Vietnam: Closed consultation on Draft Law on Personal Data Protection including cross-border data transfer regulation

On 24 November 2024, the Ministry of Public Security closed the public consultation on the Draft Law on Personal Data Protection. The draft law delineates the circumstances under which personal data may be transferred abroad, including the sharing of data with recipients situated outside of Vietnam, participation in international conferences, and the fulfilment of legal obligations in foreign jurisdictions. It is obligatory for organisations to prepare and regularly update an Impact Assessment Report for such data transfers. The Personal Data Protection Authority is empowered to halt data transfers in instances where they are deemed to contravene Vietnam's national security interests. Moreover, the legislation stipulates that both the impact assessment report on personal data processing and the cross-border data transfer report must be updated on a biannual basis or immediately in the event of significant changes, such as corporate mergers or alterations to the data protection organisation. It is the responsibility of the relevant parties to submit updates to the national portal or the Personal Data Protection Authority via the designated channels.