[KPMG] Legal Update August 2023
In the last few months, the Government issued two significant regulations on cybersecurity and personal data protection which are (i) Decree 53/2022/ND-CP providing guidance on the implementation of the Law on Cybersecurity (“Decree 53”) and (ii) Decree 13/2023/ND-CP on personal data protection (“Decree 13”).
To strengthen the practical enforcement of the abovementioned legal framework, on 31 May 2023, the Ministry of Public Security (“MPS”) circulated a 3rd version of the draft decree on cybersecurity administrative sanctions (“Draft CASD”) for public consultation. The Draft CASD features an updated list of non-compliances with the cybersecurity and data privacy regulations and also replaces certain regulations covered under the existing Decree 15/2020/ND-CP and Decree 14/2022/ND-CP on administrative sanctions against regulations on postal services, telecommunications, radio frequencies, information technology and electronic transactions.
As the regulations on personal data protection came into force on 1 July 2023, we expect that this decree on cybersecurity administrative sanctions will be issued in the coming months. The entities covered by this broad scope of application of Draft CASD should take steps to ensure they comply with Decree 53 and Decree 13, and to avoid any censure once the regulation is officially issued.
KPMG would like to outline in the Legal Alert key highlights from the Draft CASD for your information.
