From 1 January 2026, the Law on Personal Data Protection and Decree No. 356/2025/ND-CP are in force. They require businesses to prepare a personal data processing impact assessment dossier, often called a DPIA, the international term. Many businesses treat it as a set of forms to fill in. To assess properly, you first need to know what data you hold, whose it is, which systems it passes through, who can access it and who it is shared with. A dossier that does not match what actually happens will not hold up when the authorities inspect it. This article explains what a DPIA is, who must prepare one, what the dossier contains, the deadlines for filing and updating, the exemptions, and a practical roadmap for preparing it.
- A DPIA (Data Protection Impact Assessment) corresponds to the personal data processing impact assessment dossier under Law No. 91/2025/QH15 and Decree No. 356/2025/ND-CP.
- The dossier includes a report on Form No. 10, the data processing contracts or agreements, and the related policies and procedures. It is prepared from the time processing starts.
- The dossier must always be ready for inspection. One original is filed with the competent authority within 60 days from the date processing starts, together with Form No. 02a/02b.
- The dossier is updated every 6 months when there are changes. Some changes, such as a reorganisation or a change of related business lines, must be updated within 10 days.
- Household businesses and micro businesses are exempt. Small businesses and start-ups may choose for 5 years, except in certain high-risk cases.
- To prepare a DPIA properly, a business must do Data Mapping first: know what data it holds, whose it is, which systems it passes through, who can access it and who it is shared with.
1. What is a DPIA?
DPIA stands for Data Protection Impact Assessment. Under current Vietnamese law, the equivalent concept is the personal data processing impact assessment dossier (hồ sơ đánh giá tác động xử lý dữ liệu cá nhân). Its core is the personal data processing impact assessment report.
Put simply, it is an analysis of how the business processes personal data. It identifies the risks to data subjects and sets out the measures to reduce them.
From a governance point of view, a DPIA answers three questions: what are we doing with the data, what risks does that create, and how are those risks controlled?
Who must prepare an impact assessment dossier?
The Law on Personal Data Protection, Law No. 91/2025/QH15 (in force from 1 January 2026), deals with personal data processing impact assessments in Article 21. Under Clause 1, Article 19 of Decree No. 356/2025/ND-CP, the data controller, the data controller-processor and the data processor each prepare and keep their own personal data processing impact assessment dossier from the time they start processing personal data.
Analysis: This obligation is not only for technology companies. Almost every business with employees, customers or partners who are individuals processes personal data, through recruitment, timekeeping, payroll, CRM, its website or cameras. So in practice the question is usually not “Do we have to prepare one?” but “Are we in an exempt case?” and “How do we prepare it so that it matches what we actually do?”
2. What does the impact assessment dossier contain, and when is it filed?
Article 19 of Decree No. 356/2025/ND-CP
- The dossier includes: (a) the personal data processing impact assessment report on Form No. 10; (b) copies of the contracts or agreements on personal data processing between the parties involved; (c) the related policies, procedures, rules and forms.
- The report should cover items such as: information on the parties, the personal data protection staff, the purpose and types of data processed, a description of the processing and the data flows, security measures, the risk assessment and measures to reduce risk.
- The dossier must always be available for inspection and assessment by the competent personal data protection authority.
- The business sends 1 original of the dossier to the competent authority within 60 days from the date personal data processing starts, with a cover document on Form No. 02a or 02b. It can be sent online, in person or by post.
- The competent authority may ask for the dossier to be completed if it is incomplete or not in line with the rules.
The competent personal data protection authority is currently the Department of Cybersecurity and High-Tech Crime Prevention (A05), Ministry of Public Security.
Analysis: A DPIA is not a stand-alone document. The Form No. 10 report must match the contracts signed with vendors and the internal procedures in use. If each document describes things differently, the dossier will not hold up under inspection.
The cross-border personal data transfer impact assessment dossier is a separate dossier (a report on Form No. 09, Article 18 of Decree No. 356/2025/ND-CP). A business that uses cloud services or a CRM with servers abroad, or shares data with a parent company, should consider both dossiers. See also “Cross-border personal data transfers: what to check when using cloud, SaaS or a parent company”.
3. Which businesses are exempt or may choose not to prepare one?
Article 41 of Decree No. 356/2025/ND-CP
- Household businesses and micro businesses are exempt from certain obligations, including preparing the impact assessment dossier and appointing personal data protection staff or a department.
- Small businesses and start-ups may choose whether or not to carry out these obligations for 5 years from 1 January 2026.
- These exemptions do not apply if the business provides personal data processing services, directly processes sensitive personal data, or processes the personal data of a large number of data subjects above the threshold set by the Decree.
