CHAPTER I
GENERAL PROVISIONS

Article 1: Scope of Regulation and Subjects of Application

The Personal Data Protection Regulations of Mobile-ID Technologies and Services Joint Stock Company (hereinafter referred to as Mobile-ID) prescribe the protection of personal data and the personal data protection responsibilities of Mobile-ID and related organizations and individuals.

These Regulations apply to:

• Departments, divisions and units of the Company.
• All employees of the Company.
• Partners, service providers and other organizations and individuals associated with Mobile-ID and involved in personal data processing activities.

Article 2: Definitions

Unless otherwise provided in a particular provision or required by its context, the terms, definitions and abbreviations used in these Regulations shall have the following meanings:

• Mobile-ID means Mobile-ID Technologies and Services Joint Stock Company.
• Law 91/2025 means the Personal Data Protection Law No. 91/2025/QH15, adopted by the National Assembly on June 26, 2025, and effective from January 1, 2026.
• Decree 356/2025 means Government Decree No. 356/2025/NĐ-CP dated December 31, 2025, detailing certain articles of and measures for implementing the Personal Data Protection Law, effective from January 1, 2026. Under Clause 2, Article 42 of Decree No. 356/2025/NĐ-CP, Decree No. 13/2023/NĐ-CP ceased to be effective on January 1, 2026.
• Personal data means digital data or information in another form that identifies or helps identify a specific individual. Personal data includes basic personal data and sensitive personal data as defined under Law No. 91/2025 and Decree No. 356/2025.
• Basic personal data means personal data reflecting common personal and biographical characteristics frequently used in transactions and social relationships, falling within the categories promulgated by the Government. The current categories are specified in Article 3 of Decree No. 356/2025/ND-CP or any document amending, supplementing, or replacing it from time to time.
• Sensitive personal data means personal data associated with an individual's privacy, the infringement of which may directly affect the lawful rights and interests of agencies, organizations, or individuals, falling within the categories promulgated by the Government. The current categories are specified in Article 4 of Decree No. 356/2025/ND-CP or any document amending, supplementing, or replacing it from time to time.
• Personal data subject means the individual to whom the personal data relates.
• Personal data processing means any activity performed on personal data, including one or more activities such as collection, analysis, aggregation, encryption, decryption, modification, deletion, destruction, de-identification, provision, disclosure, transfer of personal data, and other activities affecting personal data.
• Personal Data Controller or Controller means an agency, organization, or individual that determines the purposes and means of personal data processing.
• Personal Data Processor or Processor means an agency, organization, or individual that processes personal data at the request of the Personal Data Controller or Controller and processes personal data under a contract.
• Personal Data Controller and Processor means an agency, organization, or individual that determines the purposes and means of personal data processing and directly carries out such processing.
• Third party means an organization or individual other than the personal data subject, Personal Data Controller, Personal Data Controller and Processor, or Personal Data Processor, that participates in personal data processing in accordance with applicable law.
• Customer means a purchaser of products or services provided by Mobile-ID. Customers include individual customers and organizational customers.
• Individual customer means an individual acting as the purchaser of products or services provided by Mobile-ID.
• Organizational customer means an organization acting as the purchaser of products or services provided by Mobile-ID.

Terms or definitions not explained in these Regulations shall be interpreted in accordance with Article 2 of Law No. 91/2025/QH15, Decree No. 356/2025/ND-CP, and other applicable laws and regulations in force.

In these Regulations, references to other provisions and/or documents shall also include any guidance, amendments, or supplements to the referenced provisions or documents.

Article 3: Principles of Personal Data Protection

Personal data shall be protected and processed in accordance with the principles set out in Article 3 of Law No. 91/2025/QH15, including compliance with the Constitution and the law; collection and processing strictly within specific, clear, and lawful scopes and purposes; ensuring accuracy, up-to-date information, and appropriate retention periods; applying coordinated institutional, technical, and human measures; proactively preventing, detecting, stopping, and addressing violations; and ensuring a balance between personal data protection, national interests, and the lawful rights and interests of agencies, organizations, and individuals.

