On March 7, 2022, the government of Vietnam issued Resolution No. 27/NQ-CP (“Resolution 27”) approving the promulgation of the latest version of the Draft Decree on Personal Data Protection (“Draft PDPD”) prepared by the Ministry of Public Security (“MPS”), and further instructed the MPS to pass this draft to the National Assembly’s Standing Committee for final consideration.

Although the full content of the approved Draft PDPD has not been made available to the public, Resolution 27 clearly sets out several circumstances approved by the government in which processing of personal data can be carried out without the consent of the data subjects. In comparison with the corresponding provision under the widely seen version of the Draft PDPD made available to the public in February 2021 (“February Draft”), the main differences are as follows:

• If the data processing is necessary in response to an emergency situation that threatens the life, health, or safety of the data subject or other individual, the data controller, data processor, data controller/processor, or a third party can process the personal data without consent of the data subject, but they are responsible for proving that the situation is an emergency. The February Draft did not mention any requirement of proof. Moreover, “safety of the data subject or other individual” is a newly added criterion for personal data processing without consent under this circumstance.
• If the data processing is necessary because of national defense and security requirements, the processing must be carried out by competent authorities in accordance with other laws. The requirement that the processing must be carried out “by competent authorities” in this circumstance was not provided under the February Draft.
• Two circumstances have been removed: the processing of personal data in compliance with specific provisions that explicitly allow the processing of personal data without the data subject’s consent under international agreements or treaties to which Vietnam is a signatory, and the processing of personal data for research or statistical purposes. This means data processing for these purposes will still be subject to the prior consent of the data subjects.
• One circumstance has been added: the processing of personal data by a competent state agency to serve the operation of the state agency in accordance with the law.

Moreover, under Resolution 27, the MPS is assigned to preside over and coordinate with the Ministry of Justice in researching and proposing the development of a Law on Personal Data Protection, a new and separate piece of legislation that promises the development of a comprehensive legal system on data protection for Vietnam.