Introduction
For foreign-invested companies operating in Vietnam, personal data protection is no longer a matter left solely to the IT department. Employee data is fed into global HR systems, customer data is synchronized to group-wide CRM platforms, facial-recognition cameras are installed at factories, and recruitment platforms, digital marketing tools, cloud services and artificial intelligence tools can all trigger legal obligations.
The applicable legal framework has moved from Decree No. 13/2023/ND-CP to the 2025 Law on Personal Data Protection and its implementing guidance. This article helps FDI companies identify the situations that trigger obligations, determine what needs to be checked before rolling out systems or transferring data to headquarters, and build a compliance approach suited to their actual operations.
1. Are FDI companies within the scope of application?
In most cases, the answer is yes. The Law on Personal Data Protection applies to foreign organizations operating in Vietnam, and also applies to foreign organizations and individuals that directly participate in or are otherwise involved in the processing of personal data of Vietnamese citizens and certain other data subjects specified by law.
Companies should therefore not assume that hosting servers, CRM systems or cloud platforms overseas takes the processing activity outside the scope of Vietnamese law. An overseas parent company may still be implicated in obligations in Vietnam if it receives, accesses, analyzes or determines the purpose of processing data belonging to employees, customers or partners in Vietnam.
In practice, FDI companies should start with the question: “What data can identify a specific individual, which systems does it pass through, and who decides how that data is used?” If these three questions cannot yet be answered, the company does not yet have a sufficient basis to assess its obligations.
1.1. “Processing” is understood more broadly than storage
Processing of personal data covers many activities: collection, analysis, aggregation, encryption, editing, deletion, destruction, de-identification, provision, disclosure and transfer of data. As a result, a company may incur obligations even if it does not directly sell data or operate a consumer-facing digital platform.
For example, the following activities typically warrant review:
- Collecting candidate profiles, photos, ID documents, family information and work history;
- Recording attendance using fingerprints, facial recognition, or tracking the location of delivery staff;
- Synchronizing customer lists from Vietnam to a group-wide CRM system;
- Using external providers for payroll, recruitment, customer service, cloud storage or marketing;
- Using call data, browsing behavior or purchase history to segment customers and target advertising;
- Feeding data into AI tools, big data warehouses or centralized analytics systems.
2. The first step: classifying data and correctly identifying each party’s role
Not all data carries the same level of risk. The law distinguishes between basic personal data and sensitive personal data; the detailed categories are set out in Decree No. 356/2025/ND-CP.
Basic data may include full name, date of birth, contact details, images, phone number, ID card or passport number, and digital account information. Sensitive data, meanwhile, covers a number of higher-risk categories such as health information, biometric data, location data, data on financial accounts and transactions, electronic identity authentication information, as well as data tracking behavior in the use of online services.
For FDI companies, labeling data as “confidential” under group-wide policy is not sufficient on its own. A data map aligned with the classification used under Vietnamese law is needed, since data that a company treats as ordinary operational data may fall into the sensitive category in Vietnam.
2.1. Determining the processing role to allocate responsibility correctly
The law distinguishes several key roles: the personal data controller, the personal data processor, the personal data controller-cum-processor, and third parties. Determining the role should not rely solely on labels used in internal group contracts, but should look at substance: who decides the purpose, who chooses the means, and who directly carries out the processing.
| Scenario | Point to determine | Risk if misclassified |
|---|---|---|
| A Vietnamese company uses external payroll software | Who decides the data categories, purposes and retention period? | The contract fails to allocate responsibility when an incident or an employee request arises |
| A global CRM system operated by the parent company | Does the parent company merely provide infrastructure, or does it also decide the purpose of using customer data? | Obligations on cross-border data transfer and responsibility allocation between entities are overlooked |
| An agent collecting customer information | Does the agent collect data as instructed, or does it use the data for its own purposes? | Data is shared beyond the scope that was notified or consented to |
Correctly allocating roles is the foundation for drafting data processing agreements, designing procedures to respond to data subject rights, and identifying which entity bears primary responsibility in the event of a violation.
