Responsibilities of a Pharmacy in Cases of Personal Data Disclosure

Pharmacies play a crucial role in community healthcare, and in doing so, they frequently collect and process various types of personal data from their customers. A serious issue that can lead to significant consequences arises when personal data of data subjects is disclosed. This raises the question: What responsibilities do pharmacies have when personal data is exposed?

This article by VDPC analyzes the legal obligations that pharmacies must immediately fulfill upon detecting a data breach, and clarifies the types of sanctions that may be imposed.

Legal basis:

• Article 3, 7, 8, 37 Law on Personal data protection 2025
• Article 46 Decree No. 98/2020/ND-CP as amended and supplemented by Decree No. 24/2025/ND-CP
• Article 4, 38 Decree No. 117/2020/ND-CP

1. The role of pharmacies

A pharmacy may act in one of the following roles

• Personal Data Controlling party (an agency, organization, or individual processing personal data that determines the purposes and means of personal data processing) 
• Personal Data Processing party (an agency, organization, or individual that processes personal data according to the instructions of a Data Controller, or a party that acts as both a Data Controller and Data Processor under a contract)
•  Personal data processing and controlling party (an agency, organization, or individual that determines the purposes, means, and directly processes personal data)

Corresponding to its role, a pharmacy will also have the corresponding responsibilities.

2. Responsibilities of a pharmacy in the role of a Personal Data Controlling party

The responsibilities of the Personal Data Controlling party are as follows:

• Specify the responsibilities, rights, and obligations of the concerned parties to be complied with in agreements or contracts regarding personal data processing, pursuant to regulations
• Decide on the purposes and means of personal data processing in documents and agreements with personal data subject matters, ensuring compliance with the principles and contents 
• Adopt appropriate managerial and technical measures to protect personal data according to the law and review and update such measures if necessary
• Issue notices of violations against personal data protection regulations 
• Select an appropriate personal data processing party to process personal data
• Ensure the rights of personal data subject matters 
•  Assume responsibility before personal data subject matters for any damage arising from personal data processing
• Prevent unauthorized collection of personal data from its system, equipment, and service
• Cooperate with the Ministry of Public Security of Vietnam and competent state authorities in protecting personal data, providing information serving the investigation, and handling violations against personal data protection laws
• Implement other responsibilities pursuant to regulations.

3. Responsibilities of a pharmacy in the role of a Personal Data Processing party

The responsibilities of the Personal Data Processing party are as follows:

• Only receive personal data after concluding an agreement or contract on personal data processing with the personal data controlling party or personal data processing and controlling party
• Process personal data in compliance with the agreement or contract concluded with the personal data controlling party 
• Implement all measures to protect personal data
• Assume responsibility before Personal data controlling party, Personal data processing and controlling party for any damage arising from personal data processing
• Prevent unauthorized collection of personal data from its system, equipment, and service
• Cooperate with the Ministry of Public Security of Vietnam and competent state authorities in protecting personal data, providing information serving the investigation, and handling violations against personal data protection laws
• Implement other responsibilities pursuant to regulations.

4. Responsibilities of a pharmacy in the role of Personal data processing and controlling party  

The responsibilities of the Personal data processing and controlling party:

• Specify the responsibilities, rights, and obligations to be complied with of concerned parties in agreements or contracts concerning personal data processing
• Only receive personal data after concluding an agreement or contract on personal data processing with the personal data controlling party or personal data processing and controlling party
• Decide on the purposes and means of personal data processing in documents and agreements with personal data subject matters, ensuring compliance with the principles and contents
• Adopt appropriate managerial and technical measures to protect personal data and review and update such measures if necessary
• Process personal data in compliance with the agreement or contract concluded with the personal data controlling party 
• Issue notices of violations against personal data protection regulations
• Select an appropriate personal data processing party to process personal data

In addition, there are other responsibilities such as:

• Ensure the rights of personal data subject matters
• Implementing all personal data protection measures as required by law
• Assume responsibility before personal data subject matters for any damage arising from personal data processing
• Assume responsibility before Personal data controlling party, Personal data processing and controlling party  for any damage arising from personal data processing
• Prevent unauthorized collection of personal data from its system, equipment, and service
• Cooperate with the Ministry of Public Security of Vietnam and competent state authorities in protecting personal data, providing information serving the investigation, and handling violations against personal data protection laws
• Implement other responsibilities pursuant to regulations.

5. What responsibilities does a pharmacy bear when the personal information or data of a data subject is disclosed?

Regarding responsibilities, in the event of a personal data breach of a data subject, a pharmacy may be held liable as follows:

1. Pursuant to the Law on Personal Data Protection, the disclosure of personal data constitutes a prohibited act. Accordingly, organizations or individuals committing such violations may be subject to administrative sanctions, with a maximum fine of up to 3 billion VND. With respect to civil liability, violators may also be required to compensate for any damages incurred by the personal data subjects, where applicable.
2. Pursuant to Decree No. 98/2020/NĐ-CP, the act of transferring consumers’ information to a third party without the consumers’ consent may be subject to an administrative fine ranging from 30,000,000 VND to 40,000,000 VND.
3. Pursuant to Decree No. 117/2020/NĐ-CP, the act of disclosing a patient’s medical condition, information provided by the patient, or medical records to the pharmacy  may be subject to a fine ranging from 2,000,000 VND to 6,000,000 VND.
4. Additionally, the disclosure of a data subject’s personal information may affect the pharmacy’s reputation, credibility, revenue, or even its operations if the incident occurs at a serious level.

CONCLUSION

Pharmacies must recognize that processing personal health data constitutes the handling of sensitive personal data, which entails significantly higher legal responsibilities. Investing in secure systems, training staff, and establishing standardized data processing procedures is essential to maintain safe business operations and ensure compliance with legal regulations.

The above outlines the Responsibilities of a Pharmacy in Cases of Personal Data Disclosure. If you have any further questions regarding this matter, please contact VDPC for the most accurate advice and support.

Sincerely !

Zalo: 098.159.5243

The above is a summary and analysis of legal regulations based on the Advisor’s perspective for reference purposes only. This content does not apply to any specific real-world case, and VDPC shall not be held liable for any application by readers based on the aforementioned information without obtaining professional consultation from experts. Readers are kindly requested to contact us for precise advice tailored to your specific case of interest. Sincerely!

See more: