On December 31, 2025, the Government of Vietnam issued Decree No. 356/2025/ND-CP ("Decree 356"), providing implementing guidance for the Law on Personal Data Protection No. 91/2025/QH15 ("PDPL"). Effective January 1, 2026, Decree 356 replaces Decree No. 13/2023/ND-CP and establishes detailed operational requirements that translate the PDPL's general obligations into enforceable compliance standards.

Scope of Application

Decree 356 applies to Vietnamese agencies, organisations, and individuals, as well as to foreign entities operating in Vietnam or that are directly involved in processing personal data of Vietnamese citizens or persons of Vietnamese origin residing in Vietnam. This confirms Vietnam's broad, extraterritorial approach to personal data protection.

Expanded Definition of Personal Data

Decree 356 provides detailed, operational lists for both categories of personal data under the PDPL:

Data Protection Officers and Departments

Organisations processing personal data must formally appoint a Data Protection Officer (DPO) or establish a Data Protection Department through a formal decision defining the role's functions, duties, and authority. DPOs and department personnel must: hold a college diploma or above; have at least two years of relevant post-graduation experience in legal, IT, cybersecurity, risk management, compliance, or human resources; and have received training in personal data protection.

Exemptions: Within five years from January 1, 2026, small enterprises, start-ups, household businesses, and micro-enterprises are exempt from DPO requirements unless they (i) provide personal data processing services, (ii) directly process sensitive personal data, or (iii) process data of 100,000 or more data subjects cumulatively.

Data Processing Impact Assessment (DPIA)

Data controllers and combined controller-processors must prepare and submit a DPIA dossier to the competent authority within 60 days of commencing personal data processing. The DPIA is completed once for the organisation's entire operational period but must be updated every six months where changes occur, or within 10 days for significant events such as restructuring, dissolution, bankruptcy, changes in DPO or data protection service provider, or the introduction of new data-related business lines.

The DPIA dossier must include: an Impact Assessment Report (statutory form); relevant contracts or agreements; and the organisation's data protection policies, procedures, and forms. The competent authority will review submissions within 15 days; incomplete dossiers must be corrected within 30 days.

Cross-Border Transfer Impact Assessment (CBTIA)

A CBTIA is required whenever Vietnam-sourced personal data is transferred abroad or processed using an overseas platform. Businesses must file within 60 days of the first transfer. Like the DPIA, the CBTIA is filed once and updated when relevant changes occur. The CBTIA dossier must include: a Cross-Border Transfer Impact Assessment Report; copies of data transfer agreements; and internal data protection policies and procedures.

Incident Notification

Organisations must notify the competent authority of a personal data breach within 72 hours of detecting the incident. In addition, organisations must promptly implement containment and remediation measures and maintain records documenting the incident, its causes, and the handling measures taken.

Impact on Businesses

Decree 356 significantly increases day-to-day compliance obligations, particularly for organisations processing large volumes of personal data or operating across borders. Businesses should prioritise reviewing their DPIA and CBTIA status, assessing DPO appointment requirements, and ensuring that incident response procedures align with the 72-hour notification timeline.

For further guidance, please contact Diep Hoang or Michael Lee.