When processing personal data in the capacity of a Controller or Controller and Processor, Mobile-ID is responsible for complying with, implementing, and demonstrating compliance with personal data protection principles and the responsibilities applicable to each role under Law No. 91/2025/QH15, Decree No. 356/2025/ND-CP, and these Regulations.

Where Mobile-ID appoints a Personal Data Processor, the processing must be governed by a contract or agreement that complies with applicable law. The Processor shall process personal data only within the lawfully established scope, purposes, and requirements, and must fully implement personal data protection measures and demonstrate compliance upon request.

Organizations and individuals cooperating with Mobile-ID and participating in personal data processing, including Third Parties, must comply with the personal data protection principles set out in Article 3 of Law No. 91/2025/QH15 and their corresponding obligations. Mobile-ID shall establish personal data protection responsibilities in relevant contracts, agreements, or cooperation documents.

Article 4: Handling Violations of Personal Data Protection Regulations

Any employee, including part-time employees, or intern who violates personal data protection requirements shall, depending on the nature and severity of the violation, be subject to the following disciplinary or other measures:

• Labor disciplinary measures in accordance with the Internal Labor Regulations.
• Material liability in accordance with labor laws.
• Compensation for direct damages suffered by the affected party.
• Measures imposed by competent authorities in accordance with applicable law.

Organizations and individuals outside Mobile-ID that violate personal data protection requirements shall, depending on the nature and severity of the violation, be subject to the following measures:

• Termination of cooperation, where applicable.
• Compensation for damages suffered by Mobile-ID and/or the affected party.
• Measures imposed by competent authorities in accordance with applicable law.

The measures specified in Clause 1 of this Article may be applied concurrently.

CHAPTER II
MOBILE-ID PERSONAL DATA PROCESSING REGULATIONS

Article 5: Department and Personnel Responsible for Personal Data Protection

The Personal Data Protection Department is the unit responsible for protecting Mobile-ID's personal data. The appointment of the Department and/or personal data protection personnel must be made in an official written document clearly specifying the assignment, functions, duties, powers, and other requirements under Clause 1, Article 13 of Decree No. 356/2025/ND-CP.

The Head of Information Security is responsible for information technology, while the Head of the Personal Data Protection Department is responsible for Mobile-ID's personal data protection activities, as assigned or appointed in writing by the Company. In specific circumstances, the General Director may appoint other personnel or departments, provided that all legal requirements are met.

Personal data protection personnel must hold at least a college degree, have at least two years of work experience after graduation in one of the following fields: legal affairs, information technology, cybersecurity, data security, risk management, compliance control, human resources management, or personnel organization; and have received training in legal knowledge and professional skills relating to personal data protection. If a Personal Data Protection Department is established, all personnel in that Department must meet these requirements.

Mobile-ID is responsible for assessing and selecting personal data protection personnel, signing confidentiality responsibility agreements with appointed personnel, and organizing training to develop their knowledge and skills in personal data protection in accordance with Article 13 of Decree No. 356/2025/ND-CP.

The Department and/or personnel responsible for personal data protection shall act as the focal point for coordination and information exchange with the specialized personal data protection authority under the Ministry of Public Security; perform or coordinate administrative procedures, reports, notifications, and document submissions as required by law. Matters beyond their authority must be promptly reported to the General Director for consideration, decision, or authorization.

The Department and personnel responsible for personal data protection shall fully perform the duties specified in Article 14 of Decree No. 356/2025/ND-CP, including developing policies, processes, regulations, and forms; implementing data subject rights; assessing compliance; preparing and updating impact assessment dossiers; receiving and reporting violations; organizing periodic training; implementing technical measures, standards, technical regulations, and incident response plans; and researching and proposing decisions relating to personal data protection.

