Filing Two Reports Is Not Compliance

What enterprises must establish before submitting personal data processing and cross-border transfer impact assessments to Vietnam's Ministry of Public Security.

Who Should Read This Article?

This article is intended for Vietnamese enterprises, multinational organizations operating in Vietnam, and the professionals responsible for personal data protection and regulatory compliance.

It is particularly relevant to:

• CEOs, CFOs, and executive management responsible for regulatory exposure, governance, and organizational accountability.
• DPOs, privacy officers, and compliance teams preparing DPIA and CbTIA dossiers and maintaining supporting evidence.
• Legal counsel and law firms advising clients on PDPL obligations, cross-border transfers, regulatory filings, and compliance remediation.
• CIOs, CTOs, CISOs, and IT teams responsible for data mapping, technology providers, security controls, and technical evidence.
• Risk, audit, and procurement teams managing vendor due diligence, third-party risks, and ongoing compliance monitoring.

The guidance is especially relevant to retail and e-commerce, manufacturing, banking and fintech, healthcare, telecommunications, logistics, technology, and professional services, particularly organizations handling significant volumes of personal data, using overseas infrastructure, or working with international processors.

Whether preparing an initial filing, addressing overdue assessments, or maintaining existing dossiers, the objective is the same: establish verifiable compliance evidence before relying on regulatory documentation.

Two reports. A much bigger compliance challenge.

We recently encountered a situation that illustrates a growing challenge for enterprises operating in Vietnam.

A large Vietnamese enterprise, supported by an overseas technology team, needed assistance preparing its Personal Data Processing Impact Assessment (DPIA) and Cross-Border Transfer Impact Assessment (CbTIA) dossiers for submission to the Ministry of Public Security (MPS).

The request initially sounded straightforward: prepare the reports and submit the required documents.

But an important question emerged.

How can an enterprise accurately assess the impact of its personal data processing when it has not completed its data mapping, identified all processors and overseas recipients, verified its consent practices or established the supporting governance records?

This is not simply a documentation problem.

It is a compliance readiness problem.

“Filing a DPIA is not the same as performing a DPIA. A perfectly packaged submission containing unsupported conclusions is still a weak assessment.”

Vietnam's Personal Data Protection Law (PDPL), Law No. 91/2025/QH15, became effective on 1 January 2026, together with implementing Decree 356/2025/NĐ-CP.

The law establishes specific documentation, assessment and regulatory submission obligations.

Yet the most important work takes place before the final dossier is assembled.

1. What Vietnamese law actually requires

The PDPL establishes two separate but closely related assessment obligations.

DPIA: Personal Data Processing Impact Assessment

Article 21 of the PDPL governs the assessment of personal data processing.

Personal data controllers and parties acting as both controllers and processors are generally required to prepare, maintain and submit assessment dossiers within the prescribed deadline.

Personal data processors have separate obligations to prepare and maintain assessment documentation in accordance with their agreements with controllers or controller-processors. Their duties should not automatically be treated as identical to those of controllers.

Article 19 of Decree 356 specifies the dossier contents.

These include three principal components:

1. DPIA report, Form No. 10

The report must address relevant processing activities, purposes, personal data categories, parties involved, data-flow diagrams, consent arrangements, retention and deletion, system architecture, protective measures, compliance assessment results, processing risks and mitigation measures.

2. Processing contracts and agreements

Copies of relevant agreements documenting the responsibilities and obligations of parties involved in processing personal data.

3. Supporting governance documentation

Applicable policies, procedures, regulations, forms and other relevant personal data protection materials.

CbTIA: Cross-Border Transfer Impact Assessment

Article 20 of the PDPL addresses qualifying cross-border transfers of personal data.

These include:

• Transferring personal data stored in Vietnam to overseas storage systems.
• Transferring personal data from Vietnam to organizations or individuals abroad.
• Using platforms outside Vietnam to process personal data collected in Vietnam.

This final category is particularly important.

An enterprise does not necessarily need to deliberately export a customer database to create a cross-border assessment obligation.

Overseas e-commerce infrastructure, customer management systems, cloud services, analytics platforms and other international technology providers may bring processing arrangements within the scope of Article 20.

Article 18 of Decree 356 specifies three principal CbTIA dossier components:

1. CbTIA report, Form No. 09

The report must identify relevant parties, transfer purposes, personal data categories, processing activities, data flows, consent arrangements, overseas systems, security measures, onward-transfer procedures, risks and mitigation measures.

2. Cross-border transfer agreements

Copies of agreements or transfer documents establishing responsibilities between the transferring and receiving parties.

3. Supporting governance documentation

Applicable policies, procedures, security measures and other relevant personal data protection records.

Importantly, Article 18(3)(i) expressly requires an assessment of the overseas recipient's personal data protection measures, the risks of cross-border transfer and processing, potential adverse consequences and mitigation measures.

A company name, cloud service agreement or signed processing contract is therefore not sufficient by itself.

Regulatory references: Law 91/2025/QH15, Articles 20–21; Decree 356/2025/NĐ-CP, Articles 18–19.

What about exemptions?

Not every organization or transfer is subject to identical assessment and filing requirements.

Article 20(6) of the PDPL and Article 17 of Decree 356 establish specified exceptions to the CbTIA requirement. These include certain employee cloud-storage arrangements, transfers by competent state authorities, transfers initiated by data subjects themselves and other defined activities.

Article 21(6) also excludes competent state authorities from the DPIA requirement under that article.

Separate transitional and limited relief provisions may apply to qualifying smaller enterprises under the PDPL and Decree 356, subject to eligibility conditions and exclusions.

These exceptions must be assessed against the facts.

An exemption from a particular impact assessment does not automatically remove the organization's other personal data protection obligations.

For large enterprises processing substantial volumes of customer information, the starting point should be a documented assessment of applicability rather than an assumption that an exemption exists.

2. Why administrative filing guidance is not enough

Administrative filing guidance can be valuable.

It may explain how to organize supporting documents, prepare signed PDFs, apply naming conventions, compile electronic submissions and respond to regulatory requests.

These details help an enterprise submit a properly assembled dossier.

But they do not establish whether the information in that dossier is accurate.

There is an important distinction between two different levels of readiness.

Administrative completeness

Have the required forms, contracts, supporting documents, signatures and other filing materials been included and prepared in the prescribed manner?

Substantive compliance readiness

Does the dossier accurately explain the processing activities, establish the applicable legal conditions, evaluate risks, identify implemented safeguards and substantiate the organization's compliance position?

Both matter.

Some administrative guidance organizes submissions into eight numbered categories of supporting files, such as notification forms, assessment reports, privacy personnel documentation, policies, consent materials, contracts, diagrams and annexes.

That structure can be useful for preparing an administrative submission.

However, it should not be confused with a universal statutory eight-document requirement or proof that eight corresponding areas of compliance work have been completed.

Articles 18 and 19 of Decree 356 prescribe the principal dossier components and their substantive content.

The supporting evidence needed to substantiate the assessments depends on the organization's actual operations.

“The regulator receives an assessment dossier. Producing a defensible dossier requires an evidence chain connecting legal obligations, technical systems, operational controls and responsible people.”

The challenge is not producing more paperwork.

It is ensuring that every material statement can be supported by reliable evidence.

3. The operational work required before a credible assessment

A DPIA or CbTIA is the result of substantial organizational, technical and legal work.

The following table distinguishes important assessment prerequisites from the practical evidence organizations should establish.

These workstreams are a practical methodology for producing credible evidence.

They are not ten separately prescribed statutory forms.

The legislation requires substantive assessment information, while the organization must determine how to discover, verify and document that information.

Data mapping must reflect reality

Article 19(3)(c) of Decree 356 requires detailed descriptions of processing activities and personal data-flow diagrams.

These cannot be reliably prepared without understanding the systems, applications, departments and third parties involved.

A diagram based solely on assumptions or an outdated architectural design may omit significant processing activities.

A credible assessment should reconcile documented data flows with actual system behavior, integrations and vendor arrangements.

Vendor onboarding is more than attaching a contract

An enterprise may have signed agreements with all its technology providers.