3. Consent should not be treated as a default checkbox
As a general rule, the collection of personal data requires the consent of the data subject, except in cases where the law permits processing without consent. Consent is only valid where the data subject gives it voluntarily and with knowledge of the type of data being processed, the purpose of processing, the identity of the controller or controller-cum-processor, and the relevant rights and obligations.
Consent must be clear, specific, and capable of being recorded or verified; silence or non-response does not constitute consent. Consent must also be separated by purpose, rather than bundling multiple unrelated purposes into a single general clause.
This point is particularly important when companies roll out:
- Recruitment forms that collect information on family members, health or background checks;
- Loyalty programs that combine marketing, behavioral analysis and group-wide data sharing;
- Surveillance cameras, location-tracking tools or biometric devices in the workplace;
- Mobile applications requesting access to location, contacts, photos or device identification;
- Data analytics activities supporting AI, scoring, forecasting or personalization of customer experience.
Companies should not assume that an employment relationship or a contractual relationship with a customer automatically replaces the need for consent. Some processing activities may rely on contract performance or another legal basis, but that basis must be assessed for each specific processing purpose and must be supported by an appropriate oversight mechanism.
4. Key operational obligations FDI companies need to put in place
4.1. Personal data processing impact assessment dossier
Personal data controllers and personal data controller-cum-processors must prepare, retain and submit a personal data processing impact assessment dossier to the specialized personal data protection authority within 60 days from the date processing first begins, except in cases that are exempted or subject to specific arrangements under the law.
This is not a form that can be completed independently by the legal department. The dossier must reflect the actual data flow: where the data comes from, its category, who accesses it, which systems it is stored on, which vendors are involved, how long the data is retained, what risks may arise, and what controls are in place.
The dossier is prepared once for the duration of operations but must be updated when changes occur in accordance with the applicable rules. In certain cases, such as a new processing purpose or the addition or change of parties involved in processing, the dossier must be updated every six months from the date of the first submission. For certain other material changes prescribed by law, the update must be made within 10 days from the occurrence of the relevant event. Companies should therefore maintain a change-monitoring mechanism to determine the correct timing and scope of each update.
4.2. Designating personnel or a unit responsible for personal data protection
Agencies and organizations are responsible for designating a unit or personnel with adequate capacity for personal data protection, or engaging an organization or individual to provide the relevant service. This designation should be documented formally, rather than being handled as an informal task assignment to IT or legal staff.
Within an FDI company, a suitable model is typically a cross-functional team comprising legal or compliance, IT/information security, HR, marketing or business, and the group’s data governance focal point. Personnel responsible in Vietnam need sufficient authority to request information from various departments, participate in vendor assessments, and activate incident response procedures.
4.3. Managing contracts with vendors and group entities
Signing service contracts with software vendors, call centers, HR providers, cloud providers or marketing agencies does not automatically relieve an FDI company of responsibility for the data it hands over. A processor may only receive and process data in accordance with an agreement or contract with the controller or controller-cum-processor.
Contracts or data processing addenda should, at a minimum, clarify: the processing purpose, the categories of data and data subjects, the scope of instructions, protective measures, the mechanism for using sub-processors, support for exercising data subject rights, retention periods, deletion or return of data, incident notification, and compliance verification mechanisms.
In particular, a global intra-group agreement drafted to a global standard may need Vietnam-specific additions rather than being applied as-is.
5. Cross-border transfer of personal data: an easily overlooked point in group structures
The law treats more than simply sending data files overseas as a cross-border transfer of personal data. Obligations may arise when data stored in Vietnam is transferred to a system located outside Vietnamese territory; when data is provided to a foreign organization or individual; or when an organization in Vietnam or overseas uses an offshore platform to process data collected in Vietnam.
This creates significant risk under centralized group governance models. A staff member at a regional headquarters accessing a CRM, an HR dashboard, or an analytics platform located overseas may constitute part of a cross-border data transfer activity that needs to be assessed.
As a general rule, organizations and individuals carrying out a cross-border transfer of personal data must prepare and submit a cross-border personal data transfer impact assessment dossier within 60 days from the date of the first transfer, except in cases exempted under the law and its implementing decree. This dossier must also be updated under the mechanism applicable to impact assessment dossiers.
The law provides for certain exceptions, including cases where an organization stores employees’ personal data on cloud computing services; Decree No. 356/2025/ND-CP also sets out additional scenarios, such as cross-border personnel management carried out under labor rules, regulations and collective labor agreements in accordance with law. However, companies should not extend these exceptions to conclude that all HR data or every group cloud platform is automatically exempt. The specific service structure, data category, purpose of use, labor regulations and actual access flows all need to be checked.
Before rolling out a new global system, companies should require the project team to answer in writing:
- Is the data collected in Vietnam?
- Where are the servers, platform, support team and sub-processors located?
- What access rights are granted to the parent company or affiliated entities?
- Does the data include sensitive, biometric, health, financial or online behavioral information?
- Does the transfer fall within the cases requiring an impact assessment dossier, or is there a specific exemption?
6. Incident governance and penalty exposure
Companies should treat data incidents as a crisis management issue, not merely a technical one. Breaches can originate from cyberattacks, misdirected files, misconfigured access permissions, lost devices, employees downloading data to personal devices, compromised vendors, or misuse of data.
Where a violation is detected that could harm national defense, national security, social order and safety, or infringe on the life, health, honor, dignity or property of the data subject, the controller, controller-cum-processor or third party must notify the specialized personal data protection authority no later than 72 hours from the time of detection. A processor must promptly notify the controller or controller-cum-processor.
This timeframe requires companies to have a procedure in place in advance: who receives alerts, who assesses the level of impact, who has authority to approve the notification, who liaises with the parent company and vendors, and how evidence and incident records are kept.
The risk is not limited to remediation costs and reputational damage. The law sets a maximum fine for organizations violating regulations on cross-border transfer of personal data of up to 5% of the preceding year’s revenue. If the organization had no revenue in the preceding year, or if 5% of that revenue is lower than the maximum fine of VND 3 billion, the maximum fine of VND 3 billion applies. For other violations in the field of personal data protection, the maximum fine is VND 3 billion. Decree No. 330/2026/ND-CP provides more detailed rules on administrative sanctions in the fields of cybersecurity and personal data protection.
7. Trigger points where FDI companies should review immediately
| Business event | What to check before proceeding | Departments that should be involved |
|---|---|---|
| Rolling out a global ERP, HRIS or CRM system | Cross-border data flows, the roles of group entities, the impact assessment dossier, access rights and internal contracts | IT, HR, legal, compliance, group governance |
| Installing AI cameras or biometric time-tracking | Sensitive data, notification and processing basis, physical security measures and access permissions | HR, administration, security, IT, legal |
| Engaging a payroll, recruitment or call center provider | Processing role, data processing addendum, right to use sub-processors, incident notification procedure | Procurement, HR, legal, IT |
| Launching digital advertising or a customer app | Purpose-specific consent, cookies or behavioral data, data sharing with advertising platforms | Marketing, business, IT, legal |
| M&A or restructuring | Scope of data sharing during due diligence, transfer basis, data room access controls, and the plan for continued processing after closing | Executive management, M&A team, legal, IT, HR |
8. A practical roadmap to operationalize compliance
An effective personal data protection program does not necessarily need to start with a large technology project. Companies should proceed in the following order of priority:
- Build a data map: identify the systems, data categories, data subjects, storage locations, personnel with access, and related vendors.
- Classify risk levels: prioritize sensitive data, HR data, large-scale customer data, biometric and location data, and data transferred overseas.
- Allocate legal roles: determine the controller, processor, controller-cum-processor or third party for each data flow.
- Remediate underlying documentation: review data processing notices, mechanisms for obtaining and recording consent, internal policies, data subject rights procedures, and vendor contracts.
- Complete documentation obligations: assess requirements relating to the data processing impact assessment dossier, the cross-border transfer impact assessment dossier, and dossier updates.
- Set up incident response: build a playbook, assign responsible personnel, require vendor notification obligations, and run periodic drills.
- Provide role-based training: HR, sales, marketing, IT, security and customer service staff, as well as managers, need to understand their differing risk exposure.
