Responsibilities of the Dermatology Specialty Clinic in cases of personal data disclosure

A Dermatology Specialty Clinic is a healthcare facility responsible for storing and processing patients’ personal data, which constitutes sensitive personal data. A personal data disclosure incident occurring at a Dermatology Specialty Clinic not only constitutes a violation of the law but may also result in serious legal and practical consequences. In this context, what responsibilities does a Dermatology Specialty Clinic bear when the personal data of data subjects is disclosed under the latest legal regulations?

In this article, VDPC analyzes the specific legal obligations applicable to the processing and protection of sensitive personal data that Dermatology Specialty Clinics are required to comply with, while also clarifying the corresponding administrative penalties in accordance with the prevailing legal provisions.

Legal basis:

• Article 3, 7, 8, 37 Law on Personal Data Protection 2025
• Article 46 Decree No. 98/2020/ND-CP as amended and supplemented by Decree No. 24/2025/ND-CP
• Article 4, 38 Decree No. 117/2020/ND-CP

1. Responsibilities of the Dermatology Specialty Clinic

A Dermatology Specialty Clinic may act either as a Personal Data Controller (an agency, organization, or individual that determines the purposes and means of personal data processing) or as a Personal Data Controller and Processor (an agency, organization, or individual that determines the purposes and means of processing and directly processes personal data). Correspondingly, the clinic may bear the following responsibilities:

(1) The Personal Data Controlling party bears the following responsibilities:

• Specify the responsibilities, rights, and obligations of the concerned parties to be complied with in agreements or contracts regarding personal data processing, pursuant to regulations
• Decide on the purposes and means of personal data processing in documents and agreements with personal data subject matters, ensuring compliance with the principles and contents 
• Adopt appropriate managerial and technical measures to protect personal data according to the law and review and update such measures if necessary
• Issue notices of violations against personal data protection regulations 
• Select an appropriate personal data processing party to process personal data
• Ensure the rights of personal data subject matters
• Assume responsibility before personal data subject matters for any damage arising from personal data processing
• Prevent unauthorized collection of personal data from its system, equipment, and service
• Cooperate with the Ministry of Public Security of Vietnam and competent state authorities in protecting personal data, providing information serving the investigation, and handling violations against personal data protection laws
• Implement other responsibilities pursuant to regulations.

(2) The Personal Data Controlling and Processing party bears the following responsibilities:

• Specify the responsibilities, rights, and obligations of the concerned parties to be complied with in agreements or contracts regarding personal data processing
• Only receive personal data after concluding an agreement or contract on personal data processing with the personal data controlling party or personal data processing and controlling party
• Decide on the purposes and means of personal data processing in documents and agreements with personal data subject matters, ensuring compliance with the principles and contents
• Adopt appropriate managerial and technical measures to protect personal data and review and update such measures if necessary
• Process personal data in compliance with the agreement or contract concluded with the personal data controlling party 
• Issue notices of violations against personal data protection regulations
• Select an appropriate personal data processing party to process personal data

Additionally, there are other responsibilities, such as:

• Ensure the rights of personal data subject matters
• Adequately implement measures to protect personal data pursuant to regulations
• Assume responsibility before personal data subject matters for any damage arising from personal data processing
• Assume responsibility before the personal data controlling party or personal data processing and controlling party for any damage arising from personal data processing
• Prevent unauthorized collection of personal data from its system, equipment, and service
• Cooperate with the Ministry of Public Security of Vietnam and competent state authorities in protecting personal data, providing information serving the investigation, and handling violations against personal data protection laws
• Implement other responsibilities pursuant to regulations.

2. What responsibilities does a Dermatology Specialty Clinic bear when the personal information and personal data of data subjects are disclosed?

What responsibilities does a Dermatology Specialty Clinic bear when the personal information and personal data of data subjects are disclosed?

1. Pursuant to the Law on Personal Data Protection disclosure of personal data constitutes a prohibited act. Accordingly, organizations or individuals committing such violations may be subject to administrative sanctions, with a maximum fine of up to 3 billion VND. With respect to civil liability, violators may also be required to compensate for any damages incurred by the personal data subjects, where applicable.
2. Pursuant to Decree No. 98/2020/NĐ-CP, the act of transferring consumers’ information to a third party without the consumers’ consent may be subject to an administrative fine ranging from 30,000,000 VND to 40,000,000 VND.
3. Pursuant to Decree No. 117/2020/NĐ-CP, the act of disclosing a patient’s medical condition, information provided by the patient, or medical records held by a Dermatology Specialty Clinic may be subject to a fine ranging from 2,000,000 VND to 6,000,000 VND.
4. In addition, the disclosure of personal data may adversely affect the honor, reputation, revenue, or even the operation activities of Dermatology Specialty Clinic, particularly where the incident occurs on a serious scale.

CONCLUSION

A Dermatology Specialty Clinic bears a very high level of legal responsibility in safeguarding sensitive personal data. Ensuring the security of medical information is a critical requirement, which obliges healthcare institutions to regularly review their information security systems and provide staff training in accordance with strict standards prescribed by law.

The above constitutes an overview of the Responsibilities of the Dermatology Specialty Clinic in cases of personal data disclosure. Should you have any further questions relating to this matter, please contact VDPC for accurate and professional legal advice and support.

Sincerely!

Zalo: 098.159.5243

The above is a summary and analysis of legal regulations based on the Advisor’s perspective for reference purposes only. This content does not apply to any specific real-world case, and VDPC shall not be held liable for any application by readers based on the aforementioned information without obtaining professional consultation from experts. Readers are kindly requested to contact us for precise advice tailored to your specific case of interest. Sincerely!

See more: