PERSONAL DATA PROCESSING IMPACT ASSESSMENT, CROSS-BORDER TRANSFER IMPACT ASSESSMENT (Vietnam)

Personal data processing impact assessment

The PDPD provides new definitions regarding Personal Data Controller (an organization or individual that decides the purposes and means of processing personal data), the Personal Data Controller cum Processor (an organization or individual who simultaneously determines the purposes, means and directly processes the personal data), and Personal Data Processor (an organization or individual that performs data processing on behalf of the Personal Data Controller, through a contract or an agreement with the Personal Data Controller).

The PDP Impact Assessment, in all cases, shall be prepared and stored by the Personal Data Controller, Personal Data Controller cum Processor, or additionally by Personal Data Processor (in the circumstances that such Personal Data Processor has entered into a contract with the Personal Data Controller) after the commencement of processing of personal data (“processing” of personal data includes the collection, recording, analysis, storage, disclosure, access, copying, transmission, etc. of personal data). The expansive definition of processing of personal data implies that the processing of personal data may be carried out on a daily basis at each company and each company may require compliance with the obligation. The PDP Impact Assessment is required to be available for inspection by the Ministry of Public Security and be submitted to the Ministry of Public Security – Department of Cybersecurity and Hi-tech Crime Prevention (“A05”) within 60 days from the date of commencement of personal data processing.

The PDP Impact Assessment under the PDPD appears to be similar to the data protection impact assessment in the EU General Data Protection Regulation (GDPR), whereas under GDPR it is only required where the risk of data processing is high. However, there is no such limitation included under the PDPD.

The content of the PDP Impact Assessment of the Personal Data Controller, the Controller cum Processer, and Personal Data Processor is slightly different. To elaborate:

• (i)  Contents of the PDP Impact Assessment of the Personal Data Controller, the Controller cum Processer include:

• (i)  Contents of the PDP Impact Assessment of the Personal Data Controller, the Controller cum Processer include:

• Information and contact details of the Personal Data Controller, the Personal Data Controller cum Processor;
• Full name and contact details of the organization or individual in charge of the personal data protection; of the Personal Data Controller, the Personal Data Controller cum Processor;
• The objectives of the personal data processing;
• The type of processed personal data;
• Organization, individual receiving personal data, including organization, individual abroad;
• Cases of transfer of personal data abroad;
• Personal data processing time; Estimated time to delete or destroy personal data (if any);
• Describing the personal data protection measures applied;
• Assessing the impact of the processing of personal data; potential unwanted consequences, damage, measures to reduce or eliminate such risk, harm;

• (ii) Contents of the dossier of the PDP Impact Assessment of the Personal Data Processor include:

• (ii) Contents of the dossier of the PDP Impact Assessment of the Personal Data Processor include:

• Information and contact details of the Personal Data Processor;
• Full name and contact details of the organization assigned or individual in charge of the personal data processing of the Personal Data Processor;
• Describing the processing activities, the type of processed personal data under the contract with the Personal Data Controller;
• Personal data processing time; Estimated time to delete or destroy personal data (if any);
• Cases of transfer of personal data abroad;
• Generally describing the personal data protection measures applied;
• Assessing the impact of the processing of personal data; potential unwanted consequences, damage, measures to reduce or eliminate such risk, harm;

Cross-border transfer impact assessment

Under the PDPD, besides the PDP Impact Assessment, an independent impact assessment is also required for cross-border transfer of personal data and is applicable to any transferor of personal data, which includes not only Personal Data Controller, the Controller cum Processer or Personal Data Processer, but also any third party (any other organizations or individuals allowed to process personal data) (collectively, “Transferor”). The cross-border transfer of personal data means the act of transferring personal data of Vietnamese citizens outside the territory of Vietnam using cyberspace, electronic devices, equipment or other forms, or using a place outside the territory of Vietnam to process personal data. Therefore, if a Japanese company in Vietnam uses a cloud service to store the personal data of Vietnamese employees on a server outside Vietnam, or if a Japanese parent company uses a computer outside Vietnam to process the personal data of Vietnamese employees of a Vietnamese subsidiary by accessing the subsidiary’s server located in Vietnam, the act of accessing and viewing such personal data of Vietnamese employees may also be considered to be a cross-border transfer. On the other hand, according to the above definition, overseas transfer of personal data of individuals other than Vietnamese citizens does not fall under "cross-border transfer", so processing of personal data of Japanese employees based in Vietnam on the parent company's server is not subject to such regulation.

Same as the PDP Impact Assessment, the Transferor is required to prepare and store a cross-border transfer impact assessment and submit it to the competent authority (A05) within 60 days from the date of commencement of processing of the personal data.

A personal data cross-border transfer impact assessment includes the following contents:

• Information and contact details of the Transferor transferring the data and the party receiving personal data of Vietnamese citizens;
• Full name and contact details of the organization or individual in charge of the data transfer party related to the transfer and receiving of personal data of Vietnamese citizens;
• Describing and explaining the objectives of the personal data processing activities of Vietnamese citizens after being transferred abroad;
• Describing and clarifying the type of personal data transferred abroad;
• Describing and clearly stating compliance with regulations on personal data protection contained in the PDPD, detailing the personal data protection measures applied;
• Assessing the impact of the processing of personal data; potential consequences, unwanted damage, measures to reduce or eliminate such risk, harm;
• The consent of the data subject;
• Having a document showing the binding and responsibilities between organizations and individuals transferring and receiving personal data of Vietnamese citizens for the processing of personal data.

Conclusion

Currently, there are no further guidelines on how to prepare a sample PDP Impact Assessment or Cross-border Transfer Impact Assessment. Besides, a new draft of the decree on governmental sanction applied to violations relating to cyber security including violations relating to such assessments has just been released for public comments. As the guidance under the PDPD on the content of both impact assessments seems to be ambiguous, it is expected that the competent authority will issue further clear and detailed guidance on this matter. In theory, it is necessary to prepare and store the PDP Impact Assessment and Cross-border Transfer Impact Assessment by the enforcement date of the PDPD. As a result, each company directly or indirectly processing personal data or engaged in cross-border transfer of personal data should pay attention to the analysis of the PDPD and prepare the necessary impact assessments in accordance with the PDPD.