Introduction
For foreign-invested companies, personal data is involved from the first day of operations: recruitment files, employment contracts, payroll records, customer data, agent information, security camera footage, website forms, CRM systems and shared platforms used across a corporate group. For this reason, a personal data protection impact assessment dossier should not be treated as a standalone form prepared by the legal department at the last minute. It should reflect how the company actually collects, uses, shares, stores and protects personal data.
This article is intended for foreign investors, FDI companies, group companies, and HR, legal, compliance and IT teams operating in Vietnam. It focuses on practical questions: when the obligation arises, what data should be included in the impact assessment dossier, which entities and departments within a group should be involved, when the dossier needs to be updated, and where common compliance risks arise.
1. The Legal Framework Has Changed: Decree No. 13 Should No Longer Be Applied Mechanically
From 1 January 2026, the Personal Data Protection Law No. 91/2025/QH15 and Decree No. 356/2025/ND-CP form the core legal framework governing personal data protection impact assessment obligations. Decree No. 356/2025/ND-CP also provides that Decree No. 13/2023/ND-CP ceases to be effective from 1 January 2026.
For companies that were already operating before this date, impact assessment dossiers prepared under Decree No. 13/2023/ND-CP and received by the specialised personal data protection authority before 1 January 2026 may continue to be used. However, updates made after the Personal Data Protection Law takes effect must comply with the new legal framework.
In substance, the dossier should do more than simply state whether the company collects personal data. It should enable the company to demonstrate:
- What types of personal data are processed and for what purposes.
- Which entity determines the purposes and methods of processing, which entity processes data under contract, and which parties receive the data.
- Which systems, countries, service providers and group entities the data passes through.
- What technical, organisational and contractual measures have been implemented to reduce risk.
- How the company handles data subject requests, retention, deletion and destruction of personal data.
A well-prepared dossier must therefore reflect actual operations. A dossier describing systems that have never been implemented, or simply copying a group’s global privacy policy without reflecting operations in Vietnam, has limited compliance value.
2. Which Companies Must Prepare a Personal Data Protection Impact Assessment Dossier?
Under the Personal Data Protection Law, a personal data controller and a personal data controller-cum-processor are required to prepare and retain the dossier and submit one original copy to the specialised personal data protection authority. The basic deadline is 60 days from the date on which personal data processing begins.
A personal data processor must also prepare and retain a dossier in accordance with its agreement with the controller or controller-cum-processor. FDI companies should address this issue expressly in contracts with payroll providers, recruitment agencies, CRM vendors, cloud providers, marketing agencies, call centres, security firms and IT service providers.
In practice, most FDI companies with employees, customers, individual suppliers, or contact persons at business partners engage in some form of personal data processing. A company does not automatically fall outside the scope of these obligations merely because it is a manufacturer, does not operate a digital platform, or does not sell directly to consumers. HR activities alone may involve identification information, contact details, tax information, insurance information, bank account details, performance evaluations, health data or camera footage.
2.1. Special Rules for Small Enterprises, Start-Ups and Micro-Enterprises
Small enterprises and start-ups may, subject to the conditions provided by law, choose whether to comply with certain obligations, including obligations under Articles 21 and 22 of the Personal Data Protection Law, for a period of five years from the Law’s effective date. Household businesses and micro-enterprises are subject to a separate exemption mechanism.
However, these mechanisms do not apply in certain cases, including where the enterprise provides personal data processing services, directly processes sensitive personal data, or processes personal data of 100,000 or more data subjects based on the cumulative volume of data processed. Because the classification of enterprise size, business type and sensitive data depends on the company’s actual circumstances, an enterprise should not assume that it is exempt merely because it has a small workforce or limited revenue.
3. Correctly Identifying Data Processing Roles Within a Corporate Group Is a Critical Step
A common mistake is to assume that the parent company is always the controller while the Vietnamese company simply follows instructions. The classification should instead be based on actual circumstances: which entity determines the purposes and methods of processing; which entity directly processes the data; which entity receives data for its own purposes; and which entity only provides processing services under instructions.
