Since 1 January 2026, Article 33.2 of Vietnam’s Personal Data Protection Law 91/2025/QH15 has introduced a new obligation many businesses have never encountered: designating a personal data protection unit or officer (commonly called the DPO — Data Protection Officer) or engaging an external service from a qualified organisation or individual. Not every business must act immediately — the law provides SME-specific exemptions and deferrals.
1. The general rule: designate or engage
Agencies and organisations (including household businesses) must designate a data protection unit or personnel meeting competency requirements; where designation is not possible, they must engage a data protection service provider (Article 33.2, Law 91/2025/QH15).
Personnel requirements (Article 13, Decree 356/2025/ND-CP): a college degree or higher; at least 2 years of experience in legal affairs, information technology or cybersecurity; duties clearly defined in the appointment document or job description; a signed confidentiality agreement.
2. Three groups with no exemption, regardless of size
Even micro-enterprises and household businesses must designate data protection personnel (or engage a service) from 1 January 2026 if they fall into one of three cases (Article 41, Decree 356/2025/ND-CP):
- Trading in personal data processing services: data is the core business asset (e.g. data brokers, credit scoring services, data-driven marketing);
- Directly processing sensitive personal data: health, biometric, banking/financial, location, political-opinion data (listed in Article 4, Decree 356/2025/ND-CP);
- Processing data of 100,000 or more data subjects: measured by cumulative processed volume.
3. Exemption and deferral track for small businesses
- Small businesses and startups: may opt in or out of this obligation for 5 years (1 January 2026–31 December 2030) — except the three cases in section 2;
- Household businesses and micro-enterprises: exempt indefinitely — except the three cases in section 2.
Micro/small status is determined by average annual social-insurance headcount, total revenue or total capital (Decree 80/2021/ND-CP).
4. Outsource or appoint in-house?
The law permits both models, with different competency thresholds:
- In-house personnel: college degree or higher + 2 years of legal/IT/cybersecurity experience;
- External individual provider: 3 years of experience;
- External organisational provider: at least 3 qualified personnel.
For SMEs, outsourcing is usually more economical than recruiting and training dedicated staff; for groups processing data at scale, an in-house dedicated unit (possibly combined with external counsel) is advisable.
5. Frequently asked questions
Q: Our 20-employee company only keeps HR files and a customer contact list. Must we appoint a DPO?
A: If none of the three cases in section 2 applies and you qualify as a small business, you may defer for 5 years (until 31 December 2030).
Q: What is the penalty for failing to appoint a DPO?
A: It violates personal data protection obligations and may draw administrative sanctions under Decree 330/2026/ND-CP (effective 19 August 2026).
Q: Must we establish a separate “data protection department”?
A: No. The law only requires designating a unit or personnel (which may be part-time) meeting competency requirements — a standalone department is not mandatory.
Need to determine whether your business must appoint a DPO now or may defer? Contact us for advice.
This article was prepared by the FLAW AI Legal Council. The content is pending QA Council review before submission for approval; information is for reference only and does not replace legal advice for your specific case.
