions being the collection and storage of personal information. In some cases, FDI companies may transfer personal data-related information to their parent company.

2. What actions are required when an FDI company processes personal data in Vietnam? 

As analyzed in Section 1 above, when an FDI company engages in personal data collection activities in Vietnam, it falls under the scope of Decree 13 and must comply with its provisions. However, this compliance only applies within the territorial boundaries of Vietnam. Therefore, if corporate policies conflict with Decree 13, the FDI company must prioritize the application of Decree 13. This is similar to the application of tax policies that correspond to specific territories or countries and should not pose significant difficulties for FDI companies. Moreover, the basic principles outlined in Decree 13 are quite consistent with legal frameworks in other regions such as the EU, Canada, Japan, etc., specifically: 

1. Ensuring the rights of data subjects regarding the processing of their personal data by other entities; and 
2. Assigning the responsibility for ensuring the security of personal data to the data processor and the data controller.

Accordingly, FDI companies need to pay attention to: 

1. Must notify the processing of personal data once and ensure the consent of the data subject; 
2. Establishing a Personal Data Processing Impact Assessment record using the specific form for storage and submitting one original copy to the Cybersecurity and High-Tech Crime Prevention Department of the Ministry of Public Security; 
3. When transferring the personal data of Vietnamese citizens abroad (whether to the parent company or to affiliated companies outside of Vietnam), a Personal Data Transfer Impact Assessment record must be established using the specific form for storage, and one original copy must be submitted to the Cybersecurity and High-Tech Crime Prevention Department of the Ministry of Public Security; 
4. There must be a data protection expert to ensure the security of the collected personal data; 
5. Notifying the parent company or affiliated companies regarding the application of Decree 13 to personal data processing activities in Vietnam and reassessing the compatibility of the corporate policies with the provisions of Decree 13. 

Note:

FDI companies must store personal data collected in Vietnam for a minimum of 24 months and it can be stored abroad. The establishment of a Personal Data Transfer Impact Assessment record only applies to the personal data of Vietnamese citizens.

3. Conclusion

Therefore, the application of appropriate personal data protection policies is not only a legal requirement but also a significant factor affecting the long-term success of FDI companies in Vietnam. FDI companies should proactively implement and comply with Vietnamese legal regulations and regularly review and collaborate with legal experts to adjust their policies in accordance with personal data protection regulations in Vietnam to protect the rights of data subjects, build credibility and trust with customers and partners, while minimizing risks and ensuring legal compliance. 

At PLF Law Firm

Personal Data Protection Law regulates the collection, processing, and storage of personal data within Vietnam’s borders. FDI companies operating in Vietnam may sometimes conflict with global corporate policies in adhering to these regulations. We support business owners, especially FDI companies, in achieving compliance with national data protection laws to responsibly collect and process the personal data of Vietnamese citizens.

At PLF, we also provide a comprehensive service for “Doing Business“, assisting businesses with a wide range of legal needs, from Company Formation, Licensing to Labor & Employment. 

Contact PLF Law Firm today via email at inquiry@plf.vn or +84913 902 906 or Zalo | Viber | WhatsApp to receive a free 30-Initial Minute Consultation.

Article completion date: October 17th, 2024.

PLF Law Firm