| Scenario | What needs to be determined | Risk if incorrectly classified |
|---|---|---|
| The Vietnamese company collects candidate applications and makes hiring decisions | The Vietnamese company will typically act as controller for recruitment activities in Vietnam. | The dossier identifies only the parent company and fails to reflect the responsibility of the Vietnamese legal entity. |
| A regional headquarters accesses the HRIS to manage personnel across the group | Purpose of access, categories of data, access rights and cross-border data flows. | Cross-border data transfers are not properly assessed or responsibilities between entities are unclear. |
| A payroll provider processes payroll data under contract | Scope of processing, company instructions, security, support for data subject rights and data deletion. | The service agreement does not properly allocate data protection obligations and the dossier does not fully identify the processor. |
| A marketing partner uses customer data to optimise its own campaigns | Whether the partner acts only under instructions or also uses the data for an independent purpose. | Confusion between processor and third party, or data sharing beyond the scope of the applicable notice or consent. |
For corporate groups using a global personal data governance model, a group-wide internal policy remains highly useful. However, such a policy does not automatically replace the legal dossier required for the Vietnamese entity. Each group company should review its own role, systems, users, service providers and processing purposes.
3.1. Can One Company Submit a Dossier on Behalf of a Group Sharing the Same System?
This is a common question for corporate groups where several member companies use the same HRIS, ERP, CRM, email system, cloud platform or centralised database. Sharing a common technology system does not automatically mean that the group companies are treated as one entity for personal data impact assessment purposes.
Under the current legal framework, the obligation to prepare and retain the dossier depends on the role of each party in the relevant personal data processing activity. Therefore, before deciding whether one company can prepare the dossier for the entire group, the group should identify, for each processing activity: which legal entity determines the purposes and methods of processing; which entity directly processes the data; which entity processes data only under instructions; and which entity receives or uses the data for its own purposes.
For example, three companies in Vietnam may use the same HRIS managed by an overseas parent company, while each company independently recruits employees, signs employment contracts, pays salaries and determines how the personnel data of its own employees is used. In that case, sharing the same HRIS does not by itself remove each company’s separate role and responsibility for the processing activities it controls.
Conversely, a group may standardise shared components such as system architecture diagrams, security standards, global policies, platform descriptions, vendor agreements and data governance mechanisms. These common documents may significantly reduce preparation work. However, each company’s dossier should still accurately reflect the submitting legal entity, its processing role, purposes, data categories, data subjects, data flows and actual responsibilities.
Companies should therefore not apply a “one group – one dossier” approach solely because they share a technology system. Nor should they automatically assume that every group company must prepare an entirely independent and identical set of documents. The appropriate approach depends on the legal role and actual data processing activities of each entity.
In practice, a corporate group may use a two-layer approach:
- Group level: map shared systems and data flows, identify parent companies, service providers, data centres, access rights, security policies and cross-border transfer mechanisms.
- Entity level: identify each company’s role in each processing activity, the categories of data and data subjects it handles, the purposes of processing, data recipients, and the corresponding obligations to prepare, submit or update the dossier.
This approach allows the group to make efficient use of common documentation while reducing the risk that a single “representative” dossier fails to reflect the legal responsibilities and actual processing activities of each company in Vietnam.
4. What Data Should Be Included in the Impact Assessment Dossier?
The question of what data should be included in the impact assessment dossier should be addressed on the basis of completeness and traceability. A company should identify all categories of personal data actually processed in each business process, not only sensitive data or data stored on servers located in Vietnam.
Decree No. 356/2025/ND-CP requires the dossier to describe the categories of data, processing activities and data flow diagrams. Companies should therefore map data by data subject group and business process rather than preparing a single generic list.
| Business area | Data to review | Key points to consider |
|---|---|---|
| Recruitment and HR | Identification information, contact details, CVs, education records, tax information, insurance data, bank account details and performance evaluations. | Health data, disciplinary records, biometric data and dependant information may increase the level of risk. |
| Customers and sales | Name, phone number, email address, purchase history, warranty requests, delivery information and customer service data. | Differentiate between the customer, recipient and contact persons at corporate customers. |
| Websites and applications | Form data, account information, IP addresses, cookies, device identifiers and browsing behaviour. | Review analytics tools, pixels, chatbots, embedded forms and access by overseas service providers. |
| CCTV and access control | Images, video footage, access times, attendance data and biometric identification data where applicable. | Do not treat ordinary CCTV as equivalent to facial recognition systems; review retention periods and access rights. |
Data should also be classified by reference to basic personal data and sensitive personal data under the applicable regulations. Categories requiring particular attention commonly include health information, biometric data, location data, financial and banking information, online behavioural tracking data, and other data that must be kept confidential or subject to enhanced protection under law.
5. What Should the Personal Data Protection Impact Assessment Dossier Contain?
Under Decree No. 356/2025/ND-CP, the personal data protection impact assessment report should include, at a minimum, the following core information:
- Information and contact details of the relevant parties, including the controller, controller-cum-processor, processor and third parties.
