An FDI enterprise’s “personal data protection report” is not one form filed once a year: under the Law on Personal Data Protection 91/2025, effective from 1 January 2026, and Decree 356/2025/ND-CP replacing Decree 13/2023/ND-CP, it is a bundle of event-based filing duties — the impact assessment dossier filed when processing begins, the cross-border transfer impact assessment, and the seventy-two-hour data breach notification — of which an FDI enterprise with data flowing to its parent will almost always touch all three.
When “reporting” is owed: three events generating filing duties
The first event is starting a personal data processing activity: controllers and controller-processors must prepare a personal data processing impact assessment dossier and send one copy to the Ministry of Public Security’s specialised personal data protection agency within sixty days of starting processing. The second event is transferring Vietnamese citizens’ personal data abroad — the daily routine of every FDI enterprise reporting to its parent — with a cross-border transfer impact assessment dossier also filed within sixty days of the transfer.
The third event is a personal data protection breach: on discovering a data violation, the enterprise must notify the specialised agency within seventy-two hours and notify data subjects where the breach may harm them. These three events, plus updating dossiers when contents change, form the whole current personal data “reporting regime” — an enterprise hunting for an annual deadline for it will never find one, and while hunting will already have missed its first two sixty-day deadlines.
A customer data leak: the seventy-two-hour clock
The moment a leak is discovered, two workstreams run in parallel: the technical stream — stopping the leak source, determining the data and subject scope touched, preserving logs and evidence; and the legal stream — assessing the breach level to notify the specialised agency within seventy-two hours on the prescribed form, preparing notice to affected customers and recording every decision in the incident file. Timely notification does not require knowing every detail: the initial notice states what is known and is supplemented as the investigation clarifies, while silence pending a completed investigation converts one data incident into an additional notification violation.
For an FDI enterprise, a data incident in Vietnam often simultaneously triggers duties in the parent’s country — such as GDPR’s seventy-two-hour notice where EU persons’ data is involved — with different clocks and contacts. The enterprise’s response process must draw both duty maps on one page so the handling team does not optimise for one regime while violating the other.
The in-house data apparatus: the responsible person and living dossiers
The Law on Personal Data Protection 91/2025 requires controllers and processors to designate the division and individual in charge of personal data protection, and that contact information forms part of the impact assessment dossier. For an FDI enterprise, the Vietnam-based responsible person must be a contact who can genuinely work with the specialised agency and with group data functions; a nominal appointee who does not command the data systems is a weakness exposed at the first working session with the authority.
Data dossiers are living files: whenever the enterprise changes a processing purpose, adds a data category, changes a processor or opens a new outbound data flow, the impact assessment dossier must be updated and supplemented. The compliance calendar therefore ties data duties into the system-change and new-contract processes — where duty-generating events actually arise — instead of one fixed annual filing date.
Frequently asked questions
Must an FDI enterprise report on personal data protection?
Yes, as event-based dossiers under the Law on Personal Data Protection 91/2025 and Decree 356/2025/ND-CP: a processing impact assessment dossier within sixty days of starting processing; a cross-border transfer impact assessment when transferring Vietnamese citizens’ data abroad; and a data breach notification within seventy-two hours. No standalone annual personal data report exists.
When must personal data filings be made?
At three moments: within sixty days of starting a processing activity within impact assessment scope; within sixty days of starting an outbound personal data transfer within cross-border assessment scope; and within seventy-two hours of discovering a data breach. Later changes to processing contents generate the corresponding dossier update duties.
How is a customer data leak handled?
Run two streams in parallel: technical — stop the leak source, determine scope and preserve evidence; legal — notify the specialised personal data protection agency within seventy-two hours with what is known, supplementing as the investigation clarifies, notify customers where the breach may harm them, and document the incident file fully. Waiting for a finished investigation before notifying adds a late-notification violation.
Must an FDI enterprise transferring HR data to its parent file a separate dossier?
Yes: transferring Vietnamese citizens’ personal data abroad — including employee and customer data flowing into group systems — falls into the cross-border personal data transfer impact assessment dossier, sent to the specialised agency within sixty days of the transfer under Law 91/2025 and Decree 356/2025/ND-CP. It is a separate dossier from the domestic processing impact assessment.
What is the exposure for not filing the personal data dossiers?
The enterprise faces administrative sanctions in the personal data protection field under Decree 356/2025/ND-CP, at a markedly higher sanction level than the previous regime, with measures compelling dossier completion and violation remediation; grave acts such as unlawful data trading are handled in heavier frames, including possible criminal liability under the corresponding law. The largest practical FDI risk is the file gap exposed when the authority inspects after a data incident.
Contact FLAT Law Firm
FLAT Law Firm builds the personal data filing duty map for FDI enterprises: the sixty-day calendar for impact assessments and parent-bound cross-border transfers, the seventy-two-hour breach notification process and the Vietnam data contact point.
This article has been quality-reviewed by the FLAW AI Legal Council