That does not mean it has evaluated how those providers process personal data.

A defensible vendor assessment should address the provider's role, relevant processing activities, data locations, subprocessors, applicable safeguards, onward-transfer arrangements and unresolved risks.

For cross-border transfers, Article 18(3)(i) expressly requires assessment of the recipient's protection measures.

A signed processing agreement is part of the evidence.

It is not, by itself, evidence that the vendor's operational risks have been assessed.

Processing purposes need legal justification

Customer registration, order fulfilment, loyalty marketing, payroll, fraud prevention and customer support represent different processing activities and purposes.

Each requires an evaluation of the applicable legal conditions.

Vietnamese law does not make consent the sole lawful basis for every processing activity. Article 19 of the PDPL establishes specific circumstances in which processing may occur without consent.

However, an organization's commercial interest does not automatically create an unrestricted right to process personal data.

Where consent is required, the enterprise needs a valid mechanism and verifiable evidence.

Simply attaching a consent template does not establish that the website or application implements it correctly.

Policies must describe implemented controls

A retention policy is not evidence that data is deleted according to that policy.

An access-control policy does not prove that permissions are configured correctly.

An incident-response policy does not prove that staff can respond effectively to an incident.

Organizations should maintain appropriate operational evidence, such as configuration records, access reviews, deletion logs, security assessments and incident-response records.

The distinction is between documentary compliance and operational compliance.

Cross-border transfers require recipient-specific assessment

A CbTIA must go beyond identifying a foreign technology provider.

The assessment should consider the recipient's processing environment, protections, relevant onward transfers, contractual enforcement mechanisms and potential risks to affected individuals.

These findings should be documented and connected to the actual transfer activities.

“A signed agreement does not prove that a vendor was assessed. A privacy policy does not prove that controls operate. A completed form does not prove that the underlying assessment was performed.”

4. A practical example: the hidden complexity of e-commerce

Consider a Vietnamese enterprise operating physical retail locations and an e-commerce platform.

Its technology environment includes an overseas-managed e-commerce system, customer registration, loyalty programs, marketing campaigns, payment services, logistics integrations and customer support.

The organization prepares a DPIA describing order processing, customer accounts and marketing.

It also prepares a CbTIA identifying an overseas platform provider.

But a technical review raises additional questions.

Does the website transmit personal information to overseas analytics or advertising services before the user has provided any consent that may be required?

Are marketing identifiers shared with additional technology providers?

Do customer support systems and logistics integrations introduce other processors?

Are loyalty-program records replicated into overseas environments?

Can the overseas technology team or its subcontractors remotely access customer information?

Are these activities reflected in the processing inventory and transfer diagrams?

And have all relevant recipients been assessed?

These questions can materially change the assessment.

For example, where tracking technologies collect or transmit personal data without valid consent or another applicable legal permission, simply declaring that consent is collected does not resolve the underlying issue.

Similarly, a CbTIA identifying only the primary overseas technology provider may be incomplete if material additional recipients or processing arrangements have been overlooked.

The organization could produce two formally complete-looking reports while failing to represent important aspects of its actual operations.

The response should not be to invent missing information or describe planned safeguards as implemented.

It should be to investigate, document the actual position, assess compliance, address material deficiencies and accurately report the findings.

A defensible assessment is not one that claims every control is perfect. It is one that accurately identifies the processing environment, established controls, risks and necessary corrective actions.

5. Practical pre-filing checklist for Vietnamese enterprises

The following checklist can be used by enterprise leadership, privacy personnel, IT teams and legal counsel to evaluate readiness before finalizing DPIA and CbTIA dossiers.

It is a recommended operational assessment methodology, not an additional statutory filing form.

A. Legal scope and accountability

• 1. Legal entities and roles: Identify relevant legal entities and determine which act as controllers, processors, controller-processors, transferors and recipients.
• 2. Applicability and exemptions: Determine whether DPIA and CbTIA obligations apply, assess any exemptions or transitional arrangements and review relevant existing filings.
• 3. Regulatory deadlines: Record commencement dates for processing and cross-border transfers, calculate the applicable submission deadlines and identify overdue obligations.
• 4. Privacy governance ownership: Document responsible privacy personnel or departments, external service arrangements where relevant, qualifications, internal responsibilities and management accountability.

