Personal data transfer abroad impact assessment dossier
When a company transfers personal data of Vietnamese citizens (such as employee data) overseas, the service provider must create a Personal Data Transfer Impact Assessment Dossier. The transfer of data overseas is considered compliant if the following conditions are met:
- Submit 01 original copy of the application to the Department of Cyber Security and Prevention of High-Tech Crimes under the Ministry of Public Security within 60 days from the date of personal data processing;
- Notice to the Department of Cyber Security and High-Tech Crime Prevention under the Ministry of Public Security on the transfer of data and contact details of the responsible organization and individual in writing after the data transfer has been completed.
Data transferors which transfer data abroad include Personal Data Controller, Personal Data Controller and Processor, Personal Data Processor, and Third Party.
*Notes: In addition to establishing and submitting dossiers to the Ministry of Public Security, enterprises must also store the Personal Data Transfer Abroad Impact Assessment Dossier. Accordingly, the Personal Data Transfer Impact Assessment Dossier must always be available to serve the inspection and evaluation activities of the Ministry of Public Security (according to Clause 3, Article 25 of Decree 13/2023).
Cases of suspension of personal data transfer abroad
The data transferor must stop transferring personal data abroad if any of the following circumstances occur:
- Upon discovery that the transferred personal data is being used for activities that violate the interests or national security of the Socialist Republic of Vietnam;
- The party transferring data abroad does not: (i) Complete the Personal Data Transfer Impact Assessment Dossier in cases where the dossier is incomplete and does not comply with the requirements of the Ministry of Public Security; (ii) Update and supplement the Personal Data Transfer Impact Assessment Dossier when there are changes to the content of the dossier submitted to the Ministry of Public Security;
- An incident of leakage or loss of personal data of Vietnamese citizens occurs.
Procedures
| Process | Detailled description |
| Step 1 |
The data transferor shall submit one original copy of the dossier to the Department of Cyber Security and Crime Prevention under the Ministry of Public Security within 60 days from the date of personal data processing in accordance with Form No. 06 of the Appendix to Decree No. 13/2023/NĐ-CP. |
| Step 2 |
After the data transfer is successful, the data transferor shall notify the Department of Cyber Security and High-Tech Crime Prevention under the Ministry of Public Security in writing about the data transfer and the contact details of the responsible organization or individual. |
| Step 3 |
The Ministry of Public Security (Department of Cyber Security and Prevention and Combating High-Tech Crimes) evaluates and requests the Data Transfer Party to complete the Personal Data Transfer Impact Assessment Dossier when the file is incomplete and does not comply with regulations. |
LIST OF DOCUMENTS
Enterprises are required to prepare a data transfer impact assessment dossier when transferring personal data overseas. The dossier includes:
- Information and contact details of the Data Transferor and the Recipient of personal data of Vietnamese citizens;
- Full name and contact details of the organization or individual responsible for the Data Transferor involved in the transfer and receipt of personal data of Vietnamese citizens;
- Description and explanation of the purpose of the processing activities of personal data of Vietnamese citizens after being transferred abroad;
- Describe and clarify the types of personal data transferred overseas;
- Describe and demonstrate compliance with the personal data protection regulations in this Decree, detailing the personal data protection measures applied;
- Assess the impact of personal data processing; potential consequences, undesirable damages, and measures to minimize or eliminate such risks and harms;
- Consent of the data subject in accordance with Article 11 of Decree 13/2023/NĐ-CP, based on a clear understanding of the feedback and complaint mechanism in case of incidents or arising requests;
- Having a document demonstrating the binding, responsibility between organizations and individuals transferring and receiving personal data of Vietnamese citizens regarding the processing of personal data.
COMMITMENT TO SERVICES
On time
All that we do will be planned specifically in terms of time and content. You can control what we do, and the time to completion, and in all cases, we help you maintain the enterprise’s compliance with the deadlines with competent authorities and employees.
Exactly
We commit to the accuracy of the contents of consultation, established documents, and services we provide to customers. We aim to provide you with a safe and effective legal solution for your business operations.
Security
We establish a confidentiality commitment with you, so information about the enterprise, human resources, finance, etc., and other contents related to enterprises and investors will only be disclosed with your consent or in accordance with the laws of Vietnam.
SERVICE PERFORMANCE PROCESS
Assign
CDLAF assigns designated personnel responsible for ensuring information security, ensuring that only assigned individuals have the right to access information and handle client communication.
Collect information and prepare the service contents
Assigned personnel are responsible for collecting clients information, reviewing regulations and preparing service content.
Control the quality
The Board of Lawyers and Counsels reviews the service content prepared by the assigned personnel before it is sent to clients for their review.
Clients’ approval
Clients review and approve the service content prepared by CDLAF. When requested, meetings are held to explain the prepared content.
Completion
Personnel responsible for service completion directly implement it at the competent authority (if required). They also monitor the progress, report the results, and hand them over to clients.
After-service support
Guide clients to perform necessary tasks related to the delivered results and provide updates on changes in legal regulations.
REASONS FOR CHOOSING CDLAF’S SERVICES
- We provide you with effective and comprehensive legal solutions, help you save your money, maintain compliance in the enterprise, and simplify all legal issues when doing business in Vietnam;
- As a law firm established in Vietnam, we have close relationships and knowledge of working methods, and policies of competent authorities, which facilitates you when operating in Vietnam;
- CDLAF Lawyers have held many important positions in law firms, banks, financial enterprises, foreign enterprises. Therefore, our lawyers provide students with the legal regulations as well as the actual solutions and opinions of competent authorities, see more about human resources.
- The system of forms about enterprise, labor, tax, etc. available and constantly updated will be provided as soon as customers request.
People
Contact Us
Are you confused? If you want to discuss your problem more specifically, let us help you, please fill in the information in the table below and send it to us. A free 45-minute consultation email or meeting will be arranged to help you better understand your problem solving problem.