- Information about the department or personnel responsible for personal data protection, and any organisation or individual providing personal data protection services, where applicable.
- Purposes of processing, categories of data, processing activities and data flow diagrams.
- Methods of obtaining consent where required, and policies for data retention, deletion and destruction.
- Data security arrangements, protection measures, system design diagrams and applicable standards.
- Results of the company’s compliance assessment under personal data protection law.
- Assessment of potential impact, risks and consequences, together with measures to mitigate or eliminate such risks.
Companies should also pay attention to the applicable forms issued together with Decree No. 356/2025/ND-CP, including the notification for submission of the personal data processing impact assessment dossier and the corresponding impact assessment report.
A strong dossier should not merely reproduce statutory wording. For example, where a company uses Microsoft 365, a global HRIS and a Vietnamese payroll provider, the data flow diagram should show what data enters each system, who has access, whether the data is transferred onward, applicable retention periods and the deletion process when an employee leaves the company.
6. Submission and Updates: Treat the Dossier as an Ongoing Compliance Process
The dossier should remain available for inspection and assessment by the specialised personal data protection authority. A personal data controller and a personal data controller-cum-processor must submit one original copy within 60 days from the commencement of personal data processing, using the methods permitted by law.
The compliance process does not end with the initial submission. The dossier must also be updated when relevant changes occur, including changes to processing purposes, the parties involved in processing, organisational information, business activities related to the registered processing, or other circumstances requiring an update under the applicable regulations.
This is why M&A transactions, restructurings, changes in business models, introduction of direct sales channels, onboarding of new service providers and expansion of technology systems should include a personal data compliance review as part of the internal approval process. If the review is performed only after the change has already been completed, companies may lack the information needed for an accurate assessment and may miss applicable update deadlines.
7. Personal Data Protection Personnel: More Than a Formal Title
The law requires organisations to designate a department or personnel meeting the required competency standards for personal data protection, or to engage an organisation or individual providing personal data protection services. The designation of responsible personnel or a responsible department should be made formally and should clearly describe the assigned functions, duties, authority and related requirements.
The designated personnel must satisfy the competency requirements prescribed by Decree No. 356/2025/ND-CP. Companies should verify the applicable requirements concerning education, relevant professional experience and training in personal data protection law and professional skills before making the appointment.
A company does not necessarily need to establish a separate department in every case. However, the designated person or department must be able to coordinate across HR, IT, legal, information security, procurement, sales and management. In a group structure, the Vietnamese contact point should also have sufficient access to information held by the parent company and external providers so that the dossier accurately reflects actual operations.
8. Situations FDI Companies Should Review Early
8.1. Use of Global Platforms and Cloud Storage Outside Vietnam
The use of email, cloud services, HRIS, CRM or analytics tools operated by a corporate group or an overseas provider may result in cross-border transfers of personal data. The personal data processing impact assessment dossier is not the same as the cross-border personal data transfer impact assessment dossier, and both obligations may arise in parallel.
The law provides certain situations in which a cross-border data transfer impact assessment may not be required. However, companies should not apply any exemption broadly to all intra-group HR data sharing. The purpose of processing, data categories, scope of access, recipients, platform and specific statutory conditions should be reviewed for each case.
8.2. Parent Company Requests for Candidate or Employee Data
Recruitment approvals, internal transfers, management evaluations, employee share programmes and compliance investigations often involve sharing personal data outside the Vietnamese legal entity. HR teams should not simply transfer data because the group requests it. They should review the legal basis for processing, applicable notices or consents, data minimisation, intra-group arrangements and any cross-border data transfer obligations.
8.3. Changing Service Providers or Introducing AI
Moving from one attendance system to a platform using facial recognition, introducing a chatbot into customer service, using AI to screen CVs, or engaging a new marketing provider may change the categories of data processed, processing purposes, processors involved and risk profile. These changes should be assessed before the contract is signed or the system goes live, rather than being documented only after implementation.
9. A Practical Roadmap for Preparing the Dossier
- Define the project owner and scope. Identify the Vietnamese legal entity, branches, representative offices, departments and systems to be reviewed.
- Map personal data. Review HR, customer, supplier, website, CCTV, security, compliance and technology processes.
- Classify the roles of the parties. Identify controllers, controller-cum-processors, processors and third parties, and compare those roles against contracts and actual system use.
