1. Introduction
FPT Smart Cloud Limited Company (“FPT Smart Cloud” hereinafter) Corporate Data Protection Policy lays out strict requirements for processing personal data pertaining to customers, business partners, employees or any other individual. It meets the requirements of the European Data Protection Directive and ensures compliance with the principles of national and international data protection laws in force all over the world. The policy sets a globally applicable data protection and security standard for FPT Smart Cloud and regulates the sharing of information between FPT Smart Cloud, subsidiaries, and legal entities. FPT Smart Cloud have established guiding data protection principles – among them transparency, data economy and data security – as FPT Smart Cloud Personal Data Protection Policy and Information security management guidelines.
FPT Smart Cloud managers and employees are obligated to adhere to the Corporate Data Protection Policy and observe their local data protection laws. As the Data Protection Officer, it is my duty to ensure that the rules and principles of data protection at FPT Smart Cloud are followed around the world.
I will be pleased to answer any questions you have about data protection and international personal data transfer.
Pham The Minh
Data Protection Officer, MinhPT@fpt.com, +84 913571357
1.1. Purpose
This Data Protection Policy applies worldwide to FPT Smart Cloud, Subsidiaries as well as legal entities and is based on globally accepted, basic principles of data protection. Ensuring data protection is the foundation of trustworthy business relationships and the reputation of the FPT Smart Cloud as a first-class employer.
The Data Protection Policy provides one of the necessary framework conditions for cross-border data transfer among FPT Smart Cloud, subsidiaries, and legal entities. It ensures an adequate level of data protection prescribed by the European Union General Data Protection Regulation, Personal Data Protection Decree No. 13, APPI, PDPA or other national Personal Data Protection Regulations and national laws for cross-border data transmission, including to countries which do not have adequate data protection law, yet.
In order to standardize the collection, processing, transfer, and use of personal data, and promote the reasonable, lawfully, fairly and transparent use of personal data to prevent personal data from being stolen, altered, damaged, lost or leaked, FPT Smart Cloud establishes the personal data protection management policy and information security policies.
1.2. Application Scope
All processing of personal data by FPT Smart Cloud is within the scope of this procedure.
Means, all FPT Smart Cloud’s business processes and information systems involved in the collection, processing, use and transfer of personal data and all employees, contractors and 3rd party providers involved in the processing of personal data on behalf of FPT Smart Cloud.
This policy is binding for all departments and functions globally which are involved in personal identifiable information processing. Every FPT Smart Cloud department, legal entity or subsidiary must follow this procedure.
In scope are all data subjects whose personal data is collected, in line with the requirements of the GDPR, Personal Data Protection Decree No. 13 and other national/ international data protection regulation.
1.3. Application of national Laws
This Data Protection Policy comprises the internationally accepted data privacy principles without replacing the existing national laws. It supplements the national data privacy laws. The relevant national law will take precedence in the event that it conflicts with this Data Protection Policy, or it has stricter requirements than this Policy. The content of this Data Protection Policy must also be observed in the absence of corresponding national legislation. The reporting requirements for data processing under national laws must be observed.
Each subsidiary or legal entity of FPT Smart Cloud is responsible for compliance with this Data Protection Policy and the legal obligations. If there is reason to believe that legal obligations contradict the duties under this Data Protection Policy, the relevant subsidiary or legal entity must inform the Data Protection Officer. In the event of conflicts between national legislation and the Data Protection Policy, FPT Smart Cloud in person the Data Protection Officer will work with the relevant subsidiary or legal entity of FPT Smart Cloud to find a practical solution that meets the purpose of the Data Protection Policy.
1.4 Prevention of national and international Data Protection Laws Violations
The Data Protection Officer DPO reporting to the board member responsible for Data Protection oversees the compliance and regulatory functions FPT Smart Cloud, with the goal to identify, reduce, and monitor all areas of possible regulatory and reputational risk regarding personal data processing.
The Personal Data Protection Policy and guidelines, procedures, templates is revised and supplemented once a year. The DPO and board member reviews and approves the Handbook promptly in the event of any material change in laws. regulations or business practices.
DPO provides periodically an online personal data protection education programs on online training platform to keep employees informed about current regulatory developments, updates of policies and procedures, and legal requirements.
If a violation of the Personal Data Protection policies, guidelines, procedures, templates occurs or a preliminary determination is made that a violation may have occurred, a report must be made to the DPO and Senior Management.
The Senior Management should impose adequate sanctions on employees violating the policies. Sanctions may include any or all of the following: a letter of censure, a fine, temporary suspension of employment, termination of employment, or any other sanction deemed appropriate by Senior Management.
2. Policy
2.1. Guiding principles
2.2.1 Rules for protection of personal data
- The personal data shall be processed as prescribed by law.
- Data subjects are informed about activities related to the processing of their personal data, unless otherwise provided for by law.
- The personal data shall be processed for the purposes that have been registered and declared by the Personal Data Controller, the Personal Data Processor, the Personal Data Controller-cum-Processor and the Third Party.
- The collected personal data shall be appropriate for the scope and purposes of processing. The purchase or sale of personal data shall be prohibited in any form, unless otherwise provided for by law.
- The personal data shall be updated and added for the processing purposes.
- The personal data shall be protected and secured throughout the processing. To be specific, the personal data shall be protected from violations against regulations on protection of personal data and prevention of loss, destruction or damage caused by incidents and use of technical measures.
- The personal data shall be stored within a period of time that is appropriate for the processing purposes, unless otherwise provided for by law.
- The Personal Data Controller and the Personal Data Controller-cum-Processor shall comply with the rules for data processing specified in Clauses 1 through 7 of this Article and prove their compliance.
2.2.2 Ensuring Data Subject’s Rights
- Right to be informed
The data subject has the right to be informed of his/her personal data processing, unless otherwise provided for by law.
- Right to give consent
The data subject has the right to give consent to the processing of his/her personal data, other than cases specified in Article 17 of Decree No 13/2023/NĐ-CP.
- Right to access personal data
The data subject has the right to access his/her personal data in order to look at, rectify or request rectification of his/her personal data, unless otherwise provided for by law.
- Right to withdraw consent
The data subject has the right to withdraw his/her consent, unless otherwise provided for by law.
- Right to delete personal data
The data subject has the right to delete or request deletion of his/her personal data, unless otherwise provided for by law.
- Right to obtain restriction on processing
- The Data Subject has the right to obtain restriction on the processing of his/her personal data, unless otherwise provided for by law.
- The restriction of data processing shall be carried out within 72 hours after the request of the Data Subject, with respect to all personal data requested by the data subject, unless otherwise provided for by law.
- Right to obtain personal data
The Data Subject has the right to request the Personal Data Controller and the Personal Data Controller-cum-Processor to provide him/her with his/her personal data, unless otherwise provided for by law.
- Right to object to processing
- a) The data subject has the right to object to the Personal Data Controller and the Personal Data Controller-cum-Processor processing his/her personal data in order to prevent or restrict the ddisclosure of personal data or the use of personal data for advertising and marketing purposes, unless otherwise provided for by law.
- b) The Personal Data Controller and the Personal Data Controller-cum-Processor shall comply with the data subject’s request within 72 hours after receiving the request, unless otherwise provided for by law.
- Right to file complaints, denunciations, and lawsuits
The Data Subject has the right to file complaints, denunciations and lawsuits as prescribed by law.
- Right to claim damage
The Data Subject has the right to claim damage as prescribed by law when there are violations against regulations on protection of his/her personal data, unless otherwise agreed by parties or unless otherwise prescribed by law.
- The right to self-protection
The Data Subject has the right to self-protection according to regulations in the Civil Code, other relevant laws and Decree No 13/2023/NĐ-CP, or request competent agencies and organizations to implement civil right protection methods according to regulations in Article 11 of the Civil Code.
2.2. Customer and Provider Data (3rd party)
2.2.1 Data processing for a contractual relationship
Personal Data of customers and providers (3rd party) can be processed in order to establish, execute and terminate a contract. Prior to a contract – during the contract initiation phase – Personal Data can be processed to prepare bids or purchase orders or to fulfill other requests that relate to contract conclusion. Customers or providers can be contacted during the contract preparation process using the information that they have provided. Any restrictions requested by customers or providers must be complied with.
FPT Smart Cloud does not need the consent of the Data Subject to perform contractual obligations.
