A Chinese group with a Vietnamese subsidiary runs at least two cross-border data flows every day: employee, customer and operational data flowing from Vietnam into the parent’s systems, and governance and technical data flowing back. Both flows are regulated simultaneously by the laws of two countries whose mechanisms were not designed to fit each other.
The China side: two layers of duties on the parent
The first layer comes from China’s Data Security Law of 2021, which builds a data classification system by importance level, under which important data and data touching national security face strict controls, including risk assessment when provided abroad in cases prescribed by law. For the parent, the practical issue is that data received from the Vietnamese subsidiary, once aggregated and processed in China together with data from other subsidiaries, can touch classified data groups, especially in sectors with infrastructure elements or large-scale personal data.
The second layer comes from China’s Personal Information Protection Law, commonly called the PIPL. Article 38 of that law requires transfers of personal information out of China to pass through one of three mechanisms: a security assessment organised by the cyberspace administration, a standard contract for outbound personal information transfers, or personal information protection certification as prescribed. The 2024 rules easing cross-border data flows added application thresholds and exemptions for each mechanism; this article records the existence of that threshold system at mechanism level, and enterprises should check the specific thresholds against the rules in force at the time of transfer rather than rely on figures remembered from earlier years.
The Vietnam side: the transfer dossier under the new law
In Vietnam, the Personal Data Protection Law 91/2025/QH15 together with Decree 356/2025/ND-CP replacing Decree 13/2023/ND-CP from 1 January 2026 raised the personal data protection framework into a statute with a dedicated regime for transferring personal data abroad. The transferring party must prepare an impact assessment dossier for the cross-border personal data transfer, describing data types, data subjects, the overseas recipient, protection measures and risk assessment, and send it to the specialised personal data protection authority under the Ministry of Public Security as prescribed, updating the dossier when the transfer activity changes.
For the Vietnamese subsidiary this duty applies to the group’s most familiar internal flows: synchronising employee records into the parent’s management system, moving customer data into a customer relationship platform hosted in China, and granting remote access for overseas technical teams into systems holding personal data in Vietnam. That the recipient is the parent company does not reduce the duty; Vietnamese law views the transaction as an outbound data transfer to an independent recipient, regardless of the ownership relation between the two sides.
The subsidiary must also secure the legal basis for processing at the collection stage in Vietnam, including notice and data subject consent under the new law in prescribed cases, data subject rights enforceable in Vietnam, and the duty to notify the specialised authority of data incidents within the statutory period when a breach occurs. Without that foundation at collection, an otherwise well-drafted transfer impact dossier stands on a pre-existing legal weakness.
Typical conflict points and how to design a common policy
The first conflict sits in two-ended assessment: the same data flow may need an impact assessment in Vietnam before transfer and, depending on the chosen mechanism, a security assessment or standard contract in China for onward transfer, with different criteria and receiving authorities. The third conflict sits in incident reporting duties: deadlines, content and receiving authorities in the two countries do not coincide, and one incident at the subsidiary can trigger duties at both ends simultaneously.
The group’s common data policy should therefore be built as one framework with two country annexes: the common framework sets unified data classification, minimisation principles and access controls; the Vietnam annex handles the transfer impact dossier, consent mechanics and incident reporting under Vietnamese law; the China annex handles important data classification and the choice of PIPL transfer mechanism..
Frequently Asked Questions
How do China’s Data Security Law and PIPL applying to the parent affect data sharing with the Vietnamese subsidiary?
The most direct effect is that every flow of personal data from China to the Vietnamese subsidiary is an outbound personal information transfer under the PIPL and must rest on a lawful mechanism, while data the parent aggregates from many subsidiaries can touch important data groups under the Data Security Law and attract additional control. In the reverse direction, the parent’s receipt of data from Vietnam is not exempted under Chinese law merely because it is an intra-group transaction. Groups should map every data flow in both directions rather than treat the internal network as a legally neutral space.
Must the Vietnamese subsidiary’s data, when transferred to China, pass a data security assessment on the Chinese side?
The two ends of the transaction must be distinguished. At the Vietnam end, transferring personal data to the parent requires a cross-border transfer impact assessment dossier under Law 91/2025, sent to the specialised authority as prescribed. At the China end, a security assessment by the cyberspace administration is one of the three mechanisms of PIPL Article 38, mandatory only in cases reaching thresholds or falling within prescribed categories; other cases may use the standard contract or certification, and the 2024 easing rules carry their own exemptions. The answer therefore depends on data type, scale and the mechanism chosen at the China end; it cannot be said that every transfer passes a security assessment.
Where do Vietnam–China two-way data transfer compliance requirements conflict?
Three typical conflict points are: the same data flow must pass assessment procedures at both ends with different criteria and authorities; storage and local processing requirements for certain specially managed data groups in each country strain a centralised system architecture; and incident reporting duties differ in deadline, content and recipient, so one incident at the subsidiary triggers two unsynchronised processes at once. In addition, consent mechanics and data subject rights differ in scope between the two countries, so one group-wide notice template usually fails the standard at at least one end.
How does a group design a common data policy meeting both Vietnam’s Law 91/2025 and the PIPL?
The durable design is one common policy framework with a separate annex for each country. The common framework unifies data classification, minimisation in collection, access control and security standards. The Vietnam annex governs the transfer impact assessment dossier, filing to the specialised authority, consent mechanics and incident reporting under Vietnamese law. The China annex governs important data classification, the choice among the three PIPL transfer mechanisms for each flow out of China, and applicable exemptions. Every cross-border data flow needs one line in the group’s data map stating the lawful mechanism at both ends before technical systems are connected.
An invitation for groups with a Vietnamese subsidiary
If your group is synchronising employee, customer or operational data between the parent in China and the subsidiary in Vietnam on shared systems, FLAT Law Firm can work with your compliance team to map the two-way data flows against the systems actually in operation: which flows need an impact dossier in Vietnam, which need a transfer mechanism chosen at the China end, and where the current common policy fails the standard in one of the two countries. The first working session starts from the group’s real system diagram, not from a generic policy template.
This article has been quality-reviewed by the FLAW AI Legal Council