Applicability of Vietnam's Personal Data Protection Decree (PDPD)

Material Applicability Factors

The material applicability of the PDPD is determined by the nature of the data processing activities and the location of the individual involved in such processing. The following factors are relevant:

• Location of Individual who Processes Data

PDPD Art.1(2)(b):

"This Decree applies to: Foreign authorities, entities and individuals in Vietnam;"

The PDPD explicitly includes foreign individuals physically present in Vietnam within its scope. The phrase "foreign authorities, entities and individuals in Vietnam" establishes that the law applies to any data processing activities conducted by such individuals while they are within Vietnam's territory, regardless of their ordinary residence or the location of the data subjects.

This provision ensures that even short-term visitors, expatriates, or foreign workers processing personal data while in Vietnam are subject to the PDPD. It emphasizes the territorial connection required for applicability.

Territorial Applicability Factors

The territorial applicability of the PDPD is determined by factors related to the location of processing activities or the presence and operations of entities within Vietnam. The following factors apply:

• Processing in Jurisdiction
• Processing by Entity Registered or Incorporated in Jurisdiction
• Entity's Link or Presence in Jurisdiction
• Processing by Local Establishment

PDPD Art.1(2)(d):

"This Decree applies to: d) Foreign agencies, organizations and individuals that directly process or are involved in processing personal data in Vietnam."

This provision establishes that any foreign entity engaging in personal data processing activities within Vietnam's territory is subject to the PDPD. The phrase "directly process or are involved in processing personal data in Vietnam" indicates a broad interpretation, capturing both direct and indirect involvement in data processing within Vietnam.

PDPD Art.1(2)(a):

"This Decree applies to: a) Vietnamese agencies, organizations and individuals;"

This provision ensures that all Vietnamese entities, regardless of their specific nature or sector, fall under the PDPD's scope when processing personal data.

PDPD Art.1(2)(c):

"This Decree applies to: c) Vietnamese agencies, organizations and individuals that operate in foreign countries;"

By extending its reach to Vietnamese entities operating abroad, this provision demonstrates the PDPD's extraterritorial application. It ensures that Vietnamese entities cannot evade compliance by relocating their operations outside Vietnam.

PDPD Art.1(2)(b):

"This Decree applies to: b) Foreign authorities, entities and individuals in Vietnam;"

This provision emphasizes that foreign entities with a presence or operations within Vietnam are subject to the PDPD. The phrase "foreign authorities, entities and individuals in Vietnam" highlights that physical presence or operational links within Vietnam trigger compliance obligations under the law.

Conclusion

The PDPD establishes a comprehensive framework for its applicability based on both material and territorial factors:

• Materially, it applies to any individual present in Vietnam who processes personal data.
• Territorially, it governs all data processing activities occurring within Vietnam's borders as well as those conducted by Vietnamese entities abroad or foreign entities with a presence or operations in Vietnam.

These provisions ensure broad coverage and create a level playing field for all entities handling personal data within Vietnam's jurisdiction while safeguarding individual privacy rights effectively.