From 1 January 2026, the Law on Personal Data Protection (Law No. 91/2025/QH15) and Decree No. 356/2025/ND-CP are in force. They put the way a business processes the data of its customers, employees and partners into a new legal framework. For violations on cross-border data transfers, the maximum fine can reach 5% of the previous year’s revenue. Many businesses already have a privacy policy or consent forms. But they still do not know which systems the data passes through, which vendors can access it, and who is responsible when an incident happens. This article sets out a 10-step practical roadmap. Each step is linked to the relevant legal rules, so your business knows where to start and what to do first.
- The Law on Personal Data Protection (Law No. 91/2025/QH15) and Decree No. 356/2025/ND-CP are in force from 1 January 2026. Decree 356 replaces Decree No. 13/2023/ND-CP.
- The foundation of compliance is a data map: what data, whose data, what it is used for, where it is stored, who it is shared with and how long it is kept.
- Businesses must prepare a personal data processing impact assessment (DPIA) dossier (Form No. 10). If they transfer data abroad, they also need a cross-border personal data transfer impact assessment dossier (Form No. 09). Both must be sent within 60 days.
- Violations must be notified to the specialised authority no later than 72 hours after discovery. Data subject requests must be acknowledged within 2 working days.
- Maximum fines for organisations: VND 3 billion; for violations on cross-border data transfers, up to 5% of the previous year’s revenue; for buying or selling data, up to 10 times the revenue obtained.
- Micro, small and start-up businesses may be exempt from some obligations, unless they process sensitive data or the data of 100,000 or more data subjects.
1. What is new in the personal data protection framework from 1 January 2026?
Law No. 91/2025/QH15 and Decree No. 356/2025/ND-CP
- The Law on Personal Data Protection (Law No. 91/2025/QH15) was passed by the National Assembly on 26 June 2025 and is in force from 1 January 2026.
- Decree No. 356/2025/ND-CP of 31 December 2025 details a number of articles and measures to implement the Law. It is in force from 1 January 2026 and replaces Decree No. 13/2023/ND-CP (Article 42).
- The specialised personal data protection authority is the Department of Cybersecurity and High-Tech Crime Prevention (A05), Ministry of Public Security.
| Type of violation | Maximum fine for an organisation (Article 8, Law No. 91/2025/QH15) |
|---|---|
| Buying or selling personal data | 10 times the revenue obtained from the violation; if there is no revenue, or the amount calculated is lower, up to VND 3 billion |
| Violating the rules on cross-border personal data transfers | 5% of the previous year’s revenue; if there is no revenue, or the amount calculated is lower, up to VND 3 billion |
| Other violations | VND 3 billion |
Analysis: These are maximum amounts. The fine for each specific act is set by the regulations on administrative penalties, and the maximum for an individual is half that for an organisation. What matters more is whether your business can prove that it processes data lawfully. The 10-step roadmap below answers the practical question: where do you start?
2. Step 1. What data does your business hold, and where does it go?
Classification of personal data
Law No. 91/2025/QH15 (Article 2) distinguishes basic personal data from sensitive personal data. The detailed lists are in Articles 3 and 4 of Decree No. 356/2025/ND-CP. The Law has specific rules on location and biometric data (Article 31) and on audio and video recording in public places (Article 32).
Analysis: Personal data is usually scattered across the business:
- HR: CVs, ID cards (CCCD), bank accounts, dependants, salaries, insurance, timekeeping, CCTV, and sometimes biometric data.
- Sales/Marketing: customer contacts, transaction history, website behaviour, CRM, membership programmes.
- IT: user accounts, logs, cloud, email, backups, SaaS.
- Procurement: data sent to cloud, payroll, logistics, call centre and agency providers.
So the first question is not “Do we have a privacy policy?” but “Where is our data going?”.
Prepare a minimum data map
For each activity, record: what data → whose data → where it is collected → purpose → which department uses it → where it is stored → who can access it → who it is shared with → how long it is kept → how it is deleted or destroyed. Example: a candidate sends a CV → HR stores it in email or the HRM system → the hiring manager and the recruitment vendor access it → the data is dealt with once there is a result. Flag sensitive data separately.
