Vietnam passes first-ever data protection law

Vietnam enacted its first comprehensive Data Protection Decree on 17 April 2023, taking effect on 1 July 2023. The decree focuses on eight principles for processing personal data, including lawfulness, transparency, purpose limitation, data minimisation, accuracy, integrity, confidentiality and security, storage limitation, and accountability. 

There are many provisions relevant to the provision of consent by the data subject. For example, permission must be expressed in a printable, reproducible, written, electronic, or verifiable format. Silence on the part of a data subject or the absence of a response by a data subject does not constitute consent. Any processing of sensitive personal information must inform the individual that the information being processed is sensitive personal information.

All Vietnamese and foreign companies in Vietnam or with data processing activities in Vietnam must be in compliance with the decree.