Article 6: Types of Personal Data Processed

Mobile-ID processes the following types of personal data, directly or through a Personal Data Processor, in accordance with established purposes and processing scope and the categories specified in Articles 3 and 4 of Decree No. 356/2025/ND-CP:

Basic Personal Data

Basic personal data includes:

• Full name at birth, including surname, middle name, and given name, and other names, if any.
• Date, month, and year of birth; date, month, and year of death or disappearance.
• Gender.
• Place of birth, place of birth registration, permanent residence, temporary residence, current residence, place of origin, and contact address.
• Nationality.
• Images of the individual.
• Telephone number, personal identification number, passport number, driver's license number, and vehicle license plate number.
• Marital status.
• Information about family relationships (parents, children, spouse).
• Information about the individual's digital accounts.
• Other information associated with or helping identify a specific individual, excluding information specified in Clause 2 of this Article.

Sensitive Personal Data

Sensitive personal data includes:

• Data revealing racial or ethnic origin.
• Political opinions, religious beliefs, or faith.
• Information concerning private life, personal secrets, or family secrets.
• Health status.
• Biometric data and genetic characteristics.
• Data revealing an individual's sex life or sexual orientation.
• Data concerning crimes or legal violations collected and stored by law enforcement agencies.
• An individual's location identified through location services.
• Usernames and passwords for an individual's electronic identification account; images of identity cards, citizen identity cards, or identity cards.
• Bank account usernames and passwords; bank card information; bank account transaction history; financial and credit information; and information on customers' financial, securities, and insurance activities and transaction histories held by credit institutions, foreign bank branches, payment intermediary service providers, securities and insurance organizations, and other authorized organizations.
• Data tracking behavior and use of telecommunications services, social networks, online communication services, and other services in cyberspace.
• Other personal data that must be kept confidential or subject to strict security measures under the law.

When processing sensitive personal data, Mobile-ID must establish access restrictions, processing procedures, and security measures under Clause 2, Article 4 of Decree No. 356/2025/ND-CP, and apply additional measures appropriate to the nature, scale, and risks of the processing activities.

Collection Subjects

The personal data collected relates to the following data subjects:

• Individual customers.
• All Mobile-ID employees.
• Partners, contractors, service providers, experts and consultants (including individual partners and individuals affiliated with organizational partners) operating in Mobile-ID's business areas.
• Other personal data subjects, to the extent permitted by law in each specific case.

Article 7: Rights and obligations of data subjects

Mobile-ID ensures the rights of data subjects under Article 4 of Law No. 91/2025/QH15 with respect to personal data controlled or controlled and processed by Mobile-ID, including:

• To be informed about personal data processing activities.
• To consent or refuse consent, and to request withdrawal of consent to personal data processing.
• To access and correct personal data, or request its correction.
• To request the provision, deletion or restriction of processing of personal data, and to object to personal data processing.
• To lodge complaints or denunciations, initiate legal proceedings, and request compensation for damage in accordance with law.
• To request competent authorities or organizations, individuals involved in personal data processing to take measures to protect their personal data in accordance with law.

Data subjects are obliged to protect their own personal data; respect and protect others' personal data; provide complete and accurate personal data as required by law, contract or consent to processing; comply with personal data protection laws; and participate in preventing and combating violations involving personal data.

Mobile-ID establishes clear processes, procedures and forms for exercising data-subject rights under Article 5 of Decree No. 356/2025/ND-CP. Upon receipt of a valid request, Mobile-ID must respond within 02 working days and act within the applicable statutory time limits: 15 days for withdrawal of consent/restriction/objection; 10 days for access, correction or provision; 20 days for deletion; and 15 days for requests to apply protective measures, together with applicable cooperation periods involving processors/third parties and the maximum extensions under Article 5 of Decree No. 356/2025/ND-CP.

The Personal Data Protection Department, as provided for in Article 5 of these Regulations, is Mobile-ID's contact point for receiving, verifying, tracking and resolving requests to exercise data-subject rights.