The public, means every customer, provider, data subjects must have access to information about the FPT Smart Cloud’s Personal Data Protection principles and activities and must be able to communicate with FPT Smart Cloud’s Data Protection Officer in an easy way:
Pham The Minh | Data Protection Officer, | FPT SMART CLOUD
Address: FPT Tower, 10 Pham Van Bach Street, Cau Giay Ward, Ha Noi, Vietnam
Cell: +84 913571357 | Tel: 1900638399
URL: https://fptsmartcloud.com/
2.2.2 Consent to data processing
Data can be processed following consent by the Data Subject. Before giving consent, the data subject must be informed in accordance with company’s Personal Data Protection Policy. In order to obtain the consent of the data subject, the following contents must be notified to the data subject:
a) The type of personal data to be processed;
b) Purpose of processing personal data;
c) Organizations and individuals may process personal data;
d) Rights and obligations of the data subject.
The declaration of consent must be obtained in writing or electronically for the purposes of documentation. In some circumstances, such as telephone conversations, consent can be given verbally. The granting of consent must be documented.
2.2.3 Data processing pursuant to legal authorization
The processing of personal data is also permitted if national legislation requests, requires or allows this. The type and extent of data processing must be necessary for the legally authorized data processing activity and must comply with the relevant statutory provisions.
2.2.4 Data processing pursuant to legitimate interest
Personal Data can also be processed if it is necessary for a legitimate interest of FPT Smart Cloud. Legitimate interests are generally of a legal (e.g. collection of outstanding receivables) or commercial nature (e.g. avoiding breaches of contract). Personal Data may not be processed for the purposes of a legitimate interest if, in individual cases, there is evidence that the interests of the data subject merit protection, and that this takes precedence. Before data is processed, it is necessary to determine whether there are interests that merit protection.
2.2.5 User data and internet
If Personal Data is collected, processed and used on websites or in apps, the data subjects must be informed of this in a privacy statement and, if applicable, information about cookies. The privacy statement and any cookie information must be integrated so that it is easy to identify, directly accessible and consistently available for the data subjects.
If use profiles (tracking) are created to evaluate the use of websites and apps, the data subjects must always be informed accordingly in the privacy statement.
If websites or apps can access Personal Data in an area restricted to registered users, the identification and authentication of the data subject must offer sufficient protection during access.
2.3. Employee Data
2.3.1 Data processing for the employment relationship
In employment relationships, personal data can be processed if needed to initiate, carry out and terminate the employment agreement. When initiating an employment relationship, the applicants’ personal data can be processed. If the candidate is rejected, his/her data must be deleted in observance of the required retention period, unless the applicant has agreed to remain on file for a future selection process. Consent must be given by every candidate before processing their personal data in FPT Smart Cloud systems. Consent is also needed to use the data for further application processes or before sharing the application with other FPT Smart Cloud legal entities.
In the existing employment relationship, data processing must always relate to the purpose of the employment agreement if none of the following circumstances for authorized data processing apply.
If it should be necessary during the application procedure to collect information on an applicant from a third party, the requirements of the corresponding national laws must be observed. In cases of doubt, consent must be obtained from the data subject.
There must be a legal authorization to process personal data that is related to the employment relationship but was not originally part of performance of the employment agreement. This includes legal requirements, collective regulations with employee representatives, consent of the employee, or the legitimate interest of the company.
Employee can also provide information about other people, such as employees’ dependents and families, so that the Company can provide relevant benefits or contract them in case of need. Before employee provide information to the company about other people, employee must inform them of the information they intend to provide to the company and must be responsible for the consent collection from their dependents and families. If employee share their information with the company, they may also need to read this Policy.
2.3.2 Data processing pursuant to legal authorization
The processing of personal employee data is also permitted if national legislation requests, requires or authorizes this. The type and extent of data processing must be necessary for the legally authorized data processing activity and must comply with the relevant statutory provisions. If there is some legal flexibility, the interests of the employee that merit protection must be taken into consideration.
2.3.3 Collective agreements on data processing
If a data processing activity exceeds the purposes of fulfilling a contract, it may be permissible if authorized through a collective agreement. Collective agreements are pay scale agreements or agreements between employers and employee representatives, within the scope allowed under the relevant employment law. The agreements must cover the specific purpose of the intended data processing activity and must be drawn up within the parameters of national data protection legislation.
2.3.4 Consent to data processing
Employee data can be processed upon consent of the person concerned. Declarations of consent must be submitted voluntarily. Involuntary consent is void. The declaration of consent must be obtained in writing or electronically for the purposes of documentation. In certain circumstances, consent may be given verbally, in this case it must be properly documented. In the event of informed, voluntary provision of data by the relevant party, consent can be assumed if national laws do not require express consent. Before giving consent, the data subject must be informed in accordance with this Data Protection Policy.
2.3.5 Data processing pursuant to legitimate interest
Personal Data can also be processed if it is necessary for a legitimate interest of FPT Smart Cloud. Legitimate interests are generally of a legal (e.g. collection of outstanding receivables) or commercial nature (e.g. avoiding breaches of contract). Personal Data may not be processed for the purposes of a legitimate interest if, in individual cases, there is evidence that the interests of the data subject merit protection, and that this takes precedence. Before data is processed, it is necessary to determine whether there are interests that merit protection.
2.3.6 Telecommunications and Internet
Telephone equipment, e-mail addresses, intranet, and internet along with internal social networks are provided by the company primarily for work-related assignments. They are company tools and company resources. They can be used within the applicable legal regulations and internal company policies. In the event of authorized use for private purposes, the laws on secrecy of telecommunications and the relevant national telecommunication laws must be observed if applicable.
There will be no general monitoring of telephone and e-mail communications or intranet/ internet use. To defend against attacks on the IT infrastructure or individual users, protective measures can be implemented for the connections to the FPT Smart Cloud network that block technically harmful content or that analyze the attack patterns. For security reasons, the use of telephone equipment, e-mail addresses, the intranet/internet and internal social networks can be logged for a temporary period. Evaluations of this data from a specific person can be made only in a concrete, justified case of suspected violations of laws or policies of FPT Smart Cloud. The evaluations can be conducted only by investigating departments while ensuring that the principle of proportionality is met. The relevant national laws must be observed.
2.4. Access Request of state/government or federal agency or other regulatory body
Requests for Personal Data Access of state/government or federal agency or other regulatory body are handled in the same way and under the same conditions as international data transfer by strictly following the requirements of the national law of the respective country. All access requests are registered in the access request register. All requests are managed by the DPO and are subject to agreement with the FPT Smart Cloud board member responsible for data protection. The DPO is responsible for communication with state/government or federal agency or other regulatory body. The DPO is responsible for the access request register. FPT Smart Cloud will inform the data subject about a request for personal data without any undue delay if it is not in contradiction to the national laws.
2.5. Policy Review and Evaluation
This policy must be reviewed and evaluated twice a year to reflect the latest status of international standards, legal regulations, technologies, and businesses, and to ensure the timeliness of personal data management practices.
2.6. Announce and Release
This policy is based on an announcement process that will enable personnel to understand the relevant principles and provisions of the personal data protection management policy so that they can follow it.
This policy must be revised and reviewed by the Data Protection Officer and the responsible FPT Smart Cloud board member. The Data Protection Officer is responsible for implementation and internal audits.
3. Data Protection Control
Compliance with the Data Protection Policy and the applicable data protection laws is checked annually with data protection audits and other controls. The performance of these controls is the responsibility of the Data Protection Representatives. The results of the data protection controls must be reported to the Data Protection Officer and the responsible FPT Smart Cloud board member. On request, the results of data protection controls will be made available to the responsible data protection authority. The responsible data protection authority can perform its own controls of compliance with the regulations of this Policy, as permitted under national law.
4. Technical and Organizational Measures
As non-public company processing Personal Data within a scope of an agreement for commissioned data processing, the FPT Smart Cloud must take technical and organizational procedures to ensure the compliance with the European Data Protection Regulation and other international Data Protection laws. On top of such procedure, confidentiality, integrity, availability and resilience of systems and components must be guaranteed by FPT Smart Cloud.
The following groups of measures tackle all aspects of current minimum-security level. They aim at assessing FPT Smart Cloud’s level of data protection when processing personal data on behalf of the Controller. If FPT Smart Cloud connects to the Controller’s systems, FPT Smart Cloud must complete at least the confidentiality part, whereby FPT Smart Cloud will need to have the access and access authorization controls as well as the segregation of duties controls completed (sections b) c) d) below).