B. Data discovery and operational evidence

• 5. Processing inventory: Establish a structured record of processing activities, purposes, data categories, data subjects, systems, responsible departments and retention requirements.
• 6. Data-flow validation: Produce current processing and transfer diagrams, validated against actual systems, integrations, service providers and relevant technical evidence.
• 7. Consent and legal justification: Assess the legal conditions for each processing purpose, verify consent mechanisms where required and retain evidence of consent collection and withdrawal.
• 8. Vendor and processor assessment: Identify relevant processors, subprocessors and recipients. Verify contractual obligations, processing locations, safeguards, onward transfers and outstanding risks.
• 9. Security and lifecycle controls: Establish evidence of access controls, appropriate technical safeguards, retention, deletion, data-subject rights procedures and incident response.

C. Impact assessment readiness

• 10. Cross-border transfer register: Identify overseas recipients, processing and storage locations, transfer purposes, personal data categories and onward-transfer arrangements.
• 11. Recipient protection assessment: Evaluate relevant overseas recipients' security arrangements, personal data protections, contractual safeguards and transfer-related risks.
• 12. Processing and transfer risk assessment: Evaluate compliance, privacy and security risks, possible harm, existing controls, residual exposure and mitigation measures.
• 13. Remediation and management decisions: Record identified gaps, responsible owners, remediation actions, deadlines, completed corrective measures and decisions concerning unresolved risks.

D. Dossier preparation and submission

• 14. DPIA documentation: Complete the applicable Form No. 10 requirements and assemble relevant processing agreements, policies, diagrams, assessment findings and supporting materials.
• 15. CbTIA documentation: Complete the applicable Form No. 09 requirements and assemble transfer agreements, recipient assessments, data-flow diagrams, safeguards and supporting materials.
• 16. Evidence consistency review: Verify that report statements, contracts, technical diagrams, consent records, recipient information and control evidence accurately reflect the same processing environment.
• 17. Management and legal review: Obtain appropriate internal approvals and qualified Vietnamese legal review where necessary, particularly concerning exemptions, material compliance risks, overdue filings and unresolved legal interpretations.
• 18. Submission readiness: Confirm the competent receiving authority, notification forms, filing method, signatures, document formats, administrative instructions and submission evidence.
• 19. Continuing compliance: Establish procedures to monitor changes, update dossiers, maintain supporting evidence and respond to regulatory requests.

How should the checklist be evaluated?

Each applicable item should have an identifiable owner, supporting evidence and a documented status.

Status	Meaning	Next action
Verified	Relevant evidence exists and has been checked	Include or reference in the assessment
Needs remediation	A compliance weakness or control gap has been identified	Assign an owner, assess risk and establish corrective action
Not assessed	Relevant facts or supporting evidence are missing	Complete discovery and evaluation
Not applicable	A documented legal or factual basis supports exclusion	Retain the explanation and approval

This converts a checklist of activities into an actionable compliance readiness assessment.

An important distinction must nevertheless be maintained.

An incomplete checklist does not suspend a statutory filing deadline.

Where submission deadlines have passed or are approaching, the organization should obtain legal guidance on its appropriate filing, risk-treatment and remediation strategy.

The objective is accurate and timely regulatory compliance, not indefinite postponement until an internal checklist reaches a perfect score.

6. What should the evidence package contain?

The statutory DPIA and CbTIA dossiers can be supported by a structured internal evidence repository.

For example:

These are recommended organizational categories, not a replacement for the statutory dossier components.

The advantage of a structured repository is that the enterprise can connect its reports to the evidence that supports their conclusions.

For example, a statement about an overseas recipient can reference the relevant vendor assessment, contract, transfer diagram and risk evaluation.

A statement about consent can reference the privacy notice, purpose assessment, implemented consent mechanism and relevant records.

A statement about security measures can reference technical configurations, policies, assessments and control testing.

This creates a traceable relationship between the enterprise's processing activities, legal obligations, assessments and supporting evidence.

