Opening warning: if your Chinese enterprise in Vietnam is still complying with personal data protection under Decree 13/2023/ND-CP — you are following an instrument that expired on 1 January 2026. From that date, the new framework of the Law on Personal Data Protection 91/2025/QH15 and Decree 356/2025/ND-CP governs everything — with a new sanction regime effective from 19 August 2026.
This article provides a 6-item compliance checklist for Chinese enterprises in Vietnam — from data-subject consent, DPIA filing, cross-border transfers to parent companies in China, to appointing data-protection personnel — plus 3 common mistakes by Chinese firms.
1. Why Chinese enterprises are in the risk zone
- Decree 13/2023/ND-CP expired on 1 January 2026 (per Article 42.2 of Decree 356/2025/ND-CP) — the number-one “old citation trap”: most Chinese firms still operate under the old framework.
- Law 91/2025/QH15 (effective 1 January 2026): Article 2 extends scope to foreign organizations and individuals in Vietnam — Chinese enterprises are squarely covered.
- New sanctions from 19 August 2026: Decree 330/2026/ND-CP on administrative penalties for personal data violations, with much heavier fines (see section 4).
2. The 6-item core compliance checklist
(a) Re-audit data-subject consent
Under Articles 9 and 11 of Law 91/2025, consent must be given before processing, be voluntary, and be purpose-specific — and silence does not constitute consent. Bundled “consent” forms, pre-ticked checkboxes, or “continued use means consent” clauses all fail the new standard. Audit every data-collection form (recruitment, customers, internal WeChat Work/DingTalk, etc.).
(b) Prepare and file the DPIA
Under Article 21 of Law 91/2025 and Article 19 of Decree 356/2025: organizations must prepare a Data Protection Impact Assessment dossier, keep it at the head office, and submit one original to the specialized authority within 60 days of starting personal data processing (per Form No. 10); update every 6 months when changes occur. The most commonly missed obligation.
(c) Dossier for cross-border transfers to the parent company in China
The signature pain point for Chinese firms: reporting HR/finance data to headquarters, using WeChat Work, DingTalk, or China-based cloud. Under Article 20 of Law 91/2025 and Articles 17–18 of Decree 356/2025, transferring personal data outside Vietnam’s territory falls into 3 cases requiring a separate impact assessment dossier filed within 60 days:
- Storing personal data outside Vietnam’s territory;
- Transferring personal data to overseas organizations or individuals;
- Using offshore platforms to process data collected in Vietnam.
Exemptions (Article 20(6)): state agencies performing official functions; storing employees’ personal data on cloud platforms; cases where the data subject transfers their own data abroad.
(d) Appoint the data-protection unit/personnel
Under Articles 13–14 of Decree 356/2025, data-protection personnel must hold at least a college degree, have ≥ 2 years of relevant experience, and have received professional training in data protection. A nominal appointment of an admin staffer without these qualifications will not pass.
(e) Breach-notification and data-subject rights procedures
Build internal procedures: receiving and handling data-subject requests (access, correction, deletion, consent withdrawal, objection to processing, etc.); notifying breaches of data protection rules to the competent authority and affected subjects within statutory deadlines.
(f) Periodic updates
DPIA dossiers and cross-border transfer dossiers must be reviewed and updated every 6 months when purposes, processing methods, or data recipients change.
3. Three common mistakes by Chinese enterprises
- “We comply with Decree 13/2023”: expired since 1 January 2026. All internal processes built on Decree 13 must be re-audited under Law 91/2025 + Decree 356/2025.
- Syncing data to the parent company without a dossier: pushing HR/customer data to China-based systems (WeChat Work, DingTalk, Chinese cloud) is a cross-border transfer — it requires its own impact assessment dossier; it cannot be done quietly.
- Data-protection staff from HQ who don’t qualify: assigning headquarters personnel who fail the qualification/experience/training standards of Articles 13–14 of Decree 356/2025, or who don’t understand Vietnamese law.
Quick comparison: Decree 13/2023 vs Law 91/2025
| Item | Decree 13/2023 (expired) | Law 91/2025 + Decree 356/2025 |
|---|---|---|
| Effectiveness | Expired 1 Jan 2026 | Effective from 1 Jan 2026 |
| Consent | General rules | Prior, voluntary, purpose-specific; silence ≠ consent |
| DPIA | Impact assessment dossier | Prepare + keep at HQ + file with authority within 60 days (Form 10) |
| Cross-border transfer | Under Decree 13 | 3 cases + separate assessment dossier (Art. 20 Law; Arts. 17–18 Decree 356) |
| Sanctions | Old framework | Decree 330/2026 (from 19/8/2026): up to VND 3bn/org; data trading up to 10× illicit gains |
4. New sanction regime (from 19 August 2026)
Decree 330/2026/ND-CP (effective 19 August 2026) — notable fines under Article 55:
- VND 20–30 million: violations on DPIA dossiers;
- VND 50–100 million: falsifying data or documents in dossiers;
- Forced suspension of data processing for serious violations;
- Other violations: fines up to VND 3 billion per organization;
- Trading in personal data: fines up to 10× the illicit gains.
5. Five-year exemption note for small businesses
Decree 356/2025 allows small businesses and startups to opt out of Articles 21, 22 and Article 33(2) of the Law for 05 years — except businesses providing data-processing services, directly processing sensitive personal data, or processing data of 100,000+ data subjects. Mid-sized Chinese firms should self-assess whether they qualify.
6. Recommended 90-day roadmap
- Days 1–30: map all data flows (where collected, where stored, where transferred — especially flows to China); audit existing consent forms.
- Days 31–60: prepare the DPIA dossier; prepare the cross-border transfer impact assessment; appoint/train data-protection personnel.
- Days 61–90: file dossiers with the specialized authority (within the 60-day window from starting processing); issue internal procedures; company-wide training.
7. Frequently asked questions
Is Decree 13/2023 still effective?
No. Expired on 1 January 2026 per Article 42.2 of Decree 356/2025/ND-CP. The current framework is Law 91/2025 + Decree 356/2025.
Our China HQ requests employee data — allowed?
Yes, but you must prepare a cross-border transfer impact assessment dossier and file it within 60 days (Article 20, Law 91/2025; Articles 17–18, Decree 356/2025), with valid employee consent in place.
Is using WeChat Work/DingTalk a violation?
Using the platforms is not banned per se, but if personal data collected in Vietnam is processed on offshore platforms, that is a cross-border transfer — follow the corresponding procedures.
8. Legal bases (as of 14 October 2026)
- Law on Personal Data Protection 91/2025/QH15 — effective 1 January 2026: Article 2 (scope), Articles 9, 11 (consent), Article 20 (cross-border transfer), Article 21 (DPIA).
- Decree 356/2025/ND-CP — effective 1 January 2026: Articles 13–14 (DP personnel), Articles 17–19 (transfers, DPIA), Article 42.2 (repealing Decree 13/2023).
- Decree 330/2026/ND-CP — effective 19 August 2026: administrative penalties for data protection violations (Article 55).
This article is general information, not legal advice for specific cases; businesses should review with counsel before deploying cross-border data flows.
Contact us
FLAT Law Firm (China Desk) helps Chinese enterprises in Vietnam audit personal data compliance and prepare DPIA and cross-border transfer dossiers. Reach us via our contact page.
Transparency note — FLAW AI Legal Council: This article was prepared by the FLAW AI Legal Council and has not been reviewed by a human lawyer. It is general information and does not replace legal advice for specific cases.
This article is awaiting review by the QA Council.