- Review supporting documents. Include privacy notices, consent forms where required, data retention and deletion policies, access controls, procedures for handling data subject requests and vendor contract clauses.
- Assess risks and mitigation measures. Do not simply state that data is “encrypted”; identify which data is encrypted, when encryption applies, who manages encryption keys, who has access and how incidents are handled.
- Complete the required forms, retain supporting evidence and submit the dossier. Establish an internal review schedule to monitor events that may require the dossier to be updated.
Summary
A personal data protection impact assessment dossier is an ongoing compliance requirement that should be closely connected to a company’s actual operations, particularly for FDI companies using group-wide systems, cloud services or providers operating across multiple countries. Companies should correctly identify the roles of the parties involved, map their data flows, prepare the dossier within the statutory timeframe and incorporate personal data reviews into the approval process for changes involving HR, technology, contracts and corporate restructuring.
Frequently Asked Questions
1) If an FDI company only processes employee data, is it still required to prepare a data protection impact assessment file?
In general, this obligation may still arise, because employee data is personal data processed in the context of recruitment, labor management, payroll, insurance and internal operations. The company needs to determine its role in the processing activity, its business type, and any case-specific exemptions before reaching a conclusion.
2) If the parent company already has a global privacy policy, does the Vietnam-based company still need its own file?
A global policy is a useful document, but it does not automatically replace the file required for the Vietnam-based legal entity. The file must reflect the actual data, systems, purposes, vendors, personnel with access, and data flows of the Vietnam-based company.
3) What is the deadline for submitting the file?
The personal data controller and the personal data controller-processor must submit one original copy within 60 days from the date personal data processing begins. Companies should identify and retain evidence of the start date of processing for each new activity.
4) Does the file need to be redone for each project or each department?
The impact assessment is generally carried out once for the duration of operations, but it must be updated whenever changes occur. As a practical matter, a company may maintain a single master file together with appendices or a log tied to its internal processes, in order to keep the information complete, easy to review, and reflective of actual practice.
5) If we use cloud services or an HRIS operated by the group overseas, is there anything additional to consider?
Yes. In addition to the data protection impact assessment file, the company needs to assess whether that activity constitutes a cross-border transfer of personal data. Certain exemptions may apply in specific situations, but companies should not assume that use of a global cloud platform is always exempt.
6) Is a company required to set up a dedicated personal data protection department?
The law allows a company either to designate personnel or a department that meets the required competency conditions, or to engage an organization or individual providing personal data protection services. The appropriate model depends on the scale of data processing, the sensitivity of the data, the number of systems involved, and the company’s governance structure.
7) If the company changes its payroll or CRM vendor, does the file need to be updated?
Most likely yes, because such a change can alter the processor, the data flows, the security measures, and the associated risks. Companies should build personal data assessment into the vendor selection and contracting process, rather than waiting until after the new system is already in operation.
8) If a group has multiple companies sharing the same system, can just one company file the impact assessment on behalf of the others?
This should not be assumed simply because the companies share a common HRIS, ERP, CRM, cloud platform, or group-wide system. The obligation must be determined based on the actual role each legal entity plays in the personal data processing activity. If member companies independently decide the purposes or methods of processing the data relevant to their own operations, the obligations of each company need to be assessed separately. A group may share documents, policies, system diagrams and security standards across its member companies to reduce preparation work, but the file must still accurately reflect the role and processing activities of each entity. For complex group structures, the specific data processing model should be reviewed before deciding on the approach for preparing and submitting the file.
Conclusion
For FDI companies, personal data compliance needs to be implemented as a cross-departmental governance activity. An impact assessment file is only useful when it accurately reflects how the company actually operates, particularly at the intersection points between HR, technology, vendor contracts, and data sharing within the group.
How TT Collab Can Help
TT Collab can support companies in reviewing their data processing models, determining the legal roles of the parties involved, mapping data flows, assessing domestic and cross-border data flows, reviewing vendor contracts, preparing the personal data protection impact assessment file, and designing an update process for the file that is suited to actual operations in Vietnam.
Legal Basis for Reference
- Personal Data Protection Law No. 91/2025/QH15.
- Decree No. 356/2025/ND-CP detailing certain articles and implementing measures of the Personal Data Protection Law.
- Decree No. 330/2026/ND-CP on administrative penalties for violations in the fields of cybersecurity and personal data protection.
Note: The content of this article is for general information purposes only and does not replace legal, tax or investment advice for any specific case. Regulations and their application may vary depending on timing, locality, industry, and the particular circumstances of each company.