Article 8: Collection and processing of personal data

Mobile-ID collects and processes personal data, including basic and sensitive personal data, in the following circumstances:

• Collection through declarations or submissions by data subjects and records made by Mobile-ID during negotiations, contract formation and performance, or transactions.
• Collection through declarations by customers (including organizational customers or customers who are not themselves the data subjects) and records made by Mobile-ID when services are requested, risks are assessed, service/sale contracts are negotiated, concluded or performed, or compensation claims are handled.
• Collection on behalf of customers from third parties (e.g. medical facilities or schools) within the scope permitted by law and/or the relevant sales or service agreement.
• Collection of data provided by customers in other circumstances.
• Collection through online environments, including applications, websites and information technology systems owned and operated by Mobile-ID.
• Receipt or transfer of data from other agencies, organizations or individuals to the extent permitted by law and/or with the data subject's consent.

Where the collection and processing described in Clause 1 of this Article is carried out through another individual or organization (e.g. certification authorities (CAs) or walk-in customers using digital-signature services provided by Mobile-ID), Mobile-ID must ensure that the data is collected in compliance with law and that Mobile-ID acts as the Personal Data Controller or Personal Data Controller and Processor.

Mobile-ID's collection and processing of personal data must have an appropriate legal basis. Where based on consent, consent must comply with Article 9 of Law No. 91/2025/QH15 and Article 6 of Decree No. 356/2025/ND-CP: it must be voluntary, clear, specific and verifiable; identify the data types, processing purposes, Controller/Controller and Processor, and the data subject's rights and obligations; be separated by purpose; not treat silence or failure to respond as consent; and not use preselected consent. Mobile-ID must retain evidence of consent. Data subjects must be informed when the data to be processed is sensitive personal data. Processing without consent is permitted only under Clause 1, Article 19 of Law No. 91/2025/QH15, including:

• To protect the life, health, honor, dignity, rights or legitimate interests of the data subject or another person in urgent circumstances; or, where necessary, to protect the legitimate rights and interests of oneself, others, the State, an agency or an organization against infringement. Relevant parties are responsible for proving that these circumstances apply.
• To address an emergency; a threat to national security that has not reached the level of a formally declared emergency; or to prevent and combat riots, terrorism, crime and violations of law.
• To serve the activities of state agencies and state management as prescribed by law.
• To perform an agreement between the data subject and a relevant agency, organization or individual in accordance with law.
• Other cases prescribed by law.

When processing personal data without consent, Mobile-ID must establish a monitoring mechanism under Clause 2, Article 19 of Law No. 91/2025/QH15, including procedures and allocation of responsibilities; appropriate data-protection measures and regular risk assessments; periodic compliance inspections and assessments; and mechanisms for receiving and handling feedback and recommendations.

Article 9: Purposes of personal data processing

Mobile-ID processes personal data only to the extent necessary and for specific, clear and lawful purposes established on an appropriate legal basis under Law No. 91/2025/QH15. Processing purposes include:

• Compiling and assessing information before establishing relationships, agreements, transactions or contracts with data subjects and/or their related parties.
• Exercising customers rights and obligations under service sale contracts; exercising Mobile-ID's rights and obligations toward customers under such contracts or toward third parties under renewal or extension contracts and/or agreements accepted by customers.
• Performing employees and Mobile-ID's rights and obligations under employment contracts.
• Performing Mobile-ID's rights and obligations toward individuals, companies, enterprises and organizations under service sale contracts.
• Compiling statistics and building databases for risk assessment, pricing, fee-schedule development, software product development, technology adoption, policies, strategies, research and application activities. Data must be processed only to the necessary and lawful extent; de-identified or anonymized data should be prioritized where identifying individuals is unnecessary.
• Demonstrating Mobile-ID's capabilities, experience, personnel and resources to third parties where necessary, on an appropriate legal basis and while minimizing disclosure of personal data.
• Describing the scope, scale and nature of work during tenders, bids or service proposals to third parties where necessary, consistent with the purpose and legal basis.
• Updating information, building databases and improving the business operations of software products and technology equipment in accordance with law, without exceeding the established scope and purposes of processing.
• Complying with and demonstrating compliance with applicable legal requirements, including electronic transactions/electronic signatures, taxation, anti-money laundering, data retention, dispute resolution, proceedings and requests from competent state authorities. If a new processing purpose arises, Mobile-ID must determine an appropriate legal basis, fulfil applicable notification/consent obligations and update the impact assessment records as required.

