Responsibilities of a Cosmetic Hospital in Cases of Personal Data Disclosure

Cosmetic hospitals are healthcare facilities responsible for storing and processing patients’ sensitive personal data. The disclosure of personal data at a cosmetic hospital not only constitutes a violation of the law but may also result in serious legal and practical consequences. In this context, what responsibilities do cosmetic hospitals bear when the personal data of data subjects is disclosed under the latest regulations?

This article by VDPC analyzes the specific legal obligations relating to sensitive personal data that cosmetic hospitals are required to comply with, while also clarifying the applicable administrative penalties in accordance with the law.

Căn cứ pháp lý:

Article 3, 7, 8, 37Law on Personal data protection 2025
Article 46 Decree No. 98/2020/NĐ-CP as amended and supplemented by Decree No. 24/2025/ND-CP
Article 4, 38 Decree No. 117/2020/ND-CP

1. Responsibilities of a Cosmetic Hospital

A cosmetic hospital may act either as a Personal Data Controlling party (an agency, organization, or individual that determines the purposes and means of personal data processing) or as a Personal Data Controlling and Processing party (agency, organization, or individual that determines the purposes and means of processing and directly processes personal data). Accordingly, the hospital may bear the following responsibilities:

(1) The responsibilities of the Personal Data Controlling party are as follows:

Specify the responsibilities, rights, and obligations of the concerned parties to be complied with in agreements or contracts regarding personal data processing, pursuant to regulations
Decide on the purposes and means of personal data processing in documents and agreements with personal data subject matters, ensuring compliance with the principles and contents
Adopt appropriate managerial and technical measures to protect personal data according to the law and review and update such measures if necessary
Issue notices of violations against personal data protection regulations
Select an appropriate personal data processing party to process personal data
Ensure the rights of personal data subject matters
Assume responsibility before personal data subject matters for any damage arising from personal data processing
Prevent unauthorized collection of personal data from its system, equipment, and service
Cooperate with the Ministry of Public Security of Vietnam and competent state authorities in protecting personal data, providing information serving the investigation, and handling violations against personal data protection laws
Implement other responsibilities pursuant to regulations.

(2) The responsibilities of the personal data processing party:

Specify the responsibilities, rights, and obligations to be complied with of concerned parties in agreements or contracts concerning personal data processing
Only receive personal data after concluding an agreement or contract on personal data processing with the personal data controlling party or personal data processing and controlling party
Decide on the purposes and means of personal data processing in documents and agreements with personal data subject matters, ensuring compliance with the principles and contents
Adopt appropriate managerial and technical measures to protect personal data according to the law and review and update such measures if necessary
Process personal data in compliance with the agreement or contract concluded with the personal data controlling party
Issue notices of violations against personal data protection regulations
Select an appropriate personal data processing party to process personal data

In addition, there are other responsibilities such as:

Ensure the rights of personal data subject matters
Implementing all personal data protection measures as required by law
Assume responsibility before personal data subject matters for any damage arising from personal data processing
Assume responsibility before Personal data controlling party, Personal data processing and controlling party for any damage arising from personal data processing
Prevent unauthorized collection of personal data from its system, equipment, and service
Cooperate with the Ministry of Public Security of Vietnam and competent state authorities in protecting personal data, providing information serving the investigation, and handling violations against personal data protection laws
Implement other responsibilities pursuant to regulations.

2. What responsibilities does a cosmetic hospital bear in cases of personal data disclosure?

Regarding responsibilities, in the event of personal data disclosure of a data subject, A Cosmetic Hospital may be liable as follows:

Under the provisions of the Law on Personal Data Protection, such conduct is strictly prohibited, organizations or individuals that commit violations may face administrative fines of up to 3 billion VND. In terms of civil liability, they may also be required to compensate for any damages caused to the data subject.
Pursuant to Decree No. 98/2020/ND-CP, the act of transferring consumers’ information to a third party without the consumers’ consent may be subject to administrative fines ranging from 30 million VND to 40 million VND.
Pursuant to Decree No. 117/2020/ND-CP, the disclosure of a patient’s medical condition, information provided by the patient, or medical records held by a cosmetic hospital may result in administrative fines ranging from 2 million VND to 6 million VND.
In addition, personal data disclosure incidents may adversely affect a cosmetic hospital’s reputation, credibility, revenue, and even its operational activities, particularly where the violation occurs on a serious scale.

CONCLUSION

Cosmetic hospitals bear a high level of legal responsibility for safeguarding sensitive personal data. Ensuring the security of medical information is a critical requirement, which obliges such hospitals to regularly review their information security systems and provide staff training in accordance with strict legal standards.

The above outlines Responsibilities of a Cosmetic Hospital in Cases of Personal Data Disclosure. If you have any further questions on this matter, please contact VDPC for the most accurate advice and support

Sincerely !

Zalo: 090.225.5492

The above is a summary and analysis of legal regulations based on the Advisor’s perspective for reference purposes only. This content does not apply to any specific real-world case, and VDPC shall not be held liable for any application by readers based on the aforementioned information without obtaining professional consultation from experts. Readers are kindly requested to contact us for precise advice tailored to your specific case of interest. Sincerely!

See more: