On 24 September 2024, Vietnam released a comprehensive draft Personal Data Protection (“PDP”) Law, marking a significant step forward in strengthening the PDP framework. Developed by the Ministry of Public Security, this proposed legislation surpasses the Decree No. 13/2023/ND-CP on Personal Data Protection issued in April 2023. 

The draft PDP Law is currently open for public consultation until 24 November 2024. Following this period of review and potential revisions, the law is expected to take effect on 1 January 2026. With 68 articles in seven chapters, it addresses a broader scope including AI, cloud computing, marketing, employee monitoring, financial data, and healthcare.

Key updates of the draft PDP Law include:

1. Expanded scope of application: the draft PDP Law applies to all Vietnamese agencies, organizations, and individuals operating domestically and abroad, as well as foreign entities involved in data processing within Vietnam and personal data of foreigners within the territory of Vietnam.
    
2. Consent of data subject: Consent remains the primary legal basis for processing personal data. Controllers and processors are required to gain affirmative, informed consent from data subjects, particularly for sensitive personal data such as health records, political views, information relating to land use right, and biometric data.
    
3. Impact Assessments Dossiers: The draft PDPL mandates this kind of dossier for organizations, which must be updated every six months or upon any material change. The dossier must include details about the PDP organization and the PDP expert and additional documentations on evaluation of current compliance with PDP Law and credit rating document for PDP. The draft PDP Law also provides further guidance regarding the circumstances of cross-border transfer of PDP.
    
4. Additional new definitions: the draft PDP Law introduces several new concepts, such as (IT) developers, PDP organizations, PDP experts, organizations certifying eligibility for PDP, certification mechanism as credit rating for PDP, etc.
    
5. Sanction: The potential sanctions appear unchanged and depending on the severity of the violation, may include disciplinary action, administrative penalties, or criminal action. However, the draft lacks specific guidance on the application of these sanctions.  
   This draft PDP Law will necessitate major changes for businesses in Vietnam, potentially imposing additional obligations on companies. As this is the initial draft, multiple revisions are expected before finalization. We will provide updates on any significant developments in future.