Below the technical and organizational measures currently realized within FPT Smart Cloud. A continuous improvement process is implemented:
4.1. Confidentiality
a) Access Control / Building Security
The aim of the Access Control is to prevent unauthorized use of data processing systems which are used for the processing and the use of Personal Data.
Each employee’s user master data and individual identification code are registered in the contact directory. Admission to the data processing systems is only possible after identification and authentication by using the identification code and the password for the particular system.
☒ Alarm system
☒ Protection of building shafts
☒ Automatic access control system
☒ Access control by chip card transporter
☒ Locking system with code lock
☒ Manual locking system
☐ Biometric access control
☒ Video surveillance of entrances
☐ Light barriers / motion sensors
☒ Safety locks
☒ Key transfer regulation (hand-over of keys etc.)
☒ Identity check by janitor/reception
☒ Recording visitors
☒ Commitment of special selected cleaning staff
☒ Commitment of special selected security
☒ Commitment to wear authorization card staff
b) Physical Access Control/ System Protection
The aim of the Physical Access Control is to prevent unauthorised people from physically accessing such data processing equipment which processes or uses Personal Data.
Due to their respective security requirements, business premises and facilities are subdivided into different security zones with different access authorizations. They are monitored by security personnel.
Access to special security areas such as the service centre for remote maintenance or ODC is additionally protected by a separate access area. The constructional and substantive security standards comply with the security requirements for data centers.
☒ Internal access control
☒ Isolation control (permission for user rights)
☒ Strong password specification
☐ Biometric authentication
☒ Authentication a username/password
☒ Assignment of user profiles to IT Systems
☒ Locking server housing/computers
☒ Use of VPN technology (remote access)
☒ Locking external interfaces (USB etc.)
☒ Encryption of mobile data media
☒ Intrusion detection system
☐ Central smartphone administration (e.g., remote deletion)
☐ Encryption of smartphone content
☐ Secure passwords for smartphones
☒ Encryption of data media on laptop computers
☒ Assignment of individual usernames
☐ Or else, please specify:
c) Electronic Access Control/Securing Access Authorization
Measures regarding Electronic Access Control are to be targeted on the fact that only such data can be accessed for which an access authorization exists, and that Personal Data cannot be read, copied, changed, or deleted in an unauthorized manner during the processing, use and after the saving of such data.
Access to data necessary for the performance of the particular task is ensured within the systems and applications by a corresponding role and authorization concept.
☒ Rights authorization concept
☒ Rights management by system administrator
☒ Number of system administrators “reduced to a minimum”
☒ Recording of deletion
☒ Logging of system access events, especially entries, changes and deletions of data
☒ Application of virus protection
☒ Physical deletion of media prior to reuse
☒ Application of software firewall
☒ Secure storage of data carriers
☒ Password policies (incl. defined password length, password changes)
☒ Encryption of data carriers
☒ Use of appropriate shredders resp. specialized service providers
☒ Application of hardware firewall
☒ Proper destruction of data carriers
☐ Or else, please specify:
☒ Access logs
d) Separation control/ Measures to safeguard the separation of purposes for which Personal Data have been collected
The aim of the Separation Control is to ensure that data which have been collected for different purposes can be processed separately.
Personal Data is used by the Processor for internal purposes only. A transfer to a third party such as a Sub-Contractor is solely made under consideration of contractual arrangements and European Data Protection Regulation.
Processor’s employees are instructed to collect, process, and use Personal Data only within the framework and for the purposes of their duties (e.g., service provision). At a technical level, multi-client capability, the separation of functions as well as the separation of testing and production systems are used for this purpose.
☒ Physically separate storing using separate systems or data carrier
☒ Definition of an authorization concept
☒ Division between productive and testing systems
☒ Encryption of data records, processed for the same purpose
☒ No productive data in testing systems
☒ Logical client separation (software based)
☐ Or else, please specify:
e) Pseudonymizing
The processing of Personal Data in such a way that the data cannot be associated with a specific Data Subject without the assistance of additional information, provided that this additional information is stored separately, and is subject to appropriate technical and organizational measures.
☒ Pseudonymously (or anonymous) processing of data
☒ Separation of assignment file and storage in a separate, secure IT system
4.2. Integrity
a) Data Transfer Control/Data Transfer Security
The aim of the Data Transfer Control is to ensure that Personal Data cannot be read, copied, changed, or deleted without authorization during their transfer and that it can be monitored and determined to which recipients a transfer of Personal Data is intended.