It also makes future updates and regulator requests considerably easier to manage.

7. The 60-day deadline is not a 60-day compliance grace period

Articles 20 and 21 of the PDPL establish general 60-day dossier submission periods, subject to applicable exemptions.

The relevant starting points differ.

For a DPIA: The commencement of applicable personal data processing.

For a CbTIA: The commencement of the relevant cross-border personal data transfer.

These are separate triggering events.

Decree 356 also requires applicable DPIA documentation to be prepared and retained from the commencement of processing.

The 60-day filing period should therefore not be interpreted as permission to process personal data unlawfully, delay required safeguards or ignore consent obligations.

Nor does the period automatically restart when an enterprise appoints a new compliance officer or begins preparing the assessment.

“The filing deadline starts from the relevant processing or transfer activity, not from the day the compliance team decides to begin preparing the report.”

Organizations already operating without complete documentation should promptly evaluate their obligations, assess possible non-compliance and obtain legal advice on appropriate remedial action.

A late filing does not automatically cure earlier violations.

8. Important regulatory changes from 15 November 2026

On 20 October 2026, the Government issued Decree 392/2026/NĐ-CP, which amends several provisions of Decree 356.

These changes take effect on 15 November 2026.

Chapter VII amends the procedures for receiving, assessing and updating DPIA and CbTIA dossiers.

Greater involvement of provincial-level public security

Under amended Articles 18 and 19 of Decree 356, the competent personal data protection authority within the MPS receives and classifies initial dossiers.

Dossiers may then be transferred for assessment by provincial-level public security authorities according to criteria concerning location, scale and sector.

This creates a more decentralized assessment process while preserving the prescribed MPS route for initial submissions.

Revised regulatory assessment period

From 15 November 2026, the competent MPS or provincial authority must assess the relevant dossiers and return a result within 11 working days.

The outcome may indicate that the dossier meets requirements, meets requirements subject to supplementation or fails to meet requirements.

Where a dossier is incomplete or non-compliant, the amended provisions prescribe a 30-day completion process.

Before 15 November, Decree 356 provides a 15-day assessment period.

Article 49 of Decree 392 contains a transitional rule: relevant dossiers already received before the effective date continue to be processed under the previous procedures.

Filing methods and notification forms

The principal dossier reports remain Forms 09 and 10.

For applicable organizational submissions, the corresponding notification forms are:

• CbTIA: Form No. 09 and Form No. 01a, together with required supporting documentation.
• DPIA: Form No. 10 and Form No. 02a, together with required supporting documentation.
• Dossier updates: Form No. 03a, where applicable.

Forms 01b, 02b and 03b are the corresponding forms for applicable individual submissions.

From 15 November, the amended provisions provide for electronic, direct or postal submissions.

The amended DPIA provision expressly refers to the National Public Service Portal.

Organizations should confirm the operative filing method, accepted formats and competent authority when submitting.

Procedural instructions concerning emailed ZIP files, naming conventions or additional paper copies may be useful in a particular administrative process, but they should be distinguished from the governing statutory requirements.

Most importantly, these procedural changes do not remove the substantive obligations to assess actual processing activities, safeguards and risks.

A dossier being accepted or assessed as meeting requirements should not be interpreted as blanket regulatory approval of every underlying processing operation.

Regulatory reference: Decree 392/2026/NĐ-CP, Chapter VII, Articles 43–45, and Articles 48–49.

9. Compliance continues after the initial filing

Vietnam's PDPL does not treat impact assessments as permanent, static documents.

Article 22 of the PDPL and Article 20 of Decree 356 establish requirements for updating DPIA and CbTIA dossiers.

Key regulatory timelines

The six-month rule applies where the specified changes occur, with the cycle measured from the initial submission. It is not a requirement for every enterprise to file an entirely new assessment every six months regardless of changes.

The ten-day requirement applies to the specific events established by Article 20(2) of Decree 356. Not every technical change automatically falls within that deadline.

Nevertheless, organizations need a process for detecting relevant changes.

New vendors, systems, business activities, processing purposes, overseas infrastructure and other operational developments should be reviewed for their effects on existing assessments.