Article 10: Organizations and individuals receiving personal data

Mobile-ID may provide, share or transfer personal data only where permitted by law, particularly under Articles 15, 17 and 19 of Law No. 91/2025/QH15. To the necessary extent and on an appropriate legal basis, recipients may include:

• Competent state authorities or authorities responsible for state management of trust services, electronic transactions/electronic signatures as prescribed by law.
• Authorized representatives of purchasers/users of Mobile-ID digital-signature software, digital-signature devices or other technology products and services.
• Domestic organizations or individuals providing software, equipment, digital-signature services and/or related services under a lawful contract or agreement with Mobile-ID.
• Domestic organizations or individuals providing personal data processing services or participating in data processing under a contract/agreement with Mobile-ID.
• Competent authorities as prescribed by law.
• Other organizations or individuals where there is a valid legal basis and the transfer is consistent with the established purposes and scope of processing.

For transfers falling under points a, c or d of Clause 1, Article 17 of Law No. 91/2025/QH15, Mobile-ID must enter into a transfer agreement with the recipient under Article 7 of Decree No. 356/2025/ND-CP. At a minimum, it must specify the purpose; data subjects and data types; processing period and deletion/destruction requirements; legal basis; data-protection responsibilities; responsibilities for facilitating data-subject rights; and coordination, compliance and violation-handling mechanisms. Transfers of sensitive personal data must use appropriate physical security, encryption, anonymization/de-identification and other necessary safeguards.

For sharing personal data between Mobile-ID departments, the Company must maintain procedures to control sharing and ensure use for the proper purpose, as well as measures to prevent internal personnel from unlawfully sharing personal data with third parties under Article 7 of Decree No. 356/2025/ND-CP.

For cross-border transfers of personal data, Mobile-ID must correctly identify the applicable transfer scenario under Article 20 of Law No. 91/2025/QH15 and Article 17 of Decree No. 356/2025/ND-CP; prepare, retain, submit and update the cross-border transfer impact assessment dossier under Articles 18 and 20 of the Decree within the statutory deadlines, unless an exemption applies.

Article 11: Personal data processing period and expected period for deletion or destruction

Processing begins when Mobile-ID first receives, collects or otherwise starts processing personal data on an appropriate legal basis.

Personal data may be retained only for a period appropriate to the established processing purposes, contractual requirements and statutory retention periods. Mobile-ID must periodically review whether continued retention remains necessary.

Personal data must be deleted or destroyed in the circumstances set out in Article 14 of Law No. 91/2025/QH15, including:

• The data subject makes a valid request and accepts the risks or damage that may result, unless deletion/destruction is prohibited by law.
• The purpose of processing the personal data has been fulfilled.
• The statutory retention period has expired.
• As required by a decision of a competent state authority.
• As agreed by the parties.
• Other cases prescribed by law.

Deletion or destruction must be carried out securely to prevent unauthorized access to or recovery of deleted/destroyed data. Mobile-ID must not intentionally and unlawfully recover deleted or destroyed personal data. If a legitimate legal basis prevents compliance with a deletion/destruction request, the data subject must be notified as required by law.

Article 12: Personal data protection measures

Mobile-ID protects personal data through the following measures:

Administrative measures

• All persons specified in Clause 2, Article 1 of these Regulations must comply with these Personal Data Protection Regulations and relevant laws.
• Ensure that all divisions/departments and employees comply with information-security requirements prescribed by law and/or issued by Mobile-ID from time to time.
• Assign clear responsibilities and authority to the department and personnel in charge of personal data protection, who act as the focal point and bear primary responsibility for implementing administrative safeguards.
• Restrict internal access to and processing of personal data at Mobile-ID. Only personnel and departments with appropriate authority, functions and work-related needs may be granted access to process personal data for which Mobile-ID is the Controller or Controller and Processor.
• Mobile-ID develops its Personal Data Protection Policy based on these Regulations, publishes it publicly and updates it from time to time.
• Establish and maintain the records, logs and evidence necessary to demonstrate compliance in personal data processing; prepare, retain, submit and update personal data processing and cross-border transfer impact assessment dossiers where required by Law No. 91/2025/QH15 and Decree No. 356/2025/ND-CP.
• Establish procedures for receiving, classifying, responding to, recording and reporting personal data protection violations; conduct training, drills or periodic checks appropriate to the risks and scope of personal data processing.

