Vietnam Data Protection Impact Assessment (DPIA) Services

Vietnam DPIA support for foreign-invested and international businesses

A Vietnam personal data processing impact assessment dossier documents how an organisation processes personal data, the risks involved and the measures used to address them. For a foreign-invested enterprise, the practical challenge is often connecting local HR, sales and operational activities with systems and decisions managed at regional or global level.

Justix Law Firm provides Vietnam legal support for assessing the obligation, preparing the dossier and supporting submission within an agreed engagement. The starting point is the company’s actual processing activities: who decides the purposes, which systems are involved, where data goes and which safeguards can be supported by evidence.

On this page, “DPIA” is used as convenient English shorthand for Vietnam’s personal data processing impact assessment dossier. The terminology should not be taken to mean that a GDPR assessment and a Vietnam dossier have identical scope, thresholds or filing requirements.

Where FDI businesses need a more detailed review

Employee data in regional HR and payroll systems

A Vietnam subsidiary may collect recruitment documents, payroll information, attendance records and benefits information while a regional team administers the HR platform. The assessment should establish who determines each purpose, which entities access the records, what information leaves the local system and how retention and deletion work. A group policy alone may not explain these local arrangements.

Customer data shared through CRM, marketing and support tools

Sales, customer support and marketing teams may use the same database for different purposes. The relevant questions include which data was collected for a transaction, how additional uses are communicated, what choices are recorded and which providers receive the information. These questions help identify the documents and operating practices that need to be reflected in the dossier.

Manufacturing sites, access control and local suppliers

Factories and offices may process information through visitor registration, access controls, CCTV, recruitment providers and outsourced payroll. The project should identify the actual systems and categories of data rather than limit the inventory to the corporate website. Technical teams should confirm system capabilities; the dossier should not describe a control as implemented merely because it appears in a template.

Overseas headquarters, cloud hosting and remote support

Map storage, backups, remote access and onward sharing across the group and vendor chain. This information supports the processing assessment and helps determine whether a separate cross-border transfer review is needed. The two workstreams should be coordinated, with their deliverables and fees stated separately where applicable.

These are illustrative business scenarios, not descriptions of identified Justix clients or claims about completed projects.

What a useful assessment project should resolve

Before drafting, the business needs an agreed assessment perimeter: the legal entity, activities and systems covered, the responsible internal contacts and the documents available. If several Vietnam entities use one group platform, their respective roles and responsibilities should be examined rather than assuming one document automatically covers the entire group.

• Processing roles: distinguish the purposes determined by the local business from processing carried out for another organisation. Review the allocation of responsibilities in contracts against actual practice.
• Evidence: connect statements about consent, retention, deletion and access control with the notices, records, contracts and technical information supplied.
• Risk: explain plausible effects on individuals and the measures used to reduce them. Record gaps and proposed improvements without presenting them as completed safeguards.
• Responsibility: identify which issues require a decision by management, legal, HR or IT, and which information must come from a vendor or headquarters.

How Justix approaches the work

Justix starts with the documents and operational facts needed to determine the assignment. Our service combines legal review, structured information collection and preparation of the agreed dossier. For complex software environments, technical input may be coordinated with the company’s IT team and, where included in the project, a technology adviser.

The proposal defines the deliverables, assumptions and responsibilities before work begins. This matters where a company needs both a filing dossier and wider remediation of its privacy notices, contracts or internal procedures: those tasks should be identified explicitly instead of being left as an open-ended promise.

The company remains responsible for confirming the accuracy of its operations and implementing measures assigned to it. Legal review does not replace a technical security audit or penetration test. Justix’s commitment is to the agreed professional work, clear reporting of gaps and defined support; regulatory acceptance is not guaranteed.

Using global privacy documents for a Vietnam project

Share existing group assessments, policies and processing agreements at the scoping stage. They can provide a useful starting point for identifying systems, recipients and responsibilities. The review then asks what applies to the Vietnam entity, what differs in local operations and what evidence or documentation remains missing.

Confirm the language of working documents, final filing materials and any management summary in the proposal. An English service page does not make translation, certification or a separate bilingual deliverable automatically part of the fee. This keeps procurement expectations aligned with the work commissioned.

Budget, schedule and scope boundaries

The published reference fee is VND 30–45 million, subject to scope and document readiness. The reference engagement includes dossier preparation, filing support, follow-up on receipt and one round of clarification or supplementation within the agreed scope.

The indicative preparation period is 15–30 days. The proposal confirms how this period is counted, the start conditions and draft/revision milestones. Time spent awaiting company information and the authority’s review should be addressed separately; the preparation estimate is not a promise of regulatory acceptance within that period.

Additional entities or dossiers, a separate cross-border transfer assessment, extensive policy or contract drafting, translation work and later changes should be scoped expressly. Tax treatment and any third-party costs should also be confirmed in the written quote.

Legal framework and ongoing maintenance

The core sources for this service are Vietnam’s Law on Personal Data Protection No. 91/2025/QH15 and Decree No. 356/2025/ND-CP, effective from 1 January 2026. Article 19 of the Decree addresses the processing impact assessment dossier; Article 20 concerns updates; Article 41 sets out conditional arrangements for specified business categories.

Under Article 42, Decree 356 replaces Decree 13/2023/ND-CP. A project based on earlier documentation therefore needs a review of the current framework and the treatment of any previous submission, rather than simply changing the date on an old template.

After handover, designate an internal owner to track changes in purposes, parties, systems and business activities and obtain advice on whether an update is required. Retaining a copy of the dossier is only part of that process. This page provides general service information; the applicable obligations depend on the facts and law relevant to the engagement.

Discuss your Vietnam DPIA requirements with Justix

For an initial scope discussion, email legal@justix.vn with your Vietnam entity’s business activities, the main types of personal data processed, relevant systems and overseas arrangements, any existing dossier, and your intended project timeline. You can also call +84 372 717 888 or +84 878 853 686.

A high-level description is enough to begin. Please do not send employee identity documents, customer databases, passwords or other sensitive records with the initial enquiry. Justix can first clarify the information needed, the appropriate scope and how further documents should be provided.