Lawyer
Trần Việt Tùng
Managing Partner
Civil & Corporate
10 years of experience
Personal Data Protection
Vietnam Data Protection Impact Assessment (DPIA) Services
Companies processing personal data in Vietnam should determine whether they must prepare, retain and submit a personal data processing impact assessment dossier. For covered entities, the law provides a 60-day filing period, subject to role-specific rules and exceptions. Justix assesses the processing activities, prepares the prescribed Form No. 10 report, reviews supporting documents and assists with filing under an agreed scope.
Who this service is for
- Foreign-invested enterprises operating in Vietnam, including manufacturers, trading companies and service businesses that process employee, customer or supplier-contact data.
- Vietnam subsidiaries of multinational groups using regional HR, payroll, CRM, ERP or cloud systems and needing to coordinate local compliance with overseas headquarters.
- Software, SaaS, e-commerce and digital-service businesses that need to distinguish their own processing activities from activities performed for customers.
- In-house legal, privacy, compliance, HR and IT teams preparing a first Vietnam assessment or reviewing an existing dossier after operational changes.
Common problems we solve
Unclear filing obligations across group entities
The local entity, parent company and service providers perform different functions. The business has not established which entity controls the purposes and means of processing or qualifies for an exception.
No reliable map of the data being processed
Customer databases, HR tools, cloud applications and marketing platforms operate separately. Teams cannot yet trace data categories, recipients, storage and access permissions.
Contracts and privacy notices do not match operations
Vendor contracts allocate responsibilities incompletely, while consent and retention disclosures may not reflect actual collection, use and deletion practices.
Risk assessment lacks operational evidence
Legal teams need input from IT about security controls, access logs, backups, deletion and incident response, but the information is dispersed or incomplete.
Sensitive data and processing scale complicate exemptions
A group entity may appear small but its activities or cumulative number of affected individuals can prevent reliance on statutory exceptions.
An earlier dossier no longer reflects the business
New platforms, processing purposes or service providers have been introduced. The company needs to assess whether an update is required and within which period.
What Justix does for you
- 01
Assess the relevant Vietnam entity, processing roles and applicable dossier obligations before recommending the scope of work; examine any claimed exemption against the actual circumstances.
- 02
Map the processing activities covered by the engagement: data categories, individuals concerned, purposes, systems, recipients, retention practices and access by group companies or vendors.
- 03
Review the available privacy notices, consent records, processing agreements, internal policies and technical descriptions; identify inconsistencies between the documents and actual operations.
- 04
Prepare the impact assessment report and supporting dossier within the agreed scope, including processing descriptions, data flows, risk analysis and documented safeguards. Separate existing controls from improvements still to be implemented.
- 05
Support execution and submission, track receipt and assist with one round of clarification or supplementation within the agreed dossier scope. Assess cross-border transfer work separately where relevant.
What you receive
- One Vietnam personal data processing impact assessment dossier covering the entity and activities specified in the engagement, with the report and agreed supporting documents.
- A documented account of processing activities, data flows, relevant parties and risks, grounded in information confirmed by the business and its technical team.
- A checklist of documents to sign, retain or complete, identifying missing information and operational matters that require action by the company.
- Filing support and a record of receipt where available through the submission method used. Receipt is distinguished from the authority’s substantive assessment of the dossier.
- Assistance with one round of clarification or supplementation within scope, together with the final file for the company’s records. Later updates or additional requests are scoped separately.
Team in charge
Tiến sĩ Luật
Trần Thúy Hằng
Legal Adviser
International Trade
25 years of experience
LL.M.
Nguyễn Phúc Mạnh
Head of Corporate Legal Affairs & Contracts
Corporate legal affairs, contracts and employment law
10 years of experience
Jurist
Trần Thanh Nhàn
Head of Corporate Legal Department – Licensing and Administrative Procedures
Intellectual Property & Corporate
9 years of experience
Kỹ sư công nghệ
Trần Văn Tùng
Cố vấn kỹ thuật về bảo vệ dữ liệu cá nhân
Công nghệ thông tin & bảo vệ Dữ liệu cá nhân
10 years of experience
How it works
- 1
Confirm the entity, obligations and scope
Review the initial information, identify the relevant processing roles and discuss the assessment perimeter. Agree the deliverables, timetable, responsibilities and fee before substantive preparation begins.