The transfer of Personal Data by FPT Smart Cloud to a third party (e.g., customers, sub-contractors, service provider) is only made if a corresponding contract exists, and only for a specific purpose. If Personal Data is transferred to companies with their seat outside the EU/EEA or the original country, FPT Smart Cloud provides that an adequate level of data protection exists at the target location or organization in accordance with the European Union’s Data Protection Regulation, e.g., by employing contracts based on the EU model contract clauses.
☒ Establishment of dedicated lines resp. VPN-tunnel
☒ Email encryption
☒ Recording of data recipients as well as periods of scheduled transmission resp. agreed deletion periods
☒ Physical transport: selection of special transport staff and carrier
☐ Or else, please specify:
☒ Data transfer in an anonymous or pseudonymous way
☒ Creation of an overview of regular data request as well as data transfer
☒ Physical transport: Use of secure transport containers/-packing
☒ Use of encrypted external devices when transferring data (CD, USB, stick etc.)
b) Input control
The aim of the Input Control is to make sure with the help of appropriate measures that the circumstances of the data entry can be reviewed and monitored retroactively.
System inputs are recorded in the form of log files. By doing so, it is possible at a later stage to review whether and by whom Personal Data was entered, altered or deleted
☒ Creation of an overview proving which application entitles to input, modify or remove which data
☒ Permission settings to entitle to input, modify and delete data in accordance with a right allocation concept
☒ Continual logging of inputs, modification and deletion of data
☒ Use of individually assigned usernames to ensure access control or input, modification or deletion of data
☒ Retention of a filing system to evaluate the origin of data transmitted to automatically processed data
☒ Activity logs
☐ Or else, please specify.
4.3. Availability and Resilience
a) Availability control and protection to prevent accidental or willful destruction or loss
The aim of the availability control is to ensure that Personal Data is protected against accidental destruction and loss.
If Personal Data is no longer required for the purposes for which it was processed, it is deleted promptly. It should be noted that with each deletion, the Personal Data is only locked in the first instance and is then deleted for good with a certain delay. This is done to prevent accidental deletions or possible intentional damage.
☒ Server rooms equipped with air conditioning, protective plugs, fire extinguishers
☒ Back-ups stored separately in a safe place
☒ Emergency plan
☒ Business continuity plan
☒ No server rooms below sanitary facilities
☒ Regular data file back-ups
☒ Supervision emergency plan
☐ Or else, please specify:
b) Rapid Recovery
☒ Recovery acc, back-up and recovery concept
☒ Recovery testing
☒ Supervision emergency plan
4.4. Procedures to handle regular review, valuation and evaluation
a) Data Protection Management
☒ The principles relating to processing of personal data (collection, processing or use) are subject to an internal company policy
☒ The data protection officer has been designated in written form
☒ Employees are committed to data confidentiality/handling of personal data
☒ Employees are committed to comply with the regulations regarding the secrecy of telecommunications
☒ An internal list of processing operations is available.
☒ The data protection officer is involved in the data protection impact assessment
☒ The data protection officer is member of the organizational chart
☒ Employee training courses.
☒ Implementation of a control system designed to detect unauthorized access to personal data
☐ Or else, please specify:
b) Incident Response Management
It corresponds to incident management in case of detected or suspected security incidents resp. failure related to IT sectors.
☒ Processing scheme for incident management
☒ Team practicing realistic exercises
☒ Security team designated and trained
☐ Or else, please specify:
c) Data protection by implementation of appropriate technical measures and privacy by default settings (as per EU Regulation)
☒ Adherence to privacy by Design/data protection by appropriate technologies
☒ Selection of privacy-enhancing technologies for future requirements
☒ Adherence to privacy by Default/data protection by appropriate settings
☐ Or else, please specify:
d) Supervision/Engagement of sub-contractors
No data processing is to be carried out without prior specific authorization of the Controller, e.g. clear contractual obligation, formalized order management, strict selection of the service provider, obligation for advance verification, follow-up inspection.
