Vietnam's Law on Personal Data Protection (Law No. 91/2025/QH15 — the "PDPL"), together with its implementing regulation Decree No. 356 on Personal Data Protection ("Decree 356"), took effect on 1 January 2026. Every organization that controls or processes personal data in Vietnam — including every foreign-invested enterprise ("FIE") — is subject to the full compliance framework from that date.

This checklist maps the 11 obligations that FDI companies most commonly get wrong or miss entirely. Work through each question and note where your answer is "No" or "Not sure." Every "No" is a compliance gap. Every "Not sure" is a risk.

1. Do we treat basic and sensitive data appropriately?

The PDPL draws a hard line between basic and sensitive personal data. The obligations attached to each category are materially different. Basic personal data includes everyday identifying information: name, date of birth, gender, home address, phone number, email address, and national ID number. Sensitive personal data is information that could cause serious harm in the event of a security breach. It includes health and medical records, financial and banking information, biometric data, personal location data, racial and ethnic origin, political views, religious beliefs, trade union membership, sexual orientation, criminal records, and other data the law requires to be kept confidential or protected by stringent security measures.

The gap most FDI companies miss is that they hold sensitive data without having formally classified it. Employee health data for insurance enrolment, fingerprint attendance systems, payroll and bank account records, and fleet GPS logs are all sensitive data under the PDPL. Processing any of these requires an additional, explicit consent layer. A general employment contract or privacy notice covering all data categories is not sufficient. You must specifically inform each data subject, before collection, that the data is sensitive. The classification also determines the security obligations for entities handling data and the risk assessment in privacy filings.

2. Are we acting as a controller, processor, or both?

The PDPL assigns fundamentally different obligations depending on your role. A Data Controller decides the purpose and method of processing and carries primary legal responsibility toward data subjects. A Data Processor handles data on behalf of a Controller under a written contract and is accountable to that Controller. A Controller-Processor does both — decides the purpose and directly processes the data — and must satisfy the obligations of both roles simultaneously.

Most FDI companies are Controllers for their own employee and customer data but become Processors when they provide services that involve handling another party's personal data — a logistics company handling customer delivery data on behalf of an e-commerce client, for instance, or a shared-services center processing HR data for group entities. The mistake is applying the wrong set of obligations. A company that treats itself as a Processor when it is a Controller will miss the requirements that generally fall on Controllers alone: obtaining valid consent, filing a DPIA, and honoring data subject rights requests. Identifying your role correctly for each processing activity is the foundation on which everything else depends.

3. Is our consent process valid?

Consent is the primary legal basis for processing personal data under the PDPL. Valid consent must meet four conditions:

Specific — given separately for each distinct purpose, not bundled into a single tick-box covering all uses.

Voluntary — refusing consent for optional processing cannot be made a condition of employment or service.

Verifiable — you must be able to prove who gave consent, when, and for what purpose. Acceptable forms include a signed document, a recorded call, a confirmed SMS, a website mechanism with a logged audit trail, and any other method that is printable or reproducible in verifiable form.

Revocable — data subjects can withdraw at any time. Silence or non-response never constitutes consent.

There is a higher bar for sensitive data. To collect it, you must explicitly notify the data subject that you are collecting sensitive data. The most common failures are employment contracts that bundle consent for all HR data in a single clause, customer registration forms with pre-ticked consent boxes, and onboarding documents that say nothing about the right to consent.

4. Do we have a DPO or data protection team?

The PDPL requires every organization that controls or processes personal data to designate a data protection function. This can be a named individual (Data Protection Officer), an internal department (Data Protection Department), or an outsourced service provider. The designation must be formalized in an internal document setting out the function's responsibilities, duties, powers, and any other requirements for personal data protection within the organization.

The most common gap is that data protection has been informally assigned to whoever manages IT, HR, or legal, without any formal designation document or training. For companies without sufficient internal capacity, engaging a qualified external data protection service provider is a valid alternative — but the arrangement must be properly documented.

