BSA recommends that Vietnam’s Personal Data Protection Law clearly define controller and processor roles in line with global norms, allow additional legal bases for data processing such as legitimate interests, and recognize mechanisms for cross-border data transfers like contracts, binding corporate rules, and internationally recognized certifications. BSA further urges adopting risk-based approaches for handling data subject rights and data breach notifications, and suggests a two-year transition period after the enactment of the Law.

Translation: Vietnamese