Technical measures

• Physically or logically separate servers for personal data processing from Mobile-ID's business application systems (direct business or online business) to ensure network security, reduce risks and avoid system conflicts.
• Provide dedicated servers for personal data processing; do not use personal computers as servers or share these servers with other entities or companies. Dedicated IT equipment for personal data processing systems must have redundancy.
• Host personal data processing systems in a data center equipped with measures to prevent unlawful access and exploitation, meeting ISO 27001 information-security standards or equivalent standards.
• Mobile-ID's websites and email systems must be authenticated using digital certificates.
• Configure Mobile-ID's personal data processing systems to prevent unauthorized access and apply system access controls between business units with potential conflicts of interest, in accordance with internal control procedures.
• Before deployment, software systems, applications and equipment used to process personal data must undergo security vulnerability scans and documented assessment. Production environments must be separated from testing and development environments. Network information-security risks must be assessed every six (06) months.
• Personal data processing systems must have technical measures to ensure network information security and system data confidentiality.
• Personal data must be protected with appropriate cryptographic measures during storage and transmission, taking account of its nature, sensitivity and risks. Personal data stored in cloud environments must be encrypted at rest and in transit, with strict access controls, under Clause 4, Article 12 of Decree No. 356/2025/ND-CP.
• Where cloud services process personal data, the contract must specify at least compliance with Vietnamese law; contact details of the personal data protection department/personnel; processing flows and each party's role; security, technical and organizational requirements; change notifications; processing and deletion/destruction periods; exercise of data-subject rights; and access controls, under Article 12 of Decree No. 356/2025/ND-CP.
• Where Mobile-ID uses big data, artificial intelligence, blockchain, the metaverse or similar technologies that process personal data, relevant units must comply with the corresponding data-protection requirements in Articles 9, 10 and 11 of Decree No. 356/2025/ND-CP and other relevant laws, following the principles of privacy by design and protection throughout the processing lifecycle.

Information exchange with the specialized personal data protection authority

The Mobile-ID department and personnel responsible for personal data protection under Article 5 of these Regulations must report and exchange information with the specialized personal data protection authority, namely the Department of Cybersecurity and High-Tech Crime Prevention under the Ministry of Public Security.

Where the law requires the Controller or Controller and Processor to take additional measures to protect personal data, Mobile-ID must fully comply.

Article 13: Impact assessments for personal data processing and cross-border transfers, and handling of violations

Impact assessment for personal data processing: Based on its actual role as Controller, Controller and Processor, or Processor, Mobile-ID must prepare, retain, submit and update the dossier under Articles 21 and 22 of Law No. 91/2025/QH15 and Articles 19 and 20 of Decree No. 356/2025/ND-CP, unless exempt by law. The dossier must be prepared from the start of processing, remain available for inspection and include at least the impact assessment report using Form No. 10, data-processing contracts/agreements, and relevant policies, procedures, regulations and forms. The report must describe the parties and data-protection contacts; purposes, data types, activities and data-flow diagrams; consent, retention and deletion/destruction mechanisms; security measures, system design and applicable standards; compliance assessment results; risks, consequences and mitigation measures. Where submission is required, the dossier must be submitted within 60 days from the first day of personal data processing.

Impact assessment for cross-border transfers: When a transfer under Article 20 of Law No. 91/2025/QH15 and Article 17 of Decree No. 356/2025/ND-CP occurs, Mobile-ID must prepare and retain the dossier and submit one original copy to the specialized personal data protection authority within 60 days of the first transfer, unless exempt. The dossier components and procedures are governed by Article 18 of Decree No. 356/2025/ND-CP. The dossier must remain available for inspection and assessment of measures to mitigate or eliminate consequences and damage.

