Having a privacy policy on your website does not mean your business protects personal data properly. Personal data is spread across candidate files, employment contracts, timekeeping machines, cameras, the CRM, the website, accounting software, cloud services, and data shared with vendors or a parent company. Since 1 January 2026, the Law on Personal Data Protection (Law No. 91/2025/QH15) and Decree No. 356/2025/ND-CP have been in force, with significant maximum penalties. This article gives a self-assessment checklist in 10 areas. It explains what to check in each area, which rules apply and where to start, so that compliance on paper becomes something your business can actually operate.
- The Law on Personal Data Protection (Law No. 91/2025/QH15) and Decree No. 356/2025/ND-CP are in force from 1 January 2026. Decree No. 13/2023/ND-CP has been replaced.
- The first step in any checklist is a data map: what data, whose it is, which system it is in, who can access it and who it is shared with.
- Consent must be clear and verifiable. It must not be assumed by default or presented in a misleading way.
- The processing impact assessment dossier (Form No. 10) and the cross-border transfer impact assessment dossier (Form No. 09) must be filed within 60 days from the start of the activity, unless an exemption applies.
- The maximum fine for an organisation can reach 5% of the previous year’s revenue for violations relating to cross-border data transfers.
- Data protection is a cross-department governance issue, not just a job for IT or Legal.
1. Why is a privacy policy not enough?
Many businesses treat posting a privacy policy on their website as the end of their obligations. A better question is: does the business know what data is being processed, where, for what purpose, who can access it and who it is shared with? When the policy does not match the actual data flows, the gap between “compliance documents” and “compliance in practice” is where risk arises.
The legal framework from 1 January 2026
- The Law on Personal Data Protection, Law No. 91/2025/QH15 (passed on 26 June 2025), and Decree No. 356/2025/ND-CP dated 31 December 2025 both took effect on 1 January 2026. Decree 356 replaces Decree No. 13/2023/ND-CP.
- Article 8 of Law No. 91/2025/QH15 sets the maximum fines for an organisation: up to 10 times the revenue obtained for buying or selling personal data; up to 5% of the previous year’s revenue for violations relating to cross-border data transfers; up to VND 3 billion for other violations (VND 3 billion also applies if there is no such revenue or it is lower). The maximum for an individual is half.
- Competent authority: the Department of Cybersecurity and High-Tech Crime Prevention (A05), Ministry of Public Security.
Analysis: These are ceilings. The fine for each act is set by the penalty regulations. Even so, the ceilings are high enough to make data protection a matter for senior management.
2. Personal data protection self-assessment checklist
For each row, mark Yes, Not yet or Unclear. Treat “Unclear” as “Not yet”: what the business cannot prove is hard to rely on in an inspection or an incident.
| Area | Self-check question | Warning sign |
|---|---|---|
| 1. Data map | Is there a list of data types, sources, storage systems, who has access and who receives the data? | Nobody knows how many systems hold customer data |
| 2. Purpose of processing | Does each collection activity have a clear purpose? Is reuse for new purposes controlled? | Phone numbers collected for delivery are used for marketing |
| 3. Notice and consent | Is there full notice, a suitable consent mechanism, and stored evidence? | Pre-ticked consent boxes; nobody knows when the customer consented |
| 4. Employee data | Are there separate rules, role-based access to HR records, and a retention period after an employee leaves? | Fingerprint or facial recognition in use, with no rules in place |
| 5. Website, app, CRM | Does the privacy policy match the data collected through forms, cookies and tracking tools? | Policy copied from a template |
| 6. Vendors | Do you know which vendors process data? Do the contracts have data clauses? | The payroll software contract does not mention data |
| 7. Cross-border | Is data stored, shared or accessed from abroad? Has the dossier been prepared where required? | International CRM or HR platform in use, not assessed |
| 8. Impact assessment | Has the processing impact assessment dossier been prepared and kept up to date? | Dossier prepared once, does not reflect new systems |
| 9. Data subjects’ rights | Is there a contact point, and a procedure for verification, finding the data and logging requests? | Nobody knows where to forward an email asking for data deletion |
| 10. Data incidents | Is there a response plan, a decision-maker, and a procedure for notifying on time? | Never rehearsed |
The sections below explain each area in detail: why it needs checking, which rules apply and what to do first.
3. What personal data does your business process?
A business usually processes the data of several groups at once: customers, employees, job candidates, partners’ representatives, suppliers, website or app users and office visitors. The data is not only names, phone numbers and emails. It may also be accounts, location, camera images, financial, health or biometric information. Some of these may be sensitive data that needs a higher level of protection.
Start with Data Mapping
Build a spreadsheet with these columns: data type, data subject, source, purpose, storage system, who has access, recipients, retention period. If you cannot fill it in yet, every document that follows is likely to be wrong.
4. Are purpose, notice and consent handled properly?
Data is often collected for one purpose and then used for many others: a phone number taken for delivery ends up in the CRM and in marketing campaigns. A common mistake is to think that a line saying “I agree to the privacy policy” settles everything. In fact consent has a whole lifecycle that needs managing.
Requirements for consent
Under Decree No. 356/2025/ND-CP, the data subject’s consent must be clear and verifiable. It must not be assumed by default or presented in a misleading way.
The consent lifecycle
- Collect the data
- Notify the data subject
- Establish the legal basis for processing
- Record consent and keep the evidence
- Reassess when the purpose changes
- Handle requests to withdraw consent
- Remove pre-ticked boxes. Separate marketing consent from consent to provide the service.
- Keep a consent log (time, channel, version of the notice).
- Any new use must be reviewed by Legal/Compliance first.
5. Is employee data a “blind spot”?
Many businesses focus on customers and forget internal data. Follow one employee from application to departure: CV → ID card (CCCD) → bank account → tax records and dependants → timekeeping → cameras → performance reviews → health records. The risk grows when cameras, facial recognition, fingerprints, HRM and cloud services are combined, because the software vendor may be able to access the entire file.
- Issue separate rules on employee data and give notice at recruitment.
- Grant access to HR records by role; set a retention period after an employee leaves.
- Review contracts with HRM, payroll and timekeeping vendors.
6. Website, CRM and vendors: where is the data going?
Websites and apps collect data through forms, accounts, purchase history, cookies and tracking tools, then pass it to the CRM, email marketing and analytics tools. A mid-sized business may use dozens of vendors (ERP, payroll, cloud, logistics, payments, call centre, agencies). Each vendor is one more point with access to data.
Analysis: A system is only as strong as its weakest link. If contracts do not allocate responsibility for data, the business will find it hard to control subcontractors, where data is stored and what happens to data when the contract ends.
- Compare the privacy policy with the actual data flows; update it when new tools are added.
- Keep a list of vendors that process personal data.
- Add data clauses: scope of processing, security, subcontractors, incident notification, return or deletion of data.
7. Does your business transfer personal data abroad?
This question is especially important for FDI companies. Do not just ask “Is the server abroad?”. Identify every situation where data is stored, shared or accessed from abroad: parent company systems, cloud, SaaS, CRM, HR platforms and foreign vendors.
Cross-border personal data transfer impact assessment dossier
Under Article 18 of Decree No. 356/2025/ND-CP, the cross-border personal data transfer impact assessment report is prepared on Form No. 09. One original is filed with the competent authority, with Form No. 01a/01b, within 60 days from the date the transfer starts. The Decree also sets out some cases where no dossier is required.
Check the actual data flows before concluding whether you have an obligation. Whether a no-dossier case applies must be checked specifically against the Decree. See also “Cross-border personal data transfers: what to check when using cloud, SaaS or a parent company”.
8. Does the processing impact assessment dossier reflect reality?
Personal data processing impact assessment dossier
- Under Article 19 of Decree No. 356/2025/ND-CP, the personal data processing impact assessment report is prepared on Form No. 10 and filed with Form No. 02a/02b within 60 days from the date processing starts. The dossier must be updated when there are changes, as provided in the Decree.
- Under Article 41, micro businesses and household businesses are exempt from certain obligations (such as preparing the impact assessment and appointing data protection staff or a department). Small businesses and start-ups may choose the exemption for 5 years from 1 January 2026, unless they provide data processing services, process sensitive data, or process the data of a large number of data subjects.
Analysis: An impact assessment is not “filling in a form”. The business must be able to answer the chain: which data → whose → for what purpose → in which system → who has access → which vendors → what risks → which measures. If the data map is wrong, the dossier will be wrong too. For more detail, see “What is a DPIA? What businesses need to prepare for a personal data processing impact assessment”.
9. When a data subject makes a request, who handles it?
A customer emails asking to see or delete their data. Will that email go to Customer Service, Legal, IT or Marketing, or will nobody take responsibility?
Deadlines for handling requests
Decree No. 356/2025/ND-CP sets specific deadlines for responding to and carrying out each type of data subject request (access, correction, withdrawal of consent, deletion and so on). The business must handle each one within the corresponding statutory deadline.
- Appoint a point of contact and publish the contact channel.
- Have a procedure for verifying the requester and finding data across several systems.
- Keep a log of how requests were handled, to prove deadlines were met.
10. If a data incident happened tomorrow, what would you do?
Tomorrow morning IT finds signs of unauthorised access to a system. Who decides? Who assesses the affected data, preserves evidence, deals with the authorities and notifies customers? If you cannot answer yet, the problem lies in your actual ability to respond, not in your policy.
Breach notification within 72 hours
Law No. 91/2025/QH15 and Decree No. 356/2025/ND-CP require a breach to be notified to the competent authority and, in some cases, to the affected data subjects, within 72 hours at the latest, as provided.
Data incident response framework
- Detect and report internally
- Contain and stop the incident
- Assess the affected data and data subjects
- Preserve evidence
- Notify the competent authority or data subjects on time
- Fix the problem and learn lessons
Prepare a response plan in advance (contacts, notification templates, decision tree) and rehearse it to test whether the 72-hour deadline is achievable.
11. Who is responsible for data protection in the business?
IT protects the systems but does not decide the purpose of processing. Legal drafts the documents but cannot make sure systems run correctly without IT. HR holds employee data, Marketing manages the points where customer data is collected, and Procurement manages vendors. The problem to solve is governance, not just paperwork.
Requirements for personal data protection staff
Under Article 13 of Decree No. 356/2025/ND-CP, personal data protection staff need a college degree or higher; at least 2 years of experience in a related field (legal, IT, cybersecurity, data security, risk management, compliance, HR management, personnel organisation); and training in personal data protection.
Appoint a person or department that meets these conditions (unless exempt) and set up a cross-department working group with a regular review schedule.
12. Where should your business start?
The aim of a review is not to create more documents. It is to answer: where is the business now, where are the gaps, what comes first, and what is the roadmap? A quick question for management: when were all systems last reviewed? If many answers are “Unclear” or “IT probably knows”, start with a quick readiness assessment before deciding on a full Health Check.
The Data Protection Health Check method
- Data Map: map the data
- Gap Analysis: identify gaps against the rules
- Risk Prioritisation: rank the risks to deal with first
- Remediation Roadmap: plan the fixes
If your business uses customer or employee data, cameras, biometrics, CRM or cloud, or shares data abroad, FC Legal can help identify the gaps to deal with first.
13. Frequently asked questions
If we already have a privacy policy, do we need to do anything else?
Yes. The privacy policy is only one part. The business also needs a data map, a consent mechanism with stored evidence, an impact assessment dossier (if required), a procedure for handling data subjects’ requests, an incident response plan, and data clauses in vendor contracts.
Which legal documents govern personal data protection?
From 1 January 2026, the main framework is the Law on Personal Data Protection (Law No. 91/2025/QH15) and Decree No. 356/2025/ND-CP. Decree 356 has replaced Decree No. 13/2023/ND-CP. Businesses should also note related laws such as the Civil Code 2015, the Law on Cybersecurity 2018 and the Law on Electronic Transactions 2023.
What is the deadline for filing the impact assessment dossier?
Under Decree No. 356/2025/ND-CP, the processing impact assessment dossier (Form No. 10) and the cross-border transfer impact assessment dossier (Form No. 09) are filed within 60 days from the date processing or the transfer starts, except in the exempt cases under the Decree.
Are small businesses exempt from the obligations?
Micro businesses and household businesses are exempt from certain obligations. Small businesses and start-ups may choose the exemption for 5 years from 1 January 2026. The exemption does not apply if the business provides data processing services, processes sensitive data, or processes the data of a large number of data subjects.
What is the highest fine for personal data protection violations?
Article 8 of Law No. 91/2025/QH15 sets the maximum for an organisation: up to 10 times the revenue from buying or selling data, up to 5% of the previous year’s revenue for cross-border transfer violations, and up to VND 3 billion for other violations. These are ceilings; the specific amount depends on the act.
If there is a data leak, how quickly must the business notify?
Personal data protection law requires a breach to be notified to the competent authority (A05, Ministry of Public Security) and, in some cases, to the affected data subjects, within 72 hours at the latest. So the business should prepare a response plan in advance.
14. Legal basis and references
- Law on Personal Data Protection, Law No. 91/2025/QH15, passed on 26 June 2025, in force from 1 January 2026.
- Decree No. 356/2025/ND-CP dated 31 December 2025 detailing certain articles of and measures to implement the Law on Personal Data Protection (replacing Decree No. 13/2023/ND-CP dated 17 April 2023).
- Civil Code 2015 (Article 38: right to private life and personal secrets).
- Law on Cybersecurity, Law No. 24/2018/QH14.
- Law on Electronic Transactions, Law No. 20/2023/QH15.
- Sources consulted: thuvienphapluat.vn, luatvietnam.vn; EY Vietnam legal update on Decree No. 356/2025/ND-CP.
Review your personal data compliance with an FC Legal lawyer
Find out what data your business processes, where it is, which risks to deal with first, and which documents you need to prepare.
- Data map and compliance gap assessment
- Impact assessment (DPIA) and cross-border transfer dossiers
- Policies, vendor contracts and incident response procedures
Please do not send confidential documents or personal data through the form.
This article is for reference and reflects the rules in force at the time of publication. For a legal opinion on a specific case, please contact an FC Legal lawyer.
Prepared by the FC Legal legal team and reviewed by FC Legal’s Managing Lawyer. Updated 4 October 2026.