- 2
Collect information from local teams and headquarters
Use a document checklist to gather input from legal, HR, operations and IT. Identify who can confirm group systems, vendor arrangements and cross-border access, and record outstanding questions.
- 3
Prepare the assessment and identify gaps
Draft the report and assemble the supporting documents. Explain material inconsistencies, missing evidence and measures requiring implementation; the company reviews and confirms factual accuracy.
- 4
Finalise and support submission
Resolve agreed comments, prepare the execution set and support submission under the engagement. Confirm the applicable filing format and any translation requirements before finalisation.
- 5
Follow up and hand over the working file
Track receipt, assist with one round of clarification or supplementation within scope and provide the dossier for retention. Explain which operational changes should trigger a review of update obligations.
What you need to prepare
- Entity information, business activities, responsible contacts and any existing appointment of personnel or a department responsible for personal data protection.
- An inventory of relevant processing activities: data categories, employee/customer/user groups, purposes, commencement dates and the parties involved.
- System and data-flow descriptions from IT, including storage and backup locations, access permissions, security controls, overseas support and relevant service providers.
- Existing privacy notices, consent mechanisms, retention/deletion procedures, data-subject request procedures and agreements with group companies, processors and vendors.
- Any previous Vietnam assessment dossiers, submission records and authority correspondence. Group privacy assessments may be useful background but need a local applicability review.
Timeline
Indicative preparation period: 15–30 days; the project schedule is confirmed in the proposal.
The agreed schedule specifies the information required, start date, draft delivery and revision milestones. Timing depends on the processing scope and document readiness. Authority review and requests for additional information are separate from Justix’s preparation schedule; a completion or acceptance date is not guaranteed.
Fees
Indicative fee: VND 30–120 million, subject to the entity, processing scope and available documents. The reference scope includes dossier preparation, filing support, receipt follow-up and one round of clarification or supplementation. Additional dossiers, a cross-border transfer assessment, extensive policy or contract remediation, later updates and further authority requests are quoted separately where required. The proposal confirms tax treatment, translation requirements and any third-party costs before engagement.
How our fees workBusinesses processing personal data in Vietnam should identify their legal role and determine whether they must prepare, retain and submit a processing impact assessment dossier. Article 21 of Vietnam’s Personal Data Protection Law (Law No. 91/2025/QH15) and Article 19 of Decree No. 356/2025/ND-CP establish the core requirements, including a 60-day submission period for covered entities and conditional exceptions.
Justix examines actual processing operations, maps data flows, prepares the prescribed Form No. 10 report, reviews supporting contracts and policies, and assists with submission within the agreed scope. Its published indicative fee is VND 30–45 million; initial drafting is estimated at 15–30 days after receiving sufficient information.
Who needs a processing impact assessment in Vietnam?
Vietnamese law differentiates between a personal data controller, a controller-processor and a processor. An international group should determine which legal entity sets the purposes and means of processing, which entity operates systems, and whether service providers process data under written instructions.
Article 21 of Law No. 91/2025/QH15 contains role-specific obligations. Article 19 of Decree 356/2025/ND-CP addresses dossier content, retention and submission. Article 41 provides conditional mechanisms for qualifying smaller businesses. A general conclusion that every small company is exempt, or that every vendor has identical filing duties, would be unreliable.
What must the assessment dossier contain?
Article 19 of Decree 356/2025/ND-CP requires a report in Form No. 10, relevant personal data processing contracts or arrangements, and supporting privacy policies, internal procedures and related records.
The report should describe each processing purpose, data category, group of affected individuals, participating entity, processing activity and data flow. It should also explain consent where applicable, retention and deletion practices, security safeguards, compliance findings, foreseeable adverse impacts and mitigation measures.
IT, security and operations teams must verify the actual controls and architecture. A law firm should not describe a proposed access control, encryption practice or deletion procedure as already implemented unless the company confirms it and provides appropriate evidence.
When should a dossier be submitted and updated?
For entities subject to submission, the law provides a 60-day period from the first day of personal data processing. Relevant documents must also be maintained so they can be made available for regulatory inspection. This statutory deadline is separate from the time a service provider needs to assess and draft the dossier.