5. Do we have a documented retention policy for data?

Personal data may only be stored for as long as necessary for the stated processing purpose. Once that purpose is fulfilled, the data must be deleted or anonymized. The PDPL does not override minimum retention periods set by other specialized laws. Where those minimums apply, they govern. Once the minimum has been met, the obligation to delete under the PDPL applies.

In practice, most FDI companies retain personal data well beyond what is legally permitted, simply because no one has defined a retention schedule. Employee records for resigned staff, customer data for lapsed accounts, and contractor information for ended engagements accumulate without a process to clear them. The retention schedule you need should cover: the data category, the purpose for which it was collected, the applicable legal minimum, if any, and the date on which deletion must be triggered. Without it, every data category you hold sits in a grey area.

6. Do we have an SOP for deleting personal data?

Deletion is a separate legal obligation from retention. When personal data reaches the end of its retention period — or when a data subject exercises their right to deletion — the PDPL and Decree 356 require permanent, irreversible destruction: physical destruction of paper records and unrecoverable deletion of electronic data. The deadlines are specific. When a deletion request is received, you must respond within two working days and complete the deletion within 20 days. If third-party processors also hold the data, you have 30 days to coordinate and complete their deletion as well. A 20-day extension is available, provided you notify the data subject and document the reason.

A retention schedule alone is not enough. You also need an operational deletion procedure: who is responsible for executing each deletion, how completion is evidenced, and how third-party processors are instructed. FDI companies using overseas cloud infrastructure or outsourced IT services often have no mechanism to instruct their vendors to delete specific records on demand. That gap must be addressed both contractually and operationally before a deletion request arrives.

7. Do we document our data protection measures?

The PDPL requires Controllers and Processors to implement technical and organizational measures to protect personal data, proportionate to the risk of each processing activity. Decree 356 requires those measures to be documented in sufficient detail to be demonstrated to regulators. A general statement that the company takes data security seriously will not satisfy the requirement.

Regulators focus on four areas in particular: technical and physical security solutions; management and training measures for staff handling personal data; potential risks to data subjects, information systems, and State security; and specific measures taken to mitigate those risks. FDI companies that run their systems through a regional or global IT infrastructure operated by an overseas parent face an additional issue: the security architecture of those external systems must be described in the DPIA and must meet Vietnamese standards. Relying on a parent company's global security policy without adapting it into a Vietnam-specific, documented framework is a common gap — and one that is correctable.

8. Have we filed our Data Processing Impact Assessment (DPIA)?

Organizations that control and/or process personal data must prepare a Personal Data Processing Impact Assessment (DPIA) and submit it to the competent authority within 60 days of commencing data processing. Under Decree 356, the DPIA must be updated at least every six months, or immediately upon any material change to processing activities.

The DPIA is the central compliance document under the PDPL. Preparation takes time, and many FDI companies underestimate the work involved because the assessment spans multiple operations and requires input from internal and external parties across HR, IT, legal, and operations. Note that exemptions and a 5-year grace period (i.e., until 1 January 2031) from the DPIA obligation exist. Still, they apply only to start-ups, micro-enterprises, small enterprises, and business households — categories that many FIEs do not fall under — subject to certain limitations and conditions. Under the law, "small businesses" for organizations engaged in trade and services are those with fewer than 50 employees (based on the average number participating in social insurance over the year) that meet capital or annual revenue ceilings (≤ VND 50 billion [about USD 1.9 million] OR ≤ VND 100 billion [about USD 3.8 million]).

9. Do we need to file an Overseas Transfer Impact Assessment (OTIA)?

Any movement of personal data from Vietnam to a location outside Vietnam is a regulated cross-border transfer under the PDPL and Decree 356. Each transfer must be disclosed in the DPIA and triggers a separate impact assessment obligation. The definition is broader than most companies expect. Uploading employee payroll data to a regional HR platform hosted overseas, sending customer records to a parent company's CRM in another country, backing up data to a global cloud infrastructure, and sharing operational reports with a regional headquarters for consolidation are all cross-border transfers.

