From 1 January 2026 the personal-data processing impact assessment (DPIA) file is no longer a decree-level formality but a statutory duty under Article 21 of Personal Data Protection Law 91/2025/QH15. Enterprises familiar with the Decree 13/2023 templates need to know exactly what changed: who must prepare the file, how updates now work, and where the cross-border transfer assessment has gone.
Governing Instruments
Article 21 of Law 91/2025: who files, and by when
Clause 1, Article 21 of Law 91/2025 requires personal data controllers and controller-processors to prepare and store a processing impact assessment file and send one original to the specialised personal data protection authority within 60 days of the first day of processing, save for the state-authority case in Clause 6. Compared with Article 24 of Decree 13/2023/ND-CP — which likewise set a 60-day, one-original filing to the Department of Cyber Security and High-Tech Crime Prevention (A05) of the Ministry of Public Security — the substantive novelty sits in Clause 3: processors must now also prepare and store an impact assessment file under their agreement with the controller, instead of merely being named inside the controller’s file as under the decree regime.
Clause 2 keeps the one-time principle for the whole life of the organisation, but updates are now routed through Article 22 of the Law — periodic updates and updates whenever the file’s content changes (Clause 5), with the authority empowered to assess the file and require its completion under Clause 4. File composition, conditions and procedure are delegated to the Government in Clause 7 and are now specified in Decree 356/2025/ND-CP, which replaced Decree 13/2023 from 1 January 2026 — so the forms used from 2026 are the new framework’s forms, not those issued with Decree 13/2023.
The cross-border part is now a separate file
Under Decree 13/2023 an enterprise ran two files in parallel: the processing impact assessment (Article 24) and the outbound transfer impact assessment (Article 25, form D25-DLCN-04). Law 91/2025 keeps the two-file structure but elevates both into statute: the processing file in Article 21 and the cross-border transfer file in Article 20 — including the exemptions from the transfer file in Clause 6 of Article 20 (transfers by competent state authorities; storing employees’ personal data on cloud services; data subjects transferring their own data; and other cases prescribed by the Government). When reviewing legacy files, enterprises must separate these two duties instead of treating the DPIA as one file covering everything.
Application Analysis
The most-asked transition question is whether a file lodged under Decree 13/2023 must be redone. Law 91/2025 sets no separate transition deadline and does not void legacy files; Articles 21–22 operate continuously — the file is made once and updated periodically and upon change. The legally sound approach is to review the existing file against the new structure at the first update cycle after 1 January 2026: add the processor-side file if none exists, split out and complete the Article 20 transfer file if there are transfer flows, and switch to the Decree 356/2025 forms when filing the update. An enterprise that never filed under the old regime has nothing to “convert” — the duty to prepare and send within 60 days of first processing applies to it directly under the new law.
On content, the new-law file demands two blocks that the old templates often treated superficially. First, the data protection organisation: the new framework gives statutory status to the enterprise’s personal data protection unit and personnel, so the file must identify that function rather than a mere administrative contact. Second, the risk assessment of the cross-border transfer itself where transferring is part of the processing — the overseas recipient, the binding responsibility documents between the parties and the safeguards — because Article 20 turns this content into a stand-alone file that can be inspected separately (the specialised authority may inspect transfers periodically, no more than once a year, or extraordinarily, under Clause 4 of Article 20).
Recommended Actions
- Map the existing DPIA file against Article 21 of Law 91/2025 clause by clause: filing entity, the 60-day mark, the processor-side file, the Article 22 update mechanism.
- Separate out the Article 20 duty wherever a cross-border transfer flow exists; test the Clause 6 exemptions before preparing a transfer file.
- Switch to the Decree 356/2025/ND-CP forms when filing the first update after 1 January 2026; do not file again on the expired Decree 13/2023 templates.
- Add the data protection organisation block (responsible unit and personnel) and the processor agreements to the file.
- Calendar the periodic Article 22 updates and set triggers for immediate updates on any change of system, vendor or processing purpose.
Frequently Asked Questions
How does the DPIA file under Law 91/2025 differ from the Decree 13/2023 template?
Three main differences. First, broader filers: Clause 3, Article 21 of Law 91/2025 obliges processors also to prepare and store a file under their agreement with the controller, whereas Decree 13/2023 centred the duty on controllers and controller-processors. Second, updates are codified in Article 22 — periodic updates and updates upon content change, replacing the decree regime’s scattered approach. Third, file composition and procedure moved to the Government framework under Clause 7, Article 21, now specified by Decree 356/2025/ND-CP which replaced Decree 13/2023 from 1 January 2026. What did not change is the filing mark: one original to the specialised authority within 60 days of the first day of processing.
Must a file prepared on the old template be redone under the new law, and what is the transition deadline?
Law 91/2025 sets no separate transition deadline and does not require starting over: the mechanism in Articles 21–22 is a file made once and updated continuously. What the enterprise must do is, at the first update cycle after 1 January 2026, review and complete the file to the new structure — the processor-side file, the Article 20 transfer file if any, and the Decree 356/2025 forms. Conversely, an enterprise that never filed under Decree 13/2023 applies the Clause 1, Article 21 mark of 60 days from its first day of processing under the new law directly.
What content is added on cross-border transfers and on the data protection organisation?
On transfers: this content is no longer a section inside the processing file but a stand-alone file under Article 20 — covering the transferor, the overseas recipient, data types, purposes, safeguards and the document binding the parties’ responsibilities; the Clause 6 exemptions must be tested before preparing it. On the data protection organisation: the new-law file must show the enterprise’s personal data protection unit and responsible personnel — the function that runs the file, receives data-subject requests and deals with the specialised authority — instead of the purely administrative contact information of the old template.
Where is the DPIA file sent, and how is it updated when processing changes?
The file goes to the specialised personal data protection authority — under the current structure, the Department of Cyber Security and High-Tech Crime Prevention (A05) of the Ministry of Public Security — one original within 60 days of the first day of processing (Clause 1, Article 21). The authority may assess the file and require completion if it is deficient (Clause 4). When processing changes — new system, new processor, new purpose or a new outbound flow — the enterprise updates and supplements the file under Clause 5, Article 21 and the Article 22 mechanism, alongside the periodic statutory update cycle; the Article 20 transfer file must be updated in parallel.