3. Step 2. What role does your business play in each processing activity?
The roles of the parties
Article 2 of Law No. 91/2025/QH15 defines the roles. The data controller decides the purpose and means of processing. The data processor processes data at the request of the data controller. The data controller-processor both decides the purpose and means and processes the data directly. A third party is an organisation or individual, other than the data subject and the parties above, that takes part in the processing. The responsibilities of each party are set out in Article 37.
Analysis: Responsibilities are not the same in every relationship. When you use a SaaS tool to manage customers, the real chain is: your business → the SaaS provider → the cloud provider → sub-processors. You need to establish who decides the purpose, who processes, who has access, and whether the vendor uses the data for its own purposes or passes it on.
Add columns to the data map for your business’s role, the legal basis for processing, whether consent is needed, and the third parties involved. This is direct input for the dossier in Step 4.
4. Step 3. Are your data collection points and consent mechanism right?
Consent of the data subject
Under Article 9 of Law No. 91/2025/QH15, consent is valid only if it is voluntary, given with clear knowledge of the processing, and is clear and specific. Silence or no response does not count as consent. Article 10 covers withdrawal of consent and restriction of processing. The ways of giving consent are set out in Article 6 of Decree No. 356/2025/ND-CP. The Law has specific rules for recruitment and employee management (Article 25) and for advertising (Article 28).
Analysis: Review every collection point: website, app, forms, contracts, membership programmes, recruitment, CCTV, timekeeping, hotline, chatbot. The core question: does the person providing the data know what the business collects and why? Pre-ticked boxes, or one consent covering several purposes, are common mistakes. Consent is not a checkbox. It is a process with a life cycle.
Checklist for activities based on consent
- Can the consent be verified (time, version of the content)?
- Is consent given separately for each purpose, such as marketing?
- Is there a channel to withdraw consent and a process to stop processing?
- Do you ask for consent again when the data is used for a new purpose?
5. Step 4. Does your business need a personal data processing impact assessment?
Personal data processing impact assessment dossier
Articles 21 and 22 of Law No. 91/2025/QH15 govern preparing and updating the personal data processing impact assessment (DPIA) dossier. Under Article 19 of Decree No. 356/2025/ND-CP, the report is prepared on Form No. 10 and sent with Form No. 02a/02b to the specialised personal data protection authority within 60 days from the start of processing. The dossier is updated under Article 20 of Decree No. 356/2025/ND-CP.
Analysis: Do not start by downloading the form and filling it in. If you are not yet clear about your data, systems, vendors, flows abroad and existing controls, the report will hardly reflect reality. An inaccurate dossier can become a weak point during an inspection.
A sensible sequence before preparing the dossier- Data mapping
- Gap analysis against the legal requirements
- Risk assessment
- Preparing the impact assessment report
- Remediation, and updating the dossier when things change
6. Step 5. Is data being transferred out of Vietnam?
Cross-border personal data transfers
Article 20 of Law No. 91/2025/QH15 requires a cross-border personal data transfer impact assessment dossier. Under Article 18 of Decree No. 356/2025/ND-CP, the report is prepared on Form No. 09 and sent with Form No. 01a/01b within 60 days from the start of the transfer. Clause 3, Article 17 of Decree No. 356/2025/ND-CP lists some cases where no dossier is needed. Violations on cross-border data transfers carry a maximum fine of 5% of the previous year’s revenue (Article 8 of the Law).
Analysis: FDI companies, technology, SaaS and e-commerce businesses, and businesses using their parent group’s systems need to pay special attention. A common misunderstanding is: “We do not send customer files abroad, so there is no cross-border transfer.” In practice, data can pass through HRM, CRM, marketing platforms, international cloud services or the parent company’s reporting systems.
Review by system and by access flow, not just by file sending. Identify where the servers are and who abroad has access, then check which flows require a dossier.
FC Legal can carry out a quick assessment of your data processing, identify gaps and the dossier obligations to prioritise.
7. Step 6. How do you control vendors and third parties?
Contracts with data processors
Under Article 37 of Law No. 91/2025/QH15, a data processor may only receive personal data after there is an agreement or contract on personal data processing, and must process the data in line with it. Article 7 of Decree No. 356/2025/ND-CP requires the agreement between the transferring party and the receiving party to state the purpose, the types of data, the storage and deletion period, responsibility for protecting the data and how data subjects’ rights are honoured.
Analysis: A customer’s phone number can pass through the CRM → a call centre → logistics → a payment gateway → a marketing platform. Good internal governance can still be undermined by a vendor. That is why data protection is closely tied to contract management.
| Vendor | Data | Purpose | System | Access | Onward transfer / abroad |
|---|---|---|---|---|---|
| Vendor A | Customers | CRM | Cloud | Yes | To be checked |
| Vendor B | Employees | Payroll | SaaS | Yes | To be checked |
| Vendor C | Customers | Delivery | API | Yes | To be checked |
Prepare a vendor data register like the table above, then review the contracts: data processing clauses, a ban on use for the vendor’s own purposes, control of sub-processors, an obligation to report incidents, and deletion or return of data on termination.
8. Step 7. How do you handle data subject requests?
Data subjects’ rights and response deadlines
Article 4 of Law No. 91/2025/QH15 sets out the rights of data subjects, including the rights to be informed, to consent or not consent, to access, to correct, to request deletion, to restrict processing, and to complain, report and sue. Under Article 5 of Decree No. 356/2025/ND-CP, the business must acknowledge receipt of a request within 2 working days. It must complete requests to access, correct or provide data within 10 days; requests to withdraw consent or restrict processing within 15 days; and requests to delete data within 20 days. The deadlines are longer when a third party must be involved, and they can be extended once at most.
Analysis: With deadlines counted in days, a clause in the privacy policy is not enough unless there is a process behind it. One customer’s data can sit in the CRM, email and a vendor’s system at the same time. Legal, IT, HR, Sales/Marketing and Customer Service have to work together.
Process for handling data subject requests- Receive and log the request
- Verify the identity of the requester
- Find the data in the relevant systems
- Coordinate with departments and vendors
- Decide how to handle the request
- Respond to the data subject
- Keep evidence
Appoint a single point of contact for requests, with response templates and a deadline tracker. Run at least one test deletion request to check that the process really works.
9. Step 8. Is your business ready for a data incident?
Breach notification within 72 hours
Under Article 23 of Law No. 91/2025/QH15, when an organisation discovers a violation of the personal data protection rules, it must notify the specialised personal data protection authority no later than 72 hours after discovery. The content of the notification is guided by Decree No. 356/2025/ND-CP (Article 28). The Decree also requires notification within no more than 72 hours in certain cases where sensitive data is disclosed or lost.
Analysis: Suppose IT discovers unauthorised access to an admin account at 9 a.m. on a Monday. The 72-hour clock starts. The business needs to know at once who is in charge, which systems must be isolated, which evidence must be preserved, which data is affected, who deals with the authorities and who contacts customers. An incident response plan is therefore not just an IT document.
Build an incident response plan that connects technical handling, legal assessment, management decisions and communications. Prepare notification templates in advance and run regular drills.
10. Step 9. Who is responsible for data protection in your business?
Personal data protection department and personnel
Article 33 of Law No. 91/2025/QH15 requires the business to appoint a personal data protection department or personnel, or to hire a personal data protection service. Under Article 13 of Decree No. 356/2025/ND-CP, the personnel need a college degree or higher, at least 2 years of experience in a relevant field, and training in personal data protection. Under Article 41 of the Decree, household businesses and micro businesses are exempt. Small businesses and start-ups may choose for 5 years, unless they provide data processing services, process sensitive data or process the data of 100,000 or more data subjects.
Analysis: An exemption from appointing personnel does not mean an exemption from other obligations such as consent, data subjects’ rights and security. Responsibility given to “everyone” usually means no one is really responsible. Roles should be clearly assigned to the Board of Management, Legal/Compliance, IT/Security, HR, Marketing/Sales, Procurement and the incident response contact.
First establish whether your business qualifies for an exemption, then issue a written decision assigning responsibilities.
11. Step 10. How should training and periodic checks work?
Training requirements
Article 13 of Decree No. 356/2025/ND-CP requires personal data protection personnel to receive professional training. The impact assessment dossier must be updated when there are changes (Article 22, Law No. 91/2025/QH15; Article 20, Decree No. 356/2025/ND-CP).
Analysis: Staff can send the wrong file, grant the wrong access rights, download data to personal devices or keep data when it is no longer needed. Training should be role-based: HR on employee data, Marketing on consent, IT on security and incidents, Procurement on vendors, and management on governance responsibilities.
Keep training records and carry out periodic internal reviews (data map, vendor contracts, dossiers, request and incident logs) to show that the programme is working.
12. Where should your business start?
Do not start with dozens of forms. Answer four questions: what data do you hold, where does it go, where are the gaps, and what must be dealt with first. The key question is not “Do we have a policy?” but “Does our data protection system actually work?”.
| Level | Signs |
|---|---|
| Level 1: Unaware | No data map; data and vendors not fully identified |
| Level 2: Documents in place | A privacy policy, consent forms and some internal rules, but not checked against actual operations |
| Level 3: Implementing | Data, dossiers and vendors reviewed; processes being standardised |
| Level 4: Operating | Responsibilities assigned, monitoring, incident response, training and an update mechanism in place |
- Discover: prepare the data map
- Diagnose: analyse the gaps
- Prioritise: rank actions by risk
- Remediate: fix legal, process, contract and technical issues
- Monitor: review, update and train
Start with an assessment
You do not need to launch a big project straight away. A quick readiness assessment shows which level your business is at. If the gaps are significant, the next step is a Health Check: mapping the current state, identifying gaps, setting priorities and proposing a remediation roadmap.
13. Frequently asked questions
Is Decree No. 13/2023/ND-CP still in force?
No. Decree No. 356/2025/ND-CP is in force from 1 January 2026 and replaces Decree No. 13/2023/ND-CP. Businesses that prepared dossiers under Decree 13 should review them against Law No. 91/2025/QH15, Decree 356 and the new forms (Form No. 09, Form No. 10).
Do small businesses need to prepare an impact assessment dossier?
Under Article 41 of Decree No. 356/2025/ND-CP, small businesses and start-ups may choose whether to do so for 5 years. Micro businesses and household businesses do not have to. Exceptions: businesses that provide data processing services, process sensitive data or process the data of 100,000 or more data subjects.
Does using foreign cloud software count as a cross-border data transfer?
It may. You need to look at where the data is stored and who abroad has access, not only at whether files are sent. Once the data flows are identified, check them against Article 20 of Law No. 91/2025/QH15 and Article 17 of Decree No. 356/2025/ND-CP to see whether a dossier is required or whether the case is exempt.
What should a business do first after a data leak?
Activate the response plan: isolate systems, preserve evidence, identify the affected data and assess the notification obligations. Under Article 23 of Law No. 91/2025/QH15, the specialised authority must be notified no later than 72 hours after the violation is discovered.
14. Legal basis and references
- Law on Personal Data Protection No. 91/2025/QH15 of 26 June 2025 (Articles 2, 4, 8, 9, 10, 20, 21, 22, 23, 25, 28, 31, 32, 33, 37).
- Decree No. 356/2025/ND-CP of 31 December 2025 detailing a number of articles and measures to implement the Law on Personal Data Protection (Articles 3–7, 13, 17–20, 28, 41, 42; Forms No. 01a/01b, 02a/02b, 09, 10).
- Decree No. 13/2023/ND-CP of 17 April 2023 on personal data protection (replaced from 1 January 2026).
- Sources consulted: Thư viện Pháp luật (thuvienphapluat.vn), LuatVietnam (luatvietnam.vn), EY Vietnam.
Review your personal data compliance with an FC Legal lawyer
Find out what data your business processes, where it is, which risks to prioritise and which dossiers you must prepare.
- Data map and compliance gap assessment
- Drafting the impact assessment dossier (DPIA) and the cross-border transfer dossier
- Standardising policies, vendor contracts and the incident response process
Please do not send confidential documents or personal data through the form.
This article is for reference. It reflects the rules in force at the time of publication. For legal advice on a specific case, please contact an FC Legal lawyer.
Prepared by the FC Legal legal team and reviewed by FC Legal’s Managing Lawyer. Updated 4 October 2026.
