Many Vietnamese businesses store customer data on foreign cloud platforms (AWS, Google Cloud, Azure, and others). From 1 January 2026, this is no longer a purely technical matter: under the Personal Data Protection Law 91/2025/QH15, using a foreign cloud counts as cross-border personal data transfer and triggers a series of legal obligations. Here are 5 points to note when signing agreements with foreign cloud providers.
1. Using a foreign cloud = cross-border data transfer
Under Point c, Clause 1, Article 20 of the Personal Data Protection Law 91/2025/QH15, storing and processing personal data on cloud infrastructure located outside Vietnam is identified as cross-border personal data transfer. The consequence: the business must prepare a cross-border transfer impact assessment dossier and submit it to the specialized personal data protection authority within 60 days from the date processing begins (Clause 2, Article 20).
Note: do not cite Article 34 of Decree 13/2023/ND-CP as the basis for this obligation — from 1 January 2026, Law 91/2025 applies.
2. Exception: the organization’s own employee data is exempt from the impact assessment
Point b, Clause 6, Article 20 provides an important exception: where an organization stores personal data of its own employees on the cloud, it is exempt from preparing the cross-border transfer impact assessment dossier.
However, this exception is narrow: if the same cloud infrastructure also stores customer or partner data, the business must still fully perform the impact assessment obligation for that data.
3. A data processing contract is mandatory — and must come BEFORE any data handover
Under Point a, Clause 2, Article 37 of Law 91/2025, a data processor may only receive personal data after an agreement or contract on personal data processing has been concluded with the data controller. In other words: the contract must be signed before any data is moved to the provider’s cloud.
On terminology: in formal Vietnamese legal content, use the proper Vietnamese term “thỏa thuận, hợp đồng về xử lý dữ liệu cá nhân” (agreement/contract on personal data processing) — do not use the abbreviation “DPA” in the main legal text.
4. Cloud security clauses: proper purpose, limited scope, authentication and authorization
Article 30 of Law 91/2025 (cloud computing) requires cloud data processing to follow the agreed purposes and stay within the necessary scope, while applying technical measures such as authentication and access authorization. When negotiating, businesses should turn these requirements into specific binding clauses for the provider: who may access the data, for what purpose, how long access logs are kept, and how data is handled upon contract termination.
5. Vietnam data localization under the 2025 Cybersecurity Law
Alongside the Personal Data Protection Law, Clause 2, Article 25 of the Cybersecurity Law 116/2025/QH15 (effective 1 July 2026) provides the data localization in Vietnam obligation for cases within its scope. Businesses using foreign clouds need to check whether they fall within the localization scope and design their storage architecture accordingly.
Validity note: do not cite Article 26 of the 2018 Cybersecurity Law — that law has expired; the current basis is Law 116/2025.
Frequently asked questions
If only internal HR data is stored on a foreign cloud, is an impact assessment dossier required?
No — storing only the organization’s own employee data is exempt under Point b, Clause 6, Article 20. But adding customer data triggers the full obligation.
Can we sign the cloud contract first and add data protection clauses later?
Not advisable. Point a, Clause 2, Article 37 requires the processor to receive data only after the personal data processing agreement or contract exists.
Can “DPA” be used in a Vietnamese-language contract?
In formal legal content, use the Vietnamese term “thỏa thuận, hợp đồng về xử lý dữ liệu cá nhân” per Article 37 of Law 91/2025.
Sources
- Personal Data Protection Law 91/2025/QH15 — effective 1 January 2026: Article 20 (cross-border transfer), Articles 21–22 (impact assessment), Article 30 (cloud computing), Article 37 (data processing contracts);
- Cybersecurity Law 116/2025/QH15 — effective 1 July 2026: Clause 2, Article 25 (data localization in Vietnam);
- Decree 333/2026/ND-CP: Articles 19 and 20.
Conclusion
Using a foreign cloud from 1 January 2026 means cross-border data transfer: prepare an impact assessment dossier and submit it within 60 days (except for the internal employee-data exception), sign the data processing agreement before handing over data, tighten security, authentication and authorization clauses, and check the Vietnam localization duty under Cybersecurity Law 116/2025. Addressing these 5 points before signing keeps the business compliant from day one.
Is your business using a foreign cloud and needs its data processing contracts reviewed? Contact FLAT Law Firm for advice.
For reference only; not legal advice. This content was prepared by AI and will undergo quality review by the AI Legal Council of FLAT Law Firm before any publication consideration; it is not the legal opinion of a licensed human lawyer. Laws and regulations may change; verify the current legal texts before applying them.