Where those developments trigger statutory updates, the dossiers must be updated through the prescribed process.

“A DPIA or CbTIA is not a document to complete once and forget. It must remain connected to the enterprise's changing processing activities and compliance evidence.”

A one-time filing exercise cannot reliably support continuing compliance without an underlying governance process.

10. What happens when the documentation does not reflect reality?

Vietnam's enforcement framework creates significant potential consequences for failures involving personal data protection and cross-border transfers.

Decree 330/2026/NĐ-CP, issued and effective on 19 August 2026, establishes administrative penalties for relevant violations.

DPIA violations

Article 55 addresses failures involving personal data processing impact assessments.

These include starting applicable processing without preparing or maintaining the required dossier, failing to submit it within the prescribed deadline and failing to make required updates.

Certain violations attract fines of VND 20–30 million.

Intentional falsification of data, providing inaccurate information in the assessment dossier or refusing required corrections may attract fines of VND 50–100 million.

The decree also provides remedial measures, including requirements to complete the dossier and, for specified violations, suspension of processing until the relevant obligations are satisfied.

CbTIA violations

Article 56 addresses cross-border transfer violations.

Certain failures to prepare, submit, maintain or update CbTIA dossiers attract fines of VND 30–50 million.

Other violations involving contractual safeguards, consent or notification arrangements, security measures and regulatory cooperation may attract higher fixed penalties.

When does the 5% revenue-based penalty apply?

Article 56(3) establishes revenue-based penalties for specified serious cross-border transfer violations.

These involve defined unlawful conduct and consequences, including circumstances in which failure to prepare an assessment, concealment or misdeclaration of data flows results in personal data leakage or loss.

The decree establishes the following tiers for qualifying violations:

Article 56 also addresses specified prohibited continuation of cross-border transfers after an authority has ordered them stopped, where national defence or security is harmed.

Revenue-based calculations refer to the preceding financial year's revenue in the Vietnamese market, with alternative monetary penalty provisions where the conditions specified in the decree apply.

The distinction is critical: simply having more than one million customers, operating an overseas technology platform or failing to submit a routine dossier does not automatically trigger a 5% revenue-based fine.

The applicable violation and the statutory conditions must be established.

Nevertheless, the penalty framework illustrates why the completeness and accuracy of data-flow declarations, transfer assessments and governance evidence matter.

Organizations cannot safely treat these assessments as administrative formalities.

Regulatory reference: Decree 330/2026/NĐ-CP, Articles 55–56.

11. Why legal expertise and technical evidence must work together

A defensible DPIA or CbTIA requires cooperation across several enterprise functions.

Technical and IT teams establish how systems actually operate, including collection mechanisms, infrastructure, integrations, access, storage and cross-border flows.

Privacy and compliance personnel establish governance ownership, maintain processing inventories, coordinate risk assessments, manage evidence and monitor changes.

Qualified legal counsel interprets applicable legislation, assesses exemptions, reviews contractual arrangements, evaluates legal risks and advises on regulatory submissions.

Management approves resources, remediation priorities and decisions concerning material residual risks.

These functions are complementary.

Legal analysis cannot establish technical facts that have never been investigated.

A data-flow diagram cannot determine whether a processing activity satisfies Vietnamese legal requirements.

And a collection of policies cannot prove that corresponding safeguards operate effectively.

Where compliance technology can help

A structured governance, risk and compliance platform can support enterprises by maintaining:

• Processing inventories and data-flow records.
• Vendor and processor registers.
• Cross-border recipient assessments.
• Consent and lawful-processing evidence.
• Risk registers and remediation workflows.
• Control ownership and implementation records.
• Regulatory requirements and supporting documentation.
• Assessment dossiers and evidence references.
• Change monitoring and audit history.

AI-assisted analysis may improve efficiency by helping organize evidence, identify inconsistencies and prepare assessment materials against applicable requirements.

However, automated conclusions must remain traceable to verified facts and subject to appropriate human oversight.

Automation cannot turn an undocumented processing activity into a verified one.

