Asia-Pacific employment law bulletin 2024

Vietnam

Vietnam in 2023, as sweeping changes were introduced that affect all employers who control and process the personal data of their employees. In addition, the pandemic made it difficult for employers to implement the stringent measures of managing foreign employees (under Decree 152/2020/ND-CP of the Government, dated 30 December 2020 (Decree 152)). In 2023, the Government issued further legal instruments to introduce some welcome relaxations.

Decree on personal data protection

Decree 13/2023/ND-CP of the Government, dated 17 April 2023, on personal data protection (Decree 13) is Vietnam’s overarching data protection regulation and came into effect on 1 July 2023. The main authority in charge of drafting and explaining Decree 13 is the Department of Cyber Security and Hi-tech Crime Prevention of the Ministry of Public Security (A05). Various aspects of Decree 13 remain unclear with regard to how they will be implemented or enforced in practice.

Under Decree 13, ‘personal data’ means information in the form of symbols, scripts, notebooks, images or similar forms in the electronic environment attached to a specific person or helping to identify a specific person, which is then categorised as basic and sensitive data.

According to Decree 13, parties relevant to the processing of personal data comprise of:

• Data controller: The organisation/individual who determines the purpose and the means of personal data processing;
• Data processor: The organisation/individual who processes the personal data on behalf of the data controller through a contract or agreement with the data controller;
• Data controller and processor: The organisation/individual who determines the purpose, the means of data processing and directly processes the personal data;
• Third party: The organisation/individual who, other than the data subject, data controller, data processor, data controlling and processing party, is allowed to process the personal data. 

Accordingly, employers which undertake the processing of personal data of Vietnamese citizens (e.g. their employees) would be categorised as a ‘data controller and processor’. They are subject to the following key obligations: 

• obtain “qualified” consent from data subjects (e.g. employees) prior to processing their personal data, which must include certain prescribed contents;
• make a notification (including prescribed contents) to data subjects prior to processing personal data. As Decree 13 specifies that the notification is not required if the same contents have been consented to by the data subject, in practice, a data controller and processor usually combines them in the consent form;
• conduct impact assessment for cross-border data transfer (CBDT) and keep in a dossier in prescribed form; and
• conduct an impact assessment (PIA) for the processing of personal data and keep in a dossier in prescribed form;

The CBDT and PIA dossiers must be delivered to the A05 within two months of 1 July 2023, though there are not yet any applicable administrative sanctions and the level of enforcement of this requirement remains unclear. The A05 then has 10 business days to examine and give further comments if they are incomplete. The dossiers must also be available at the company’s premises for examination by the A05.

Work permit simplifications

Decree 70/2023/ND-CP of the Government dated 18 September 2023 (Decree 70) stipulates the following key developments from Decree 152:

• Looser conditions for some intra-company transferees: Under the prior Decree 152, an ‘expert’ needed at least three years of work experience in the same field as the expert’s university degree or equivalent, and the field had to correspond to the projected job in Vietnam. A ‘technical worker’ needed at least one year of education/training and three years of work experience in the same field. Under Decree 70, the work experience and the education no longer have to be in the same field; the work experience need only be appropriate to the projected job. 
• Clarification of application documents: For a manager or executive director, Decree 152 did not specify which documents were acceptable to demonstrate the manager or executive director’s function in an application for a work permit (WP) or work permit exemption (WPE). This resulted in inconsistent demands from different provinces. Decree 70 has now made clear that the application documents will simply include a resolution or appointment decision in favour of the employee.

For an expert or technical worker, under Decree 152, application documents must show the satisfaction of the conditions for an expert or technical worker and include diplomas, degrees, and certifications by the foreign organisation on the years of work of the employee. Decree 70 adds that a previously issued WP or WPE will also be accepted.

• Additional grounds for exemption from prior approvals: In addition to the grounds under Decree 152, Decree 70 sets out additional grounds for exemption from having to obtain the prior approval by the authorities, including:
  • foreign lawyers who were issued with a lawyer certificate to practice in Vietnam under the Law on Lawyers;
  • foreigners who have married a Vietnamese citizen and will reside in Vietnam; and
  • other grounds under Article 7 of Decree 152, which were previously grounds for not having to obtain a WP, and now also serve as exceptions to the prior approval requirement. 
• New process for approval prior to recruitment: before any particular vacancies can be filled by foreign employees, employers in Vietnam must generally specify a demand for foreign employees for such vacancies and show how Vietnamese employees are underqualified for the role, and seek approval from the competent authorities (except where exempted by law, as set out above). 

Decree 70 now also requires that, from 1 January 2024, employers in Vietnam must publicly announce the job vacancies for which they plan to recruit foreign employees to Vietnamese job-seekers through an online portal of either the Ministry of Labour, Invalids and Social Affairs (MOLISA) or an Occupation Services Centre. Though the drafting is not clear, it may be reasonably interpreted that the announcement must occur before the employer can submit a demand for foreign employees to the authorities, and the process would comprise of the following steps:

• • Step 1: Public announcement of job vacancy through the online portals, which must include certain prescribed contents under Decree 70;
  • Step 2: At least 15 days after Step 1, the employer in Vietnam can submit a report to the MOLISA or the provincial DOLISA. The form of the report includes an explanation of the reason for not being able to recruit Vietnamese employees. 

If one of the prescribed items in the vacancy changes, the employer must report this to the MOLISA or DOLISA at least 15 days before the estimated recruitment date.

• • Step 3: The MOLISA or provincial DOLISA reviews and issues approval within 10 business days after receipt of the report in Step 2.