How much does a Data Protection Impact Assessment (DPIA) cost in Vietnam? The short answer may surprise many businesses: the law imposes zero state fees for preparing and filing a DPIA. But “zero state fees” does not mean “zero cost” — the real costs fall into five entirely different groups.
A note on the legal framework: Decree 13/2023/ND-CP expired on 1 January 2026 (per Article 42.2 of Decree 356/2025/ND-CP). This article is updated under the Law on Personal Data Protection 91/2025/QH15 and Decree 356/2025/ND-CP (both effective 1 January 2026).
1. The DPIA obligation under the new rules
Under Article 21 of Law 91/2025/QH15 and Article 19 of Decree 356/2025/ND-CP, personal data processors must:
- Prepare an impact assessment dossier for personal data processing;
- Keep it at their head office;
- Send one original copy to the specialised personal-data-protection authority within 60 days from the start of processing (using Form No. 10 in the Appendix to Decree 356/2025);
- Update it every 6 months when assessed contents change.
Preparing and filing this dossier attracts no state fees — a review of Decree 356/2025 and the current fee system shows no charge for the DPIA procedure.
2. The five real cost groups businesses actually pay
| Cost group | Contents | Who pays |
|---|---|---|
| 1. Compliance personnel | Staffing a data-protection function (Articles 13–14, Decree 356/2025): salaries, training, certification | All data processors |
| 2. Legal counsel | Engaging counsel to draft the DPIA, map data flows, classify basic vs. sensitive personal data (Articles 3–4, Decree 356/2025) | Businesses lacking in-house capacity |
| 3. Technical systems | Security measures: encryption, access control, processing logs, dossier storage systems | Depends on processing scale |
| 4. Ongoing updates | Updating the dossier every 6 months when changes occur; periodic staff training | All data processors |
| 5. Non-compliance risk | Fines up to VND 30 million plus forced suspension of processing (see section 4) | Violating businesses |
3. In-house or outsourced?
Doing it in-house suits businesses whose legal/IT teams already understand their data flows: costs are mainly internal staff time. The risk is a shallow dossier, misclassified sensitive data, or non-conformity with Form No. 10 — leading to rework when the authority requests supplementation.
Engaging counsel suits businesses processing sensitive data, large-scale data, or preparing a DPIA for the first time: service fees are market-based (no state price), in exchange for a compliant dossier and a proper data-flow review. Advisory fees are indicative only, agreed with each provider.
4. The price of doing nothing: fines up to VND 100 million
Under Article 55 of Decree 330/2026/ND-CP (effective 19 August 2026):
- VND 20–30 million for failing to prepare or file the impact assessment dossier;
- VND 50–100 million for falsifying figures or documents in the dossier;
- Additional sanction: forced suspension of data processing — business interruption usually costs far more than the fine itself.
5. Exemptions: small businesses and startups
Decree 356/2025/ND-CP provides an exemption mechanism: small enterprises and startups may opt out of Article 21 of Law 91/2025 (the DPIA duty) for 5 years — except where they: provide personal-data-processing services; process sensitive personal data; or process data of 100,000 data subjects or more.
Businesses should self-assess their exemption eligibility before committing resources to a dossier.
6. Conclusion
A DPIA costs no “state fee” but real compliance money: personnel, counsel, technical systems and periodic maintenance. Against fines of up to VND 100 million plus the risk of forced processing suspension, doing it right from the start is always the cheaper option.
Read more: 5 notes on handling personal data of departed employees.
If your business needs a DPIA review under the 2025 Law on Personal Data Protection, contact FLAT Law Firm for advice.
This article has been reviewed by the QA Council.
Transparency note: this article was prepared by the FLAW AI Legal Council based on legislation in force at the time of writing (14 October 2026). It is for general information only and does not replace legal advice for your specific business. Market advisory fees are indicative only, agreed with each provider.