☒ Selection of (sub)contractors subject to professional diligence (in particular with regard to data security)
☒ Guidelines drawn up for processor documented in writing (e.g. by data processing agreement)
☒ Processor designated data protection officer (if necessary)
☒ Effective controller’s supervision rights agreed
☒ Prior to engagement, verification of security measures recorded by sub-contractor
☒ Processor’s employees are committed to sign a secrecy/confidentiality agreement
☒ Ensure erasure or destruction of data after termination of the contract
☒ Continuous review of processor and his activities
☐ Or else, please specify:
5. Personal Data Protection Training
Every new employee must join the first day Personal Data Protection training.
For every employee processing personal data, it is mandatory to join the Personal Data Protection training including a successful exam before starting personal data processing. An annually refresh training is also mandatory.
6. Data Protection Officer
The Data Protection Officer, being internally independent of professional orders, works towards the compliance with national and international data protection regulations. He is responsible for the Data Protection Policy and supervises its compliance. The Data Protection Officer is appointed by the FPT Smart Cloud Board.
Any data subject may approach the Data Protection Officer, at any time to raise concerns, ask questions, request information, or make complaints relating to data protection or data security issues. If requested, concerns and complaints will be handled confidentially.
Contact details for the Data Protection Officer and staff are as follows:
FPT Smart Cloud Company, Ltd.
Data Protection Officer, Pham The Minh
FPT Tower, 10 Pham Van Bach Street, Cau Giay Ward, Ha Noi, Viet Nam
Cell: +84 913571357
E-mail: MinhPT@fpt.com
7. Responsibilities and Disciplinary
The executive bodies of FPT Smart Cloud, subsidiaries and legal entities are responsible for data processing in their area of responsibility. Therefore, they are required to ensure that the legal requirements, and those contained in the Data Protection Policy, for data protection are met (e.g., national reporting duties). Board of Managers are responsible for ensuring that organizational, HR and technical measures are in place so that any data processing is carried out in accordance with data protection. Compliance with these requirements is the responsibility of the relevant employees. If external agencies perform data protection controls, the Data Protection Officer must be informed immediately.
Improper processing of personal data, or other violations of the data protection laws, can be criminally prosecuted in many countries, and result in claims for compensation of damage. Violations for which individual employees are responsible can lead to sanctions under employment law.
If you do not understand the implications of this policy or how it may apply to you, seek advice from the DPO via the phone or email (Pham The Minh, phone: +84913571357, email: MinhPT@fpt.com).
8. Supplementary Guidelines and Documents
Personal Data Protection Policy
Every FPT Smart Cloud employee can find these Policies, Guidelines, procedures and templates on the platform QMS.
9. Exceptions
Any exception must be reviewed and approved by Data Protection Officer and also approved by the responsible board member of FPT Smart Cloud.
10. Appendix
10.1. Definition
Abbreviations
Description
PII, Personal Identifiable Information, Personal Data
Refer to the personal data defined by the EU GDPR (Article 4 (1)), ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Data Subject
EU GDPR (Article 4 – 1), Data subject refers to any individual person who can be identified, directly or indirectly.
Data Controller
EU GDPR (Article 4 – 7), Data Controller means the natural or legal person, public authority, agency or anybody which alone or jointly with others, determines the purpose and means of processing of personal data; where the purpose and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
Data Processor
EU GDPR (Article 4 – 8), Data Processor means a natural or legal person, public authority, agency or anybody which processes data on behalf of the controller.
Recipient
EU GDPR (Article 4 – 9), A natural or legal person, public authority, agency or anybody, to which the personal data are disclosed, whether third party or not.
Third Party
EU GDPR (Article 4 – 10), A natural or legal person, public authority, agency or anybody other than the data subject, controller, processor and persons who under direct authority of controller or processor, are authorized to process personal data
DPO
Data Protection Officer
DPIA
Data Protection Impacted Assessment
EU
European Union
10.2. Related Documents
No
Code
Name of documents
1
EU GDPR
EU General Data Protection Regulation
2
PERSONAL DATA PROTECTION DECREE NO. 13/2023/ND-CP, VN
Decree of the Vietnamese Government: PERSONAL DATA PROTECTION DECREE NO. 13/2023/ND-CP
Nghị Định Quy Định Về Bảo Vệ Dữ Liệu Cá Nhân 07/2023
3
PCI DSS
Payment Card Industry Data Security Standard,
10.3. Data Protection Law, Vietnam, Overview
There is no single data protection law in Vietnam. Regulations on data protection and privacy can be found in various legal instruments. The right of privacy and right of reputation, dignity and honour and fundamental principles of such rights are currently provided for in Constitution 2013 (“Constitution”) and Civil Code 2015 (“Civil Code”) as inviolable and protected by law.
