Personal data transfer abroad impact assessment dossier

When a company transfers personal data of Vietnamese citizens (such as employee data) overseas, the service provider must create a Personal Data Transfer Impact Assessment Dossier. The transfer of data overseas is considered compliant if the following conditions are met:

Submit 01 original copy of the application to the Department of Cyber Security and Prevention of High-Tech Crimes under the Ministry of Public Security within 60 days from the date of personal data processing;
Notice to the Department of Cyber Security and High-Tech Crime Prevention under the Ministry of Public Security on the transfer of data and contact details of the responsible organization and individual in writing after the data transfer has been completed.

Data transferors which transfer data abroad include Personal Data Controller, Personal Data Controller and Processor, Personal Data Processor, and Third Party.

*Notes: In addition to establishing and submitting dossiers to the Ministry of Public Security, enterprises must also store the Personal Data Transfer Abroad Impact Assessment Dossier. Accordingly, the Personal Data Transfer Impact Assessment Dossier must always be available to serve the inspection and evaluation activities of the Ministry of Public Security (according to Clause 3, Article 25 of Decree 13/2023).

Cases of suspension of personal data transfer abroad

The data transferor must stop transferring personal data abroad if any of the following circumstances occur:

Upon discovery that the transferred personal data is being used for activities that violate the interests or national security of the Socialist Republic of Vietnam;
The party transferring data abroad does not: (i) Complete the Personal Data Transfer Impact Assessment Dossier in cases where the dossier is incomplete and does not comply with the requirements of the Ministry of Public Security; (ii) Update and supplement the Personal Data Transfer Impact Assessment Dossier when there are changes to the content of the dossier submitted to the Ministry of Public Security;
An incident of leakage or loss of personal data of Vietnamese citizens occurs.

Procedures

Process	Detailled description
Step 1	The data transferor shall submit one original copy of the dossier to the Department of Cyber Security and Crime Prevention under the Ministry of Public Security within 60 days from the date of personal data processing in accordance with Form No. 06 of the Appendix to Decree No. 13/2023/NĐ-CP.
Step 2	After the data transfer is successful, the data transferor shall notify the Department of Cyber Security and High-Tech Crime Prevention under the Ministry of Public Security in writing about the data transfer and the contact details of the responsible organization or individual.
Step 3	The Ministry of Public Security (Department of Cyber Security and Prevention and Combating High-Tech Crimes) evaluates and requests the Data Transfer Party to complete the Personal Data Transfer Impact Assessment Dossier when the file is incomplete and does not comply with regulations.

LIST OF DOCUMENTS

Enterprises are required to prepare a data transfer impact assessment dossier when transferring personal data overseas. The dossier includes:

Information and contact details of the Data Transferor and the Recipient of personal data of Vietnamese citizens;
Full name and contact details of the organization or individual responsible for the Data Transferor involved in the transfer and receipt of personal data of Vietnamese citizens;
Description and explanation of the purpose of the processing activities of personal data of Vietnamese citizens after being transferred abroad;
Describe and clarify the types of personal data transferred overseas;
Describe and demonstrate compliance with the personal data protection regulations in this Decree, detailing the personal data protection measures applied;
Assess the impact of personal data processing; potential consequences, undesirable damages, and measures to minimize or eliminate such risks and harms;
Consent of the data subject in accordance with Article 11 of Decree 13/2023/NĐ-CP, based on a clear understanding of the feedback and complaint mechanism in case of incidents or arising requests;
Having a document demonstrating the binding, responsibility between organizations and individuals transferring and receiving personal data of Vietnamese citizens regarding the processing of personal data.

Download attachments here

COMMITMENT TO SERVICES

On time

All that we do will be planned specifically in terms of time and content. You can control what we do, and the time to completion, and in all cases, we help you maintain the enterprise’s compliance with the deadlines with competent authorities and employees.

Exactly

We commit to the accuracy of the contents of consultation, established documents, and services we provide to customers. We aim to provide you with a safe and effective legal solution for your business operations.

Security

We establish a confidentiality commitment with you, so information about the enterprise, human resources, finance, etc., and other contents related to enterprises and investors will only be disclosed with your consent or in accordance with the laws of Vietnam.

SERVICE PERFORMANCE PROCESS

Assign

CDLAF assigns designated personnel responsible for ensuring information security, ensuring that only assigned individuals have the right to access information and handle client communication.

Collect information and prepare the service contents

Assigned personnel are responsible for collecting clients information, reviewing regulations and preparing service content.

Control the quality

The Board of Lawyers and Counsels reviews the service content prepared by the assigned personnel before it is sent to clients for their review.

Clients’ approval

Clients review and approve the service content prepared by CDLAF. When requested, meetings are held to explain the prepared content.

Completion

Personnel responsible for service completion directly implement it at the competent authority (if required). They also monitor the progress, report the results, and hand them over to clients.

After-service support

Guide clients to perform necessary tasks related to the delivered results and provide updates on changes in legal regulations.

People

Contact Us

Are you confused? If you want to discuss your problem more specifically, let us help you, please fill in the information in the table below and send it to us. A free 45-minute consultation email or meeting will be arranged to help you better understand your problem solving problem.

FAQ QUESTIONS: Personal data transfer abroad impact assessment dossier

How long is the work permit valid?

The maximum term of a work permit is 02 years. In case of extension, it can only be extended once for a maximum period of 02 years.

In which cases will the Work Permit be revoked?

The Work permit expires in accordance with the provisions of Clauses 1, 2, 3, 4, 5, 6 and 7, Article 156 of the Labor Code.

The employer or foreign employee does not comply with the provisions of this Decree.
Foreign workers do not comply with Vietnamese laws while working in Vietnam, which affects social security, order and safety.

What are the conditions for foreign workers to be allowed to work in Vietnam?

Foreign workers working in Vietnam are people with foreign nationality and must meet the following conditions:

Being 18 years old or older and having full civil capacity;
Having professional qualifications, techniques, skills, and work experience; having good health in accordance with regulations of the Minister of Health;
Not being a person who is serving a sentence or who has not had a criminal record erased or is being prosecuted for criminal liability in accordance with foreign or Vietnamese law;
Having a work permit issued by a competent Vietnamese state agency, except for the cases specified in Article 154 of this Code.

In which cases are foreign investors considered technical workers?

Technical workers are foreign workers in one of the following cases:

Having been trained for at least 1 year and having at least 3 years of working experience which is appropriate to the position that foreign workers expect to work in Vietnam.
Having at least 5 years of working experience which is appropriate to the position that foreign workers expect to work in Vietnam.

In which cases can foreign workers come to Vietnam to work as experts?

Experts are foreign workers in one of the following cases:

Having graduated from university or higher or equivalent and having at least 3 years of work experience which is appropriate to the job position that the foreign worker expects to work in Vietnam;
Having at least 5 years of experience and having a practising certificate which is appropriate to the job position that the foreign worker expects to work in Vietnam;
Special cases are decided by the Prime Minister at the request of the Ministry of Labor, War Invalids and Social Affairs.