Analysis: Whether a business is small or micro is decided by the labour and revenue or capital criteria in the law on support for small and medium-sized enterprises. The exceptions are easy to miss. A start-up with few staff but an app with many users, or a small clinic or finance company processing health or financial data (sensitive data), may still have to prepare a dossier. “May choose” also does not mean the business can ignore its other data protection obligations.
Before concluding that you are “exempt”, keep a record of the basis for that conclusion: the criteria used to decide the size of the business, the types of data processed (including any sensitive data), the number of data subjects, and whether the business provides data processing services to others. Review the conclusion again when the size or business model changes.
4. Why you should not start a DPIA by filling in the form
Many businesses approach a DPIA in this order: download the form, fill in the details, sign, file. This skips a more important question: does the business really understand how it processes data?
Imagine a business running a website, CRM, ERP, HRM, cameras, timekeeping machines, cloud services and a customer app. When Legal is asked to prepare the DPIA, Legal has to ask HR, HR asks the vendor, IT checks the cloud, Marketing checks the CRM and Procurement looks back through the contracts.
In other words, there is always another task before the DPIA: Data Mapping. A more realistic order is:
From Data Mapping to the DPIA dossier
- Data Mapping: review data sources and systems
- List the processing activities
- Identify risks
- Assess the impact
- Fix gaps and add controls
- Prepare the dossier on Form No. 10 with the supporting documents
5. What information should you collect before preparing a DPIA?
You can start with the following groups of information. These are also the items the Form No. 10 report will need to describe.
| Information group | Question to answer | Examples |
|---|---|---|
| Data subjects | Whose data are we processing? | Customers, employees, job candidates, app users, partners’ representatives |
| Types of data | Basic or sensitive? | Name, email, phone number; financial data, location, camera images, health data, biometric data |
| Purpose of processing | Why do we need this data? | HR: recruitment, payroll; Sales: managing transactions; Marketing: customer care |
| Data flows | Where does the data come from and which systems does it pass through? | Website → CRM → Sales → Customer service → marketing platform |
| Parties involved | Who else processes it? | CRM, cloud and payroll providers, sub-processors |
| Storage and access | Where is it stored, for how long, and who can see it? | Internal server or cloud, retention period, access rights |
| Transfers abroad | Is any infrastructure or partner outside Vietnam? | Cloud located abroad, sharing with the parent company |
Analysis: One type of data can serve several purposes. A customer’s phone number may be used for delivery and also for telesales. So a business should not just list its data. It should list its data processing activities. Classifying data correctly also decides the level of risk and whether the business falls into an exempt case. Only when it can draw the data flow, for example candidate → recruitment platform → HR → HRM → payroll, can a business see where data is collected, stored, accessed and shared, and where it leaves the country.
At the same time, prepare a Vendor/Data Processor Register: the vendor’s name, the data it can access, the purpose, where the data is stored, whether it uses sub-processors, and whether the contract has data protection clauses. This register feeds directly into the “contracts or agreements on data processing” part of the dossier.
6. Which risks must a DPIA assess?
Once you have a data map, the next question is: what could happen to the data? Common risks include:
- Inappropriate access: staff who do not need the data can still see it.
- Sharing with the wrong people: a customer file is sent to the wrong recipient.
- Loss or leaks: a device or account is hacked.
- Use beyond the purpose: data collected for purpose A is also used for purpose B.
- Vendor risk: a vendor has wider access than it needs.
- Keeping data too long: data is still held after the original purpose has ended.
- Cross-border risk: data passes through infrastructure abroad, but the business has not noticed.
Each risk should be linked to a specific control, rather than left as a list:
| Type of measure | Examples |
|---|---|
| Legal | Data protection policy, processing notices, consent mechanism, contracts with processors, allocation of responsibilities |
| Process | Access approval, retention periods, vendor onboarding, handling data subjects’ requests, incident response |
| Technical | Access rights, logging, encryption, backups, system monitoring |
| People | Assigning responsibilities, training, awareness, role-based access control |
7. A common mistake: leaving the whole DPIA to Legal
Legal cannot know on its own which server the data is stored on, where the HRM sends data, which tracking tools (trackers) are on the website, or whether a vendor uses third parties.
So a DPIA needs to be a cross-functional project. Management assigns the task and approves the result. Legal/Compliance coordinates and assesses compliance. IT/Security provides information on systems and security measures. HR and Sales/Marketing describe how data is actually processed. Procurement reviews vendor contracts. The closer the DPIA is to real operations, the more useful it is for governance.
Appoint one coordinator (usually the personal data protection staff member or department) and ask each department to nominate one person responsible for providing and confirming information on that department’s processing activities.
8. When your systems change, is the DPIA dossier still accurate?
Article 20 of Decree No. 356/2025/ND-CP
- The personal data processing impact assessment dossier is updated every 6 months when there are changes, such as a new processing purpose or a change in the parties involved in processing.