The biggest gap most FDI companies face is not knowing which of their data flows cross borders. Data often moves through global systems established before Vietnam's data protection framework existed, with no mapping of where the data physically resides. The first step is to identify all data flows that leave Vietnam. The second is to confirm that each flow is disclosed in the impact assessment dossiers and supported by proper documentation. Until that mapping is complete, it is not possible to know whether your cross-border transfers are lawful.

The PDPL treats the Overseas Transfer Impact Assessment (OTIA) as a separate and distinct filing from the DPIA. The organization transferring data must submit the OTIA dossier to the competent authority within 60 days of commencing the transfer. Like the DPIA, the OTIA must be updated every six months or immediately upon a material change.

This is the obligation that catches most FDI companies off guard. Disclosing cross-border data transfers in the DPIA is necessary, but it is not sufficient. Companies that file a DPIA without also completing and submitting the OTIA have only partially met their obligations under the law.

Note that the same exemptions and a 5-year grace period that apply to DPIAs also apply to OTIAs.

10. Do we have a data breach response plan?

Under Decree 356, a Controller or Controller-Processor must notify both the affected data subjects and the competent authority within 72 hours of discovering a personal data breach. The notification must cover the time and location of the breach, the actions taken and parties involved, the categories and volume of data affected, the contact details of your designated data protection function, the consequences, and the measures applied in response. Seventy-two hours is a short window. Most organizations discover breaches through a vendor or cloud provider, and by the time the incident is confirmed, the affected data is identified, and a notification drafted, the deadline can pass without a plan in place.

What you need before a breach occurs: an internal detection and escalation procedure, a named person responsible for assessing the breach and preparing notifications, a notification template ready for completion, and a documented process for notifying both affected data subjects and the authorities. Vendor contracts matter here, too. If an overseas service provider operates your IT infrastructure, your data processing agreement must require that provider to notify you immediately upon discovering any breach affecting your data. The 72-hour clock starts from the moment you become aware — not from the moment the vendor chooses to tell you.

11. Are your documents updated for the PDPL?

PDPL compliance is not a filing exercise — it runs through every document your business uses that involves personal data. The most common mistake is treating updates as cosmetic: adding a reference to the PDPL without fixing the underlying mechanism. Each document needs to be assessed against the specific obligation it is meant to satisfy — not checked for a reference to the law but tested against what the law requires — and amended until it meets that standard in full.

Where do you start?

If any of the 11 questions produced a "No" or "Not sure," those are compliance gaps that need to be closed. If your business has not yet started, the right first step is a focused compliance gap assessment — a structured review of current practices against each of the 11 obligations, producing a prioritized action plan with clear owners and deadlines.

About the authors

Michael Lee is a Partner at Dilinh Legal, Ho Chi Minh City. He brings over a decade of experience advising foreign-invested companies and multinationals on regulatory compliance, corporate law, and data privacy in Vietnam, drawn from his time at two international law firms before joining Dilinh Legal in 2017. Michael was ranked by Chambers Asia and Legal500 as a leading lawyer in Corporate & M&A from 2014 to 2019. Dilinh Legal is ranked as a leading Vietnamese law firm in Corporate and M&A by both Chambers Asia and Legal500.

Khai Ho is an Associate at Dilinh Legal, advising on corporate, regulatory, and data privacy matters.

To discuss PDPL compliance for your business, contact Michael at michael.lee@dilinh.com or reach the Dilinh team at contact@dilinh.com | +84 (28) 73000864 | dilinh.com

Disclaimer: This article is for general information only and does not constitute legal advice. For further information, please get in touch with Dilinh Legal at contact@dilinh.com | +84 (28) 73000864 | dilinh.com