Small enterprises and start-ups may be permitted to defer certain obligations relating to the impact assessment dossier, dossier updates, and the designation of a personal data protection unit or personnel for five years from the effective date of the Law, but this does not apply if the enterprise provides personal data processing services, directly processes sensitive data, or has reached the threshold of 100,000 personal data subjects based on the cumulative volume of data processed. This arrangement is not a general exemption from other personal data protection obligations; FDI companies should assess their actual circumstances rather than relying solely on capital scale or headcount.
Summary
Personal data protection in Vietnam should be viewed as part of corporate governance, vendor governance and cross-border risk management. For FDI companies, the priorities are building a data map, determining the roles between the Vietnamese entity and the group, controlling consent, reviewing overseas cloud or CRM systems, completing impact assessment dossiers, and preparing incident response procedures within a short timeframe. Reviewing these matters before implementation is far less costly and disruptive than remediating them after a system is already in operation.
Frequently asked questions
1) If an FDI company only processes employee data, does it still need to comply?
Yes. HR data such as recruitment records, salary information, ID documents, bank account details, attendance data, camera footage or biometric data can all constitute personal data. If this data is uploaded to a group-wide system or overseas cloud platform, the company also needs to assess obligations relating to cross-border transfer of personal data.
2) Does consent obtained under Decree No. 13/2023/ND-CP need to be renewed?
Not necessarily. Processing activities that are already underway and for which consent or an agreement was obtained under Decree No. 13/2023/ND-CP before the Law on Personal Data Protection took effect may continue without needing to re-obtain consent or re-execute the agreement. However, companies should still review whether the purpose, data category, data recipient, or manner of processing has since changed.
3) Does using Microsoft 365, Google Workspace or a group cloud platform automatically constitute a cross-border transfer of personal data?
This cannot be concluded based on the vendor’s name alone. Companies need to check where the system is hosted, where backup copies are stored, the access rights of overseas support teams, the type of data uploaded to the platform, and the purpose of use. Using a platform located outside Vietnamese territory to process data collected in Vietnam may fall within the scope of a cross-border personal data transfer.
4) Does the service provider bear responsibility on the company’s behalf?
No. The provider bears responsibility according to its role, but the company that determines the purpose and means of processing still needs to fulfill its responsibilities as controller or controller-cum-processor. Contracts should clearly allocate responsibility, but a contract does not replace the obligation to comply with the law.
5) Does the company need to appoint a dedicated DPO?
The law requires agencies and organizations to designate a unit or personnel with adequate capacity for personal data protection, or to engage an organization or individual to provide the relevant service. Depending on scale and risk level, a company may assign dedicated personnel, staff with sufficient capacity holding the role alongside other duties, or an external service provider; the designation should be documented formally.
6) When must an incident be notified within 72 hours?
When a violation is detected that could harm national defense, national security, social order and safety, or infringe on the life, health, honor, dignity or property of a data subject, the responsible party must notify the specialized personal data protection authority no later than 72 hours from the time of detection. The assessment of the situation should be carried out immediately, with the involvement of IT, legal, and authorized management.
Conclusion
For FDI companies, compliance with personal data protection requirements needs to be integrated into technology rollout decisions, HR management, vendor selection, and the operation of group-wide systems. The focus is not merely on having a privacy policy in place, but on being able to demonstrate that the company understands, controls and governs its actual data flows.
How TT Collab can help
TT Collab can support companies in reviewing compliance gaps, building a data map, determining processing roles between the Vietnamese entity and the group, assessing cross-border data transfer activities, preparing impact assessment dossiers, reviewing vendor contracts, and designing internal procedures for data subject rights and incident response.
Legal basis referenced
- Law on Personal Data Protection No. 91/2025/QH15.
- Decree No. 356/2025/ND-CP detailing certain articles and implementing measures of the Law on Personal Data Protection.
- Decree No. 330/2026/ND-CP on administrative sanctions in the fields of cybersecurity and personal data protection.
Note: This article is provided for general information purposes only and does not replace legal, tax or investment advice tailored to any specific case. Regulations and their application may change depending on timing, locality, industry and the particular circumstances of the enterprise.