- Some changes must be updated within 10 days: reorganisation, termination of operations or dissolution; a change of the organisation providing personal data protection services; a change of business lines related to personal data processing.
- Updates are filed with a cover document on Form No. 03a or 03b.
Analysis: Suppose the business completes its assessment today. A few months later it launches an AI chatbot, changes CRM, hires a new vendor, installs facial recognition cameras, moves to the cloud, or launches an app or a loyalty programme. The data flows have changed, and so have the risks. Some changes trigger the duty to update the dossier. Others (such as biometrics or transferring data abroad) also trigger further obligations. So a DPIA cannot be a “do it once and you are done” task.
Add the question “Does this new activity change how we process personal data?” to the approval process for projects, software purchases and vendor contracts. If the answer is yes, inform the data protection coordinator so they can assess whether the dossier needs updating.
9. Where should your business start?
Answer Yes / No / Not sure to the following 8 questions:
- Does the business have a data map?
- Has it listed its data processing activities?
- Has it identified the purpose of each activity?
- Has it identified its own role (data controller, data processor, etc.) and the other parties involved?
- Does it have a list of vendors with access to the data, and the corresponding contracts?
- Has it identified data flows going abroad?
- Has it identified risks and controls?
- Does the information in the current dossier match what actually happens?
If many answers are “No” or “Not sure”, the business should not start by filling in Form No. 10. It should start with a current-state assessment (Data Mapping & Gap Assessment).
Where the DPIA fits in the compliance roadmap
- Discover: map the data
- Classify: data, processing activities, parties
- Assess: risks and impact
- Document: the DPIA and related documents
- Fix: legal, contracts, processes, technical measures
- Monitor: review and update when activities change
A DPIA is not the starting point of personal data protection. It is the result of a business understanding its own data processing.
FC Legal reviews your data map, compliance gaps, priority risks and remediation roadmap, so that your impact assessment dossier reflects how you actually operate.
10. Frequently asked questions
Is “DPIA” the official term in Vietnamese law?
No. DPIA is an international term. Vietnamese law uses the term personal data processing impact assessment dossier, governed by the Law on Personal Data Protection (Law No. 91/2025/QH15) and Articles 19 and 20 of Decree No. 356/2025/ND-CP, with the report prepared on Form No. 10.
What is the deadline for filing the impact assessment dossier?
The business prepares the dossier from the time it starts processing personal data and sends 1 original to the competent personal data protection authority within 60 days from the date processing starts, with a cover document on Form No. 02a or 02b. It can be sent online, in person or by post.
Do small businesses have to prepare an impact assessment dossier?
Under Article 41 of Decree No. 356/2025/ND-CP, small businesses and start-ups may choose whether or not to do so for 5 years from 1 January 2026. Household businesses and micro businesses are exempt. Exceptions: businesses that provide data processing services, process sensitive data, or process the data of a large number of data subjects.
When must the dossier be updated?
The dossier is updated every 6 months when there are changes such as a new processing purpose or a change in the parties involved. Changes such as reorganisation, dissolution, a change of the organisation providing data protection services, or a change of related business lines must be updated within 10 days, with Form No. 03a/03b.
If we use a cloud service with servers abroad, is one dossier enough?
Usually not. Besides the personal data processing impact assessment dossier (Form No. 10), transferring personal data abroad may require a separate cross-border data transfer impact assessment dossier (Form No. 09, Article 18 of Decree No. 356/2025/ND-CP), unless the law allows an exception.
11. Legal basis and references
- Law on Personal Data Protection, Law No. 91/2025/QH15, passed by the National Assembly on 26 June 2025, in force from 1 January 2026.
- Decree No. 356/2025/ND-CP dated 31 December 2025 detailing certain articles of and measures to implement the Law on Personal Data Protection (Articles 18, 19, 20 and 41; Forms No. 02a, 02b, 03a, 03b, 09 and 10).
- Decree No. 13/2023/ND-CP on personal data protection, now replaced by Decree No. 356/2025/ND-CP.
- Thư viện Pháp luật and LuatVietnam: analysis articles on the personal data processing impact assessment dossier and the cases where no dossier is required.
Review your personal data compliance with an FC Legal lawyer
Find out what data your business processes, where it is, which risks to deal with first, and which documents you need to prepare.
- Data map and compliance gap assessment
- Impact assessment (DPIA) and cross-border transfer dossiers
- Policies, vendor contracts and incident response procedures
Please do not send confidential documents or personal data through the form.
This article is for reference and reflects the rules in force at the time of publication. For a legal opinion on a specific case, please contact an FC Legal lawyer.
Prepared by the FC Legal legal team and reviewed by FC Legal’s Managing Lawyer. Updated 4 October 2026.
