Company: KNRX
Filing Date: 2025-01-15
Form Type: F-1/A
Source: 0001493152-25-002249
Chunk: 125

Company: KNOREX LTD.
Filing Date: 2025-01-15
Form: F-1/A
Chunk 125
---
 personal data protection are Law No. 24/2018/QH14 on Cyber Security which has come into effect since 1 January 2019, Decree No. 53/2022/ND-CP which has come into effect since 1 January 2022 and Decree No. 13/2023/ND-CP which has come into effect since 1 July 2023.

Personal data protection laws apply to organizations and individuals that are involved in the processing of personal data (data controller, data processor, or third party) and natural persons who are identified or identifiable from the personal information (data subject).

The consent of the data subject is required before carrying out the processing of the personal data. The consent must be expressly made (silent consent is not permitted) and can be partial or conditional. The data subject has the right to access and review their personal data. If the data subject withdraws consent, the relevant personal data must be deleted within a statutory period.

Within sixty days from the date of data processing, organizations must submit a personal data protection impact assessment for the evaluation by the Ministry of Public Security (Department of Cybersecurity and High-Tech Crime Prevention and Control). The impact assessment needs to be amended or updated upon any changes in the extent of the personal data processed by organizations.

Transfer of personal data of Vietnamese citizens abroad requires a relevant impact assessment primarily including a description of reasons, the purposes of transferring the data abroad and relevant consent of the data subjects, as well as a written data transfer agreement with the foreign entity that receives the data. Impact assessment dossier needs to be sent to the Ministry of Public Security within sixty days from the date of processing of personal data and must be available for inspection at the organization. Organizations must update their impact assessment in case of changes and send an update to the Ministry of Public Security.

The above-mentioned procedures at the Ministry of Public Security have just been promulgated without clear guidance; therefore, there are certain difficulties in compliance with the said obligations.

Further, domestic and foreign service providers on telecom networks, on the Internet, and other value-added services in cyberspace in Vietnam carrying out activities of collecting, exploiting, analyzingand processing certain personal data in Vietnam must store such data in Vietnam for a specified period as stipulated by the Government.A foreign enterprise providing certain services into Vietnam on a cross-border basis will be subject to the data storage in Vietnam and the establishment of a branch or representative office in Vietnam if such foreign enterprise falls into the required case which needs more supervision from the