The value lies in connecting legal obligations, operational responsibilities, evidence and assessments within a maintained compliance process.

Not merely in generating reports.

12. The question every enterprise should ask before submitting

Before approving a DPIA or CbTIA for submission, enterprise leadership should ask:

Can we demonstrate that the information in this assessment accurately reflects how our organization collects, processes, protects and transfers personal data today?

Can we identify the relevant processors and overseas recipients?

Can we explain material data flows and processing purposes?

Can we demonstrate the applicable consent arrangements or other legal conditions?

Can we substantiate our technical and organizational safeguards?

Can we explain identified risks, corrective actions and remaining gaps?

And can we maintain that evidence as our systems, vendors and business operations change?

If those answers are incomplete, the enterprise has work to do beyond preparing two regulatory forms.

The purpose of an impact assessment is to make the organization's processing activities, protections and risks visible and accountable.

The submission should be a documented outcome of that work, not a substitute for it.

“A defensible DPIA or CbTIA is not where compliance begins. It is where documented governance, implemented controls and verifiable evidence come together.”

Vietnam's personal data protection framework is pushing enterprises beyond privacy policies and administrative documentation toward more demonstrable accountability.

The organizations best positioned to respond will be those that can show not only what their policies promise, but also what their systems, people and processes actually do.

The DPIA and CbTIA are not the compliance program. They are evidence-based assessments produced by that program.

For Vietnamese enterprises, the lesson is straightforward.

Understand the data. Establish the controls. Verify the evidence. Assess the risks. Submit a dossier that reflects reality. And maintain compliance as the organization changes.

Ronni K. Gothard Christiansen
Technical Privacy Engineer & CEO, AesirX.io

Download the Vietnam DPIA & CbTIA Pre-Filing Playbook

29 slides with a 19-point readiness checklist, evidence requirements, regulatory timelines and a practical filing preparation methodology.

Regulatory references

1. Law No. 91/2025/QH15, Law on Personal Data Protection

Issued 26 June 2025. Effective 1 Janupdary 2026.

Relevant provisions include Articles 8, 9, 19, 20, 21, 22, 37, 38 and 39.

Official government publication

2. Decree No. 356/2025/NĐ-CP

Issued 31 December 2025. Effective 1 January 2026.

Implementing provisions for the PDPL.

Relevant provisions include Articles 13–20 and 41, particularly Articles 18–19 on impact assessment dossiers and Article 20 on updates.

Official government publication

3. Decree No. 330/2026/NĐ-CP

Issued and effective 19 August 2026.

Administrative sanctions in cybersecurity and personal data protection.

Relevant provisions include Articles 55–57 concerning DPIA violations, cross-border transfers and privacy personnel requirements.

Official government publication

4. Decree No. 392/2026/NĐ-CP

Issued 20 October 2026. Effective 15 November 2026.

Chapter VII amends certain assessment, submission and update procedures under Decree 356/2025.

Relevant provisions include Articles 42–45 and transitional provisions in Articles 48–49.

Official government publication

Legal disclaimer

This article is provided for general informational and educational purposes only and does not constitute legal advice, a formal regulatory assessment, legal representation or confirmation that any particular organization complies with Vietnamese law.

The analysis reflects legislation and regulatory materials available as of 28 October 2026, including amendments scheduled to take effect on 15 November 2026. Actual compliance obligations, exemptions, filing deadlines, administrative procedures and potential sanctions depend on the relevant facts and applicable legislation.

The operational workstreams, evidence categories, readiness statuses and pre-filing checklist described in this article are recommended compliance methodologies. They should not be interpreted as additional statutory forms or filing requirements imposed by Vietnamese law.

Organizations should obtain advice from qualified Vietnamese legal counsel and consult official Ministry of Public Security guidance before determining regulatory obligations, relying on exemptions, making submissions, responding to potential violations or assessing enforcement exposure.

Compliance technology, automated documentation and AI-assisted assessments can support governance, risk management and evidence preparation, but do not replace qualified legal advice, responsible privacy personnel, management accountability or independent human review.

Any enterprise scenario used in this article is illustrative and does not disclose or make findings about the compliance status of an identifiable organization.