Practitioners from Tilleke & Gibbins’ Vietnam offices contributed content for the latest edition of the Practical Law Life Sciences Global Guide. The guide provides a comparative overview, in Q&A format, of laws and regulations on pharmaceuticals, medical devices, and other life sciences products in dozens of jurisdictions around the world. The Life Sciences Global Guide is divided into two sections: Commercialization (see more details here) and Regulation, which covers the following topics: Pharmaceuticals: Laws and regulatory authorities Clinical trials: Legal, regulatory, and procedural requirements Manufacturing and distribution Marketing: Authorization for marketing medicinal products, monitoring compliance and penalties, pharmacovigilance and other commitments, foreign marketing authorizations Data privacy Packaging, labeling, and tracking Biological medicines Medical devices: Legislation and regulatory authorities, definition and classification Healthcare IT Combination products and borderlines Natural health products Recent developments and reform proposals Practical Law, produced by Thomson Reuters, is the world’s leading legal know-how resource for business lawyers, publishing a huge range of guides covering hundreds of jurisdictions and practice areas. The full “Life Sciences Regulation in Vietnam” section can be found on the Practical Law website.

Vietnam’s Ministry of Information and Communications (MIC) organized a workshop with industry representatives on June 19, 2023, to discuss its future policy direction for over-the-top (OTT) telecom services and internet data center (IDC) and cloud computing services. OTT telecom services, in the MIC’s interpretation, are communication services such as text messages or voice calls provided over the internet—for example, the services of Zalo, WhatsApp, WeChat, etc. The workshop, the first in an expected series, focused only on the discussion of policy on how to regulate these services. Light-Touch Management Approach A very positive signal of the MIC in the workshop was its clear intention to apply a “light-touch” approach to management. For cross-border provision of OTT telecom services and IDC/cloud computing services, the MIC intends to require notification and a post-check mechanism, instead of a heavy licensing or commercial arrangement regime like the one applicable to traditional telecom services. In addition, there is no limitation on foreign investment if foreigners would like to provide these services in Vietnam. With regard to domestic service providers, the MIC proposes a registration regime with a similar post-check mechanism. The MIC’s reason for registration instead of notification is because the provision of these services by domestic companies may involve setting up data center/cloud systems which require consideration of various issues including location, electricity sources, and connection with telecom infrastructure such as marine cable. However, the MIC is also hoping to make the registration process as light as possible for enterprises (for example, using online registration) to provide a favorable environment and conditions to facilitate development of the industry without obstacles or cumbersome administrative procedures for companies’ operations. For providers of these services, the MIC is also considering an exemption from the responsibility to pay fees for telecommunications activities rights, and from payment to

Thailand is not a signatory to the Cape Town Convention. This means that upon an airline-lessee’s default, a lessor cannot present an Irrevocable Deregistration and Export Authorization (IDERA) document to easily repossess an aircraft. However, Thai law does allow for lessors to obtain aircraft deregisteration without the need to go to court. Pursuant to Clause 12 of the Civil Aviation Authority of Thailand (CAAT) Regulation No. 23 (Reg. 23), the Director General of CAAT has the authority to deregister an aircraft when the possessory right to the aircraft under a lease agreement has expired for any of the following reasons: The lease agreement has expired due to the lease term; The lease agreement has been terminated by either the lessor or the lessee in accordance with its termination clause; The lessor and lessee agree to terminate the lease agreement; The lessor notifies the termination of the lease agreement and submits an irrevocable deregistration power of attorney together with an application requesting the exportation of the aircraft, and the lessor or its agent submits an application for deregistration of the aircraft to the Director General. Under Reg. 23, a lessor can submit a deregistration application to CAAT asking CAAT to deregister. The deregistration application consists of evidence of the lease termination, a deregistration power of attorney (DPOA), the applicant’s certificate of incorporation, and the aircraft’s certificate of airworthiness and Certificate of Registration. CAAT will review the application and ask the lessee if it consents to the deregistration. If the lessee does not consent, CAAT may invite the lessor and lessee to one or more administrative hearings to give evidence on the dispute. If CAAT concludes that the lease has been validly terminated and the lessee no longer has possessory rights, CAAT will deregister the aircraft. Under Thai law, a lessor

At a conference organized by Vietnam’s Ministry of Public Security (MPS) on June 7, 2023, government officials provided more guidance on the recently issued Personal Data Protection Decree (PDPD), which is set to take effect on July 1, 2023. Key takeaways included the following: A national portal on personal data protection for online submission of notifications and registrations will be launched before July 1, 2023. The MPS also plans to issue templates for data processing impact assessments (DPIAs) and transfer impact assessments (TIAs) in the near future. The PDPD requires data controllers, data processors, and data controller-processors to prepare a DPIA at the start of personal data processing. The MPS clarified that the DPIA is expected to be prepared and submitted once. Only changes to its content would require submission of an updated DPIA. Both DPIAs and TIAs (which are for cross-border data transfers) must be prepared in Vietnamese. Since the sale and purchase of personal data is strictly prohibited unless explicitly permitted by law, the MPS has handled approximately 14 cases involving unlawful trading of personal data, including sensitive data. Under the PDPD, sensitive data has a broader definition than under the GDPR (the European Union’s General Data Protection Regulation), and also includes location data, creditworthiness, and personal financial data. Consent is not a legal basis for the trading of personal data, including sensitive data. The 72-hour timeline for responding to a data subject’s request does not mean 72 working or business hours. Rather, it means 72 actual consecutive hours. Any organization transferring the personal data of Vietnamese citizens outside of Vietnam must comply with the PDPD, regardless of the organization’s location. For organizations incorporated overseas that must comply with the PDPD, there is no requirement to appoint a local representative (unlike the GDPR)—but appointment of a data