Regarding personal data, the guiding principles on collection, storage, use, process, disclosure or transfer of personal information are specified in the following main laws and documents:
- Data Law No. 60/2024/QH15, passed by the National Assembly on 30 November 2024. This Law comes into force as of July 1, 2025.
- Criminal Code No. 100/2015/QH13, passed by the National Assembly on 27 November 2015
- Law No. 24/2018/QH14 on Cybersecurity, passed by the National Assembly on 12 June 2018 (“Cybersecurity Law”);
- Law No. 86/2015/QH13 on Network Information Security, passed by the National Assembly on 19 November 2015; as amended by Law No. 35/2018/QH14 dated 20 November 2018, on amendments to some articles concerning planning of 37 Laws (“Network Information Security Law”);
- Law No. 59/2010/QH12 on Protection of Consumers’ Rights, passed by the National Assembly on 17 November 2010; as amended by Law No.35/2018/QH14 dated 20 November 2018, on amendments to some articles concerning planning of 37 Laws (“CRPL”);
- Law No. 67/2006/QH11 on Information Technology, passed by the National Assembly on 29 June 2006; as amended by Law No. 21/2017/QH14 dated 14 November 2017 on planning (“IT Law”);
- Law No. 51/2005/QH11 on E-transactions, passed by the National Assembly on 29 November 2005 (“E-transactions Law”);
- Decree No. 85/2016/ND-CP dated 1 July 2016, on the security of information systems by classification (“Decree 85”);
- Decree No. 72/2013/ND-CP dated 15 July 2013 of the Government, on management, provision and use of Internet services and online information; as amended by Decree No. 27/2018/ND-CP dated 1 March 2018 and Decree No.150/2018/ND-CP dated 7 November 2018 (“Decree 72”);
- Decree No. 52/2013/ND-CP dated 16 May 2013 of the Government; as amended by Decree No. 08/2018/ND-CP dated 15 January 2018, on amendments to certain Decrees related to business conditions under state management of the Ministry of Industry and Trade and Decree No. 85/2021/ND-CP dated 25 September 2021 (“Decree 52”);
- Decree No. 15/2020/ND-CP of the Government dated 3 February 2020 on penalties for administrative violations against regulations on postal services, telecommunications, radio frequencies, information technology and electronic transactions (“Decree 15”);
- Circular No. 03/2017/TT-BTTTT of the Ministry of Information and Communications dated 24 April 2017 on guidelines for Decree 85 (“Circular 03”);
- Circular No. 20/2017/TT-BTTTT dated 12 September 2017 of the Ministry of Information and Communications, providing for Regulations on coordinating and responding to information security incidents nationwide (“Circular 20”);
- Circular No. 38/2016/TT-BTTTT dated 26 December 2016 of the Ministry of Information and Communications, detailing cross-border provision of public information (“Circular 38”);
- Circular No. 24/2015/TT-BTTTT dated 18 August 2015 of the Ministry of Information and Communications, providing for the management and use of Internet resources, as amended by Circular No. 06/2019/TT-BTTTT dated 19 July 2019 (“Circular 25”); and
- Decision No. 05/2017/QD-TTg of the Prime Minister dated 16 March 2017 on emergency response plans to ensure national cyber-information security (“Decision 05” ).
Applicability of the legal documents will depend on the factual context of each case, e.g businesses in the banking and finance, education, healthcare sectors may be subject to specialized data protection regulations, not to mention to regulations on employees’ personal information as provided in Labour Code 2019 (“Labour Code”).
FPT Corporation Data protection Regulation:
Vietnamese: Chinh sach bao mat du lieu ca nhan (01-CS/TT/HDCV/FPT v1.0) Chính sách bảo mật dữ liệu cá nhân
Vietnamese: Chinh sach bao mat du lieu ca nhan cua can bo nhan vien (02-CS/TT/HDCV/FPT v1.0) Chính sách bảo mật dữ liệu cá nhân của cán bộ nhân viên