Article 20 of Decree 356/2025/ND-CP requires updates for specified changes. Depending on the event, the rule provides a six-month update cycle or a ten-day update period. Companies should have an internal contact monitoring changes in processing purposes, relevant service providers, corporate structures and covered business activities.
Processing assessments and international data transfers
A company using an overseas parent company, hosting provider or other foreign recipient may also need to assess a distinct cross-border personal data transfer impact assessment. The processing dossier does not automatically satisfy the transfer-specific obligations. Each data flow and any statutory exception should be assessed independently.
Example: multiple operational systems in one company
Illustrative example: A Vietnamese subsidiary uses a CRM, a recruitment platform and an international email marketing service. The assessment needs to identify which information is collected through each system, why it is used, who can access it, how long it is retained, which service provider is involved and whether any transfer overseas occurs. The company should verify operational details before signing the report.
What Justix does and what the client must provide
Justix reviews legal applicability, gathers factual information through designated contacts, documents processing activities, evaluates risks, prepares the report and assembles the agreed supporting records. The company remains responsible for verifying factual descriptions, confirming existing safeguards, completing operational changes and signing the dossier.
Filing assistance and one round of explanation or supplementation are included only in the agreed scope. Additional policy development, contract remediation, staff training or cross-border assessment work will be defined and quoted separately.
Legal sources
- Law No. 91/2025/QH15 on Personal Data Protection, particularly Articles 21 and 22.
- Decree No. 356/2025/ND-CP, particularly Articles 19, 20 and 41 and the prescribed annex forms.
Frequently asked questions
Does a foreign-invested company in Vietnam need a DPIA dossier?
Foreign ownership alone does not determine the answer. The review considers the entity, its actual processing activities and roles, and any applicable statutory exception. Article 19 of Decree 356/2025/ND-CP addresses dossiers for controllers, controller-processors and processors. Justix checks the local facts before proposing the work, including employee data and activities supported by overseas group systems.
Can we use our headquarters’ GDPR DPIA or global privacy policy?
Existing group documents are useful starting material, but they should not be treated as an automatic substitute for a Vietnam dossier. The local entity, processing activities, parties, data flows and supporting documents must be checked against Vietnamese requirements. Justix can use the group’s materials to identify what is reusable and what requires local clarification or adaptation within the agreed scope.
When must the Vietnam processing impact assessment be prepared and filed?
For entities subject to the obligation, Article 19 of Decree 356/2025/ND-CP provides for preparation and retention from the start of processing and submission within 60 days of commencing processing. Existing operations require a review of their commencement date, earlier filings and applicable transitional provisions. Do not assume that engaging an adviser restarts a statutory deadline.
Does this service also cover cross-border transfers to headquarters or cloud providers?
A processing impact assessment and a cross-border transfer impact assessment address different obligations. Overseas storage, group access and vendor arrangements should be mapped and assessed rather than classified solely by the supplier’s address. This service does not automatically include a separate transfer dossier; Justix identifies the issue during scoping and proposes additional work if appropriate.
Are small foreign-invested businesses exempt?
A small headcount is not enough to establish an exemption. Article 41 of Decree 356/2025/ND-CP contains conditional arrangements for certain small, startup and micro businesses, with exclusions concerning data-processing services, direct processing of sensitive data and the specified scale of processing. The business classification and actual activities need checking; any relief must be assessed separately for each obligation.
What happens after submission, and is acceptance guaranteed?
Submission is followed by the authority’s assessment and may lead to a request for clarification or supplementation. The reference service includes one round within the agreed scope; additional requests or changed operations are scoped separately. Justix does not guarantee acceptance or a particular regulatory outcome. The company should retain the dossier and review changes in purposes, parties or business activities for any update obligation under Article 20 of Decree 356/2025/ND-CP.
Can an assessment be prepared before all controls are implemented?
A draft can identify gaps, but the dossier must accurately distinguish existing controls from planned measures. Comprehensive drafting of new contracts or policies is scoped separately.
Does a filing receipt prove complete legal compliance?
No. Filing and authority review do not eliminate the company’s ongoing duties concerning lawful processing, security and data-subject rights.
Must the dossier be updated later?
Potentially. Article 20 of Decree 356/2025/ND-CP provides six-month updates for specified changes and ten-day updates for other listed events. The applicable trigger must be checked.
Need a lawyer for your situation?
Talk to a Justix lawyer about your options, timeline and fees before you decide.