DPIA for FDI Enterprises in Vietnam: When Is It Mandatory?

Must an FDI enterprise prepare a Data Protection Impact Assessment (DPIA)? Under Law on Personal Data Protection 91/2025/QH15 (effective 1/1/2026) and Decree 356/2025/ND-CP, the answer is: almost certainly yes — because of five FDI-specific triggers. This article offers a five-question self-check matrix, distinguishes the two easily confused filings, explains the 60-day timeline, and outlines sanctions.

Legal Basis

Law 91/2025/QH15 (effective 1/1/2026): Article 21 (DPIA); Article 20 (cross-border personal data transfer).
Decree 356/2025/ND-CP (effective 1/1/2026): Article 19 (DPIA dossier — prepare, retain, submit one original within 60 days, Form No. 10); Articles 17–18 (cross-border transfer).
Sanctions: Article 55, Decree 330/2026/ND-CP (issued 19/8/2026).

Five-Question Self-Check: Does Your FDI Company Need a DPIA?

A “YES” to any question below means the company almost certainly must prepare a DPIA dossier:

#	Self-check question	Why it matters
1	Do you transfer personal data to the overseas parent / headquarters?	The most common FDI trigger: HR reports, customer data, operational data sent to HQ.
2	Do you use offshore platforms to process personal data collected in Vietnam (global HR/ERP systems, foreign cloud)?	Art. 20(3), Law 91/2025: processing Vietnam-collected data on offshore platforms.
3	Do you process sensitive personal data?	Per Art. 4, Decree 356/2025 (e.g., biometric, health, financial data).
4	Is the processing scale 100,000+ data subjects?	The threshold losing small-business exemptions.
5	Have data processing activities changed since the last assessment (expanded scope, new purposes, new systems)?	Must update every 6 months when changes occur.

Two Filings Compared: DPIA vs Cross-Border Transfer Assessment

Criterion	DPIA dossier (Art. 21)	Cross-border transfer impact assessment (Art. 20)
Scope	All of the company’s personal data processing	Only cross-border transfers
Frequency	Once for all processing; update on change	Prepared when transfers begin; not one dossier per transfer batch
Filing deadline	Submit one original within 60 days (Art. 19, Decree 356/2025, Form No. 10)	File within 60 days of the first transfer
Retention	Kept at the company; produced on inspection	Kept at the company

The 60-Day Timeline: Key Milestones

Before processing / before transferring: prepare the impact assessment dossier.
Within 60 days: submit one original DPIA dossier to the competent authority (Form No. 10, Decree 356/2025).
Every 6 months: update the dossier when processing activities change.
On inspection: produce the dossier retained at the company.

Exemptions & Two Common Misunderstandings

Exemptions (Article 20(6))

State agencies performing statutory duties;
Storing employees’ personal data on cloud — exempt from the cross-border assessment dossier, but DPIA is still required;
Data subjects transferring their own data abroad.

Misunderstanding 1: “Storing HR data on cloud exempts everything”

Wrong. The exemption covers only the cross-border assessment; the DPIA obligation for data processing generally remains.

Misunderstanding 2: “Each data transfer needs a new dossier”

Wrong. The DPIA is prepared once for all processing activities and updated on change — not re-prepared per transfer batch.

Sanctions (Article 55, Decree 330/2026/ND-CP)

VND 20–30 million: failure to prepare or submit the impact assessment dossier as required.
VND 50–100 million: falsifying the assessment dossier.
Remedial measure: ordered suspension of the violating data processing.

Action Checklist for FDI Companies

☐ Answer the five-question matrix — determine DPIA applicability.
☐ Clearly distinguish the two filings (DPIA Art. 21 vs cross-border Art. 20).
☐ Prepare the DPIA dossier per Form No. 10 (Decree 356/2025); submit one original within 60 days.
☐ Map data flows to the parent company / global HR-ERP systems / foreign cloud.
☐ Schedule 6-monthly updates when changes occur.

Disclaimer: General information under Law 91/2025/QH15, Decree 356/2025/ND-CP, and Decree 330/2026/ND-CP, as of publication. Each company’s actual data flows require individual review before preparing dossiers; please verify original texts and consult specialists before applying.

Content reviewed by the FLAW AI Legal Council — an AI council with the mindset of seasoned lawyers. This is not the opinion of a human lawyer and does not replace direct legal advice.

This article has been reviewed by the QA Council.

For personal-data compliance review or DPIA preparation, please contact FLAT Law Firm.