A personal data protection impact assessment — DPIA in international usage — is the dossier the enterprise must prepare itself and file with the specialised agency within sixty days of starting data processing under the Law on Personal Data Protection 91/2025. The FDI enterprise’s practical questions are not “must we do it” but “which of our activities are in scope, what the dossier contains, and does one filing cover every system” — three questions deciding the enterprise’s whole data compliance programme.
When an impact assessment is required: the default principle is yes
Under the Law on Personal Data Protection 91/2025 and Decree 356/2025/ND-CP, personal data controllers and controller-processors must prepare a processing impact assessment dossier for their processing activities and send it to the Ministry of Public Security’s specialised personal data protection agency within sixty days of starting processing. Unlike some international regimes requiring DPIA only for high-risk processing, the Vietnamese regime builds the impact assessment dossier as a foundation duty for organisations’ personal data processing, so the enterprise should start from the assumption of a dossier per main processing system and narrow only on clear grounds.
Typical FDI activities all sit in this scope: human resources administration with hundreds of employees’ data, CRM and sales with customer data, face or fingerprint time-attendance — biometric data in the sensitive category — surveillance cameras, and e-commerce platforms. Classifying each system by ordinary data, sensitive data and impact level on subjects is the opening step of the dossier itself.
What the assessment contains: the structure of one dossier
The impact assessment dossier on the prescribed form comprises: information on the controller, the processor and the division and individual in charge of data protection; processing purposes and the legal basis of each; the personal data categories processed and data subject groups; data recipients, including outbound transfer flows where any; retention periods and deletion schedules; the technical and organisational protection measures in place; and the enterprise’s own assessment of the likelihood and severity of harm to data subjects with mitigation measures.
The dossier’s real value sits in its last two parts — protection measures and the risk self-assessment — because those are what the specialised agency reads to judge the enterprise’s readiness. A dossier complete in administrative information but generic in protection measures will be rated as not yet an assessment. The enterprise must also note that the cross-border transfer impact assessment is a separate dossier where an outbound data flow exists, not merged into the domestic processing dossier.
Must it be filed with the state, and the exposure for not doing it
Yes: one copy of the dossier must be sent to the specialised personal data protection agency within the sixty-day period, and that agency may require supplementation and completion where the dossier falls short; the enterprise keeps the full set at its office for inspection. Where processing changes materially — a new purpose, a new data category, a new processor — the dossier must be updated and re-filed, so the true duty is a cycle living with the system’s life rather than a one-off filing at establishment.
Not preparing the dossier, preparing it with wrong contents or filing it late is an administrative violation in the personal data protection field sanctioned under Decree 356/2025/ND-CP, at a markedly higher level than the former Decree 13/2023/ND-CP, with measures compelling dossier completion. The larger strategic risk beyond the fine is that a missing DPIA is discovered exactly when the enterprise is weakest — when a data incident or a subject complaint brings the specialised agency in to inspect the entire data programme.
Frequently asked questions
When must an FDI company conduct a data protection impact assessment?
The Vietnamese regime’s principle under Law 91/2025 and Decree 356/2025/ND-CP is that controllers and controller-processors prepare an impact assessment dossier for their processing activities: human resources, customers, marketing, cameras, biometric attendance and every other organised data processing system. Start from the assumption of one dossier per main processing system, with ordinary and sensitive data classification inside the dossier itself.
What does the impact assessment contain?
Controller, processor and data protection contact information; processing purposes and legal bases; data categories and subject groups; data recipients including outbound flows where any; retention periods and deletion schedules; technical and organisational protection measures; and a self-assessment of the likelihood and severity of harm to data subjects with mitigation — the last two parts decide the dossier’s quality.
Must the impact assessment dossier be filed with the state?
Yes: the enterprise sends one copy to the Ministry of Public Security’s specialised personal data protection agency within sixty days of starting processing, keeps the full set at the enterprise for inspection, and updates and supplements it when processing changes materially. The specialised agency may require completion of a dossier that falls short.
What is the penalty for not conducting an impact assessment?
The enterprise faces administrative sanctions under Decree 356/2025/ND-CP in the personal data protection field — a sanction level markedly above Decree 13/2023/ND-CP — and is compelled to complete the dossier. The heavier consequence is that, on a data incident or complaint, a missing impact assessment turns an incident inspection into an audit of the enterprise’s entire data compliance programme.
Can one impact assessment dossier cover every system?
It should not: each processing system has different purposes, data categories, recipients and protection measures, so the dossier must reflect each processing activity or each homogeneous activity group. A single generic enterprise-wide dossier is usually empty in the protection measures and risk self-assessment parts — exactly the two parts the specialised agency reads most closely. A system with outbound data flow additionally needs its own cross-border transfer assessment dossier.
Contact FLAT Law Firm
FLAT Law Firm builds the personal data impact assessment programme for FDI enterprises: the processing system map with sensitive data classification, per-system dossiers on the prescribed form, separate cross-border dossiers and the update mechanism when processing changes.
This article has been quality-reviewed by the FLAW AI Legal Council
