Personal data protection and cyberinformation security to be strengthened in the education sector

On August 22, 2024, the Minister of Education and Training issued Official Letter 4567/BGDĐT-CNTT on strengthening personal data protection and cyberinformation security in the education sector.

Accordingly, to ensure a thorough understanding and strict implementation of the provisions of Decree 13/2023/NĐ-CP in relevant activities within the sector, the Ministry of Education and Training (MOET) requests that departments of education and training, university systems, academies, universities, and teacher training colleges (hereinafter referred to as units) intensify their review and implementation of the measures set out in Official Letter 4567/BGDĐT-CNTT of 2024, including:

(1) Strengthen efforts to disseminate, communicate, and ensure a thorough understanding of the provisions of Decree 13/2023/NĐ-CP among units and individuals under their management, particularly personnel directly involved in managing, accessing, and processing personal data; provide appropriate legal education, communications, and instruction on personal data protection knowledge and skills for students at schools and higher education institutions.

(2) Review internal rules and regulations on the management, operation, access, and use of information systems/databases (IS/DBs) under the management of each unit and its subordinate units to incorporate current legal provisions on personal data protection. These rules and regulations must clearly define the responsibilities of relevant agencies, organizations, and individuals for protecting personal data, as well as measures to hold organizations and individuals accountable for violations of personal data protection regulations within their areas of responsibility.

Review units and divisions engaged in collecting and processing personal data; classify personal data that have been collected or are being processed; and assess personal data collection and processing procedures to issue or propose appropriate management measures and determine the corresponding protection responsibilities for each type of personal data in accordance with Decree 13/2023/NĐ-CP.

(3) Review measures to ensure system security and safety and implement necessary technical measures for IS/DBs under their management; regularly inspect, maintain, and upgrade systems to promptly detect and address technical vulnerabilities and prevent risks to system security and safety that could lead to personal data disclosure or loss. Units using business service providers to maintain and operate IS/DBs must conduct reviews to ensure the principle that data under a unit’s management must remain under its management and control; businesses must not be allowed to access data (including personal data) without permission from the managing unit.

(4) Regarding the management, access, and use of education sector databases: inform officials, civil servants, public employees, and workers that they must study and implement the provisions of Circular 42/2021/TT-BGDĐT on education and training databases.

Clearly define responsibilities for account protection and cyberinformation security, as well as rules on personal data protection. Pay particular attention to access account management: do not share accounts; set passwords with the necessary complexity (at least 8 characters, including numbers, uppercase letters, lowercase letters, and special characters); and change passwords regularly (at least once every three months).

(5) Upon detecting violations of personal data protection regulations (especially the illegal sale, purchase, or transfer of personal data), take strict action and notify the specialized personal data protection agency (the Department of Cybersecurity and High-Tech Crime Prevention and Control under the Ministry of Public Security) and MOET (through the Department of Information Technology) no later than 72 hours after the violation occurs or is detected, using Form No. 03 in the Appendix issued with Decree 13/2023/NĐ-CP.

MOET requests that heads of units ensure the proper implementation of the guidance set out in Official Letter 4567/BGDĐT-CNTT of 2024.

For more information, see Official Letter 4567/BGDĐT-CNTT, issued on August 22, 2024.

This is an automated translation. If you notice any errors, please contact the Department of Communications, National Economics University at phongtruyenthong@neu.edu.vn.