Vietnamese payroll sits on an HR system hosted in Germany; headcount reports go to a US parent quarterly. Every cross-border HR data flow is a legal duty — this is the playbook for making those flows lawful.
Common HR data flows
FDI businesses in Vietnam typically run four cross-border HR data flows:
- Management reporting: headcount, pay, bonuses, attrition — to the parent monthly/quarterly.
- Centralised HR systems: Workday/SAP SuccessFactors on servers outside Vietnam — Vietnamese staff enter data directly into the global system.
- Transferee files: dossiers of specialists moving between Vietnam and abroad (contracts, visas, insurance, tax).
- Outsourcing: payroll, recruitment, background checks via vendors — some based abroad.
Each flow is an “outbound cross-border transfer” under Law 91/2025 — no “intra-group” exception.
Procedures under Law 91/2025
For Vietnam → abroad flows:
- Impact assessment for outbound transfers — prepared before transferring, updated when flows change.
- Authority procedures under Decree 356/2025 (dossiers, notification/registration) — by data type and scale.
- Employee consent: employment contracts/agreements should carry a consent clause for HR-data transfers to the parent/global system — clear on purpose, scope and receiving country.
- Intra-group data agreements: processing agreements between the Vietnamese subsidiary and the parent/HR-system operator — allocating liability for leaks.
EU → Vietnam: GDPR Chapter V
For EU → Vietnam flows (EU parent sending HR data over, or EU staff working in Vietnam):
- Vietnam holds no EU adequacy decision — use SCCs (standard contractual clauses) or BCRs (binding corporate rules).
- BCRs are the premium group solution: one approval for all internal flows — but approval is long and costly.
- SCCs are faster: signed between the EU exporter and Vietnamese importer per flow — with a transfer impact assessment (TIA).
- Note: SCCs/BCRs satisfy the GDPR; the flow simultaneously faces Law 91/2025 at the Vietnamese end (receipt and onward processing).
Sensitive HR data: double caution
HR data holds much sensitive data: health (check-up certificates, sick leave), biometrics (fingerprint/face attendance), union membership, religion (in some forms). For sensitive data:
- Separate, explicit consent — not bundled into the contract’s “general consent”.
- Minimise transfer: transfer only when truly necessary; biometrics should be processed locally (templates on-device, no raw images abroad).
- Heightened security: encryption, strict access control, access logs — leaked health/biometric data causes irreversible harm (fingerprints can’t be “reset” like passwords).
Centralised HR systems: five questions to answer
Before putting Vietnamese HR data on the global HR system, answer five questions:
- 1. Where is data stored (which country, which data centre) — it sets the transfer procedure.
- 2. Who can access it — global HR, managers in other countries? Least-privilege access.
- 3. For what purpose — management reporting, global payroll, people analytics? No purpose drift beyond consent.
- 4. How long is it kept — retention and deletion policies when staff leave (minus statutory retention).
- 5. When it leaks — who notifies, under which country’s law (see EXP-4041).
A compliance roadmap for HR departments
- Map data flows: list every HR data flow in/out of Vietnam — systems, receiving countries, data types.
- Complete procedures: impact assessments + Decree 356/2025 procedures for outbound; SCCs/BCRs for EU inbound.
- Update employment contracts: clear transfer-consent clauses, separate ones for sensitive data.
- Sign intra-group agreements: between subsidiary and parent/system operator — liability, security, breach notification.
- Train HR: HR staff handle data daily — they must know the rules; no emailing HR Excel files from personal accounts.
Frequently asked questions
Is HR data sent to the parent an ‘outbound transfer’?
Yes — every HR data flow from Vietnam abroad, including intra-group ones (reports, centralised HR systems), is a cross-border personal-data transfer under Law 91/2025; impact assessment + procedures required.
What procedures do outbound HR transfers need?
Transfer impact assessment (before transferring), authority procedures under Decree 356/2025, employee consent (clear contract clauses), and intra-group processing agreements.
What do EU-to-Vietnam data flows need?
Vietnam has no EU adequacy, so SCCs or BCRs (with transfer impact assessments); the flow simultaneously faces Law 91/2025 at the Vietnamese end.
Can fingerprint attendance data go abroad?
Minimise it — biometrics are sensitive data needing separate explicit consent; process locally (on-device templates) rather than sending raw images abroad; transfer only when truly necessary with heightened security.
Contact FLAT Law Firm
FLAT Law Firm advises on cross-border HR data flows: flow mapping, Law 91/2025 procedures, SCCs/BCRs, employment-contract clauses. Contact us for an HR-data review.
This article has been quality-reviewed by the FLAW AI Legal Council