Updating dossiers: Personal data processing and cross-border transfer impact assessment dossiers must be updated every six months after the initial submission when a new processing/transfer purpose arises or participating parties are added or changed. Changes involving reorganization, cessation of operations, dissolution or bankruptcy; information about organizations/individuals providing personal data protection services; or business sectors, occupations or services related to personal data processing must be updated within 10 days. Updates must follow Forms No. 03a/03b and the procedures set out in Article 20 of Decree No. 356/2025/ND-CP.

Handling and reporting violations: If a violation is discovered that may harm national defense, national security, public order or safety, or infringe the life, health, honor, dignity or property of data subjects, Mobile-ID, where subject to the reporting obligation, must notify the specialized personal data protection authority no later than 72 hours after discovery under Article 23 of Law No. 91/2025/QH15; document the incident, contain it, remedy consequences and cooperate in handling it. Notification content and procedures follow Article 28 of Decree No. 356/2025/ND-CP and Form No. 08. A Processor must promptly notify the Controller/Controller and Processor upon discovering a violation. For violations involving location data or biometric data, affected data subjects must be notified within no more than 72 hours, the competent authority must be informed, and violation records must be retained for at least five years after the incident has been remedied, under Article 29 of Decree No. 356/2025/ND-CP.

Impact assessment dossiers received by the specialized personal data protection authority under Decree No. 13/2023/ND-CP before 1 January 2026 may continue to be used under the transitional provisions of Law No. 91/2025/QH15. Updates after the Law takes effect must comply with Law No. 91/2025/QH15 and Decree No. 356/2025/ND-CP.

CHAPTER III
IMPLEMENTATION

Article 14: Responsibilities of the Board of Management

Provide the resources and create favorable conditions for the department and personnel responsible for personal data protection to perform their assigned duties, and direct departments/units to coordinate with the department and personnel responsible for personal data protection in accordance with this Regulation.

Promptly consider and resolve recommendations made by the department and personnel responsible for personal data protection.

Article 15: Responsibilities of the Department and Personnel Responsible for Personal Data Protection

Fully perform the responsibilities prescribed by law, the tasks set out in Article 14 of Decree No. 356/2025/ND-CP, and the tasks assigned under this Regulation.

Disseminate guidance and organize periodic training and capacity-building on legal provisions, internal regulations, and personal data protection skills for departments/divisions/units, employees, and relevant groups, according to a plan appropriate to their roles and the level of risk associated with data processing.

Monitor and assess compliance; recommend that the Board of Management amend this Regulation, policies, procedures, forms, and personal data protection measures; and report and propose solutions for matters beyond their authority.

Article 16: Responsibilities of Departments/Units and Employees

All departments/units and employees are responsible for complying with this Regulation and applicable laws.

Departments/units and employees whose duties involve, or who otherwise perform work related to, personal data processing must carry out their work seriously, honestly, carefully, and in compliance with the relevant requirements.

Departments/units and employees who initiate contact with, or act as the point of contact for, partners, organizations, or individuals outside Mobile-ID must ensure that those partners, organizations, or individuals comply with the personal data protection principles set out in Article 3 of this Regulation.

For partners already engaged with Mobile-ID when this Regulation takes effect, the relevant point of contact is responsible for notifying the partner that Decree No. 356/2025/ND-CP and Mobile-ID's Personal Data Protection Regulation have taken effect, and for ensuring the partner's compliance.

Article 17: Effectiveness

Mobile-ID's Personal Data Protection Regulation takes effect on 2 March 2026.

Mobile-ID's Personal Data Protection Policy is developed and issued together with this Regulation and forms an integral part of it. It is publicly disclosed and updated from time to time on Mobile-ID's website.

Matters relating to personal data protection that are not provided for in this Regulation, or any inconsistency between this Regulation and Law No. 91/2025/QH15, Decree No. 356/2025/ND-CP, or other applicable laws currently in force, shall be governed by the applicable laws.