After a protracted period of deliberation, the Vietnamese government ultimately passed the country’s “historic,” first-ever Personal Data Protection Decree (“PDPD”) on April 17, 2023, as Decree No. 13/2023/ND-CP. The PDPD is a landmark legal instrument that integrates all of Vietnam’s disparate data protection legislation, with the potential to bring them closer to the EU’s General Data Protection Regulation (“GDPR”) requirements. (The PDPD, however, will not replace these existing regulations but will concurrently exist with them.) Scheduled to take effect on July 1, 2023, with basically no grace period (save in limited cases), the PDPD will apply to both domestic and foreign individuals/entities that directly engage in or relate to personal data processing activities in Vietnam. As the PDPD continues to be a magnet for public attention, we take a closer look at its key provisions and some initial implications for businesses below. 1. Definition and Classification of Personal Data The PDPD defines personal data as information on an electronic medium in the form of symbols, letters, numbers, photos, sounds, or the like that is associated with or helps to identify a specific individual. Information that helps to identify a specific individual is further clarified as information generated from an individual’s activities that, when combined with other data and stored information, can identify a particular person. Personal data is split into two different categories—basic personal data and sensitive personal data. Basic personal data includes name, date of birth, gender, nationality, personal photos, phone number, identification number, marriage status, history of one’s cyberspace activities, and so on. Sensitive personal data, on the other hand, is more private and, if violated, will jeopardize a person’s legitimate rights and interests. Accordingly, sensitive personal data comprises, among other things, political and religious views, health status and private life information as recorded in medical records,

On April 17, 2023, the Vietnamese government issued Decree No. 13/2023/ND on the Protection of Personal Data (“PDPD”), following extensive public consultations and multiple rounds of review since the first release of its draft version in February 2021. This is a long-awaited legal instrument which is designed to be the very first comprehensive regulation on the protection of personal data in Vietnam. The PDPD is set to take effect on July 1, 2023, without any transitional period. All Vietnamese and foreign organizations and individuals located in Vietnam and/or directly participating in or related to personal data processing activities in Vietnam must comply with the PDPD. As expected, the PDPD sets out significantly new requirements on the processing of personal data. The most critical provisions include: Eight principles for the processing of personal data: (i) lawfulness, (ii) transparency, (iii) purpose limitation, (iv) data minimization, (v) accuracy, (vi) integrity, confidentiality, and security, (iv) storage limitation, and (viii) accountability (Article 3). Critical new definitions and concepts, notably including personal data (Article 2.1); basic personal data (Article 2.3); sensitive data (Article 2.4); data subject (Article 2.6); data controller (Article 2.9); data processor (Article 2.10); parties controlling and processing personal data (Article 2.11); third parties (Article 2.12); and cross-border transfer of personal data (Article 2.14). Eleven data subject rights, including the right to know; right to consent; right to access; right to withdraw consent; right to delete data; right to restrict data processing; right to request the provision of data; right to object to data processing; right to complain, denounce and initiate lawsuits; right to claim compensation for damage; and right to self-defense (Article 9). Specific responsibilities of data controllers (Article 38), data processors (Article 39) and third parties (Article 41). Specific requirements in the exercise of data subject rights (Articles 14-16). Rules on

Since the issuance last October of Decree No. 71/2022/ND-CP (“Decree 71”), the differentiation of film vs. non-film content has become increasingly important for pay-TV service providers in Vietnam, because they are subject to completely different licensing requirements. With the effectiveness of Decree 71 on January 1, 2023, overseas providers of over-the-top (OTT) pay-TV services, including video on demand (VOD) content, to Vietnamese users are subject to licensing requirements and the establishment of a local presence in Vietnam. Meanwhile, the new Cinema Law promulgated on June 15, 2022, and its guiding Decree No. 131/2022/ND-CP dated December 31, 2022—both of which also took effect on January 1, 2023—do not impose any licensing requirements on film disseminators. Although there are ambiguities in Decree 71’s wording, the Ministry of Information and Communication (MIC) and the Authority for Broadcasting and Electronic Information (ABEI) under the MIC have confirmed orally in a closed industry meeting, without written confirmation, that for VOD film-only content, OTT pay-TV service providers are exempted from the licensing requirements of Decree 71 and are instead subject to regulations of the Cinema Law. This is why film vs. non-film content has become critical in shaping the business models of overseas pay-TV service providers. In this article, we provide an overview of the current regulations and draft regulations with regard to the classification/rating of film content under the regulations of the Cinema Law and its sub-laws, and the classification/rating of non-film content under the regulations of Decree 71.   Film Classification/Rating Under the Cinema Law, “films” are defined to include feature films, documentaries, cartoons, and films of combined genres. The law explicitly provides that “films” do not include recorded products for disseminating news, art shows, video games, recorded products that show the activities of one or more people and describe events and situations,

Digital asset litigation is one of the most cutting-edge types of litigation in Thailand. There are factual, technical, regulatory, and legal challenges and hurdles for the parties to the dispute throughout all procedural stages. This is mainly because digital assets are different in nature from more conventional types of assets, as they are digitally created and used on a blockchain network. Legal Status The first issue to be aware of in approaching digital asset litigation is the legal status of digital assets. Under Thai law, there are two key terms concerning digital assets’ legal status: “thing” and “property.” Things are tangible objects, while property provides a much wider range of meaning. Property could be anything—including intangible objects that may be of value and able to be appropriated. It is fairly clear that digital assets are not a “thing” since they are not tangible. However, determining whether digital assets are “property” is even more complicated. Although digital assets are intangible objects, one might argue that, unlike fiat money, they do not have any inherent value but are rather conferred value based on certain people’s perspective. (For example, the Bank of Thailand expressed this opinion of bitcoin in 2014.) Some may even argue that digital assets cannot be possessed and therefore cannot be appropriated. According to these arguments, digital assets should not be regarded as a property either. Legal Grounds Determining whether digital assets are things, property, or something else altogether is crucial to any subsequent litigation. In Thailand, the party initiating the lawsuit (the plaintiff) generally has to state the relevant legal grounds for the complaint—that is, the different relevant legal provisions that the court is to apply to the case. These provisions of Thai laws mostly refer only to “things” or to “property,” not both. This often means that