This topic’s title keeps the Decree 13/2023/ND-CP reference because that instrument created the cross-border personal data transfer impact assessment, but a business filing today must follow the new frame. From 1 January 2026, Personal Data Protection Law No. 91/2025/QH15 governs outbound personal data transfers at statute level, and Decree 356/2025/ND-CP has replaced Decree 13/2023/ND-CP with refreshed assessment forms and procedures. A dossier validly filed under Decree 13/2023 is good historical evidence, but its content must be re-mapped to the new forms when data flows change or the specialised authority requires an update.
The frame changed: transfer assessment now stands on Law 91/2025
A cross-border transfer impact assessment essentially answers six questions: who the transferor and recipient are, how many data subjects and which data types are involved, the transfer purpose and legal basis including data subject consent where the law requires it, the protection measures at the receiving end including contracts binding the recipient, the risk assessment of the transfer, and the contact point plus a commitment to update when flows change. The dossier goes to the specialised personal data protection authority under the Ministry of Public Security under Decree 356/2025/ND-CP procedure, and the business must keep the full supporting set, including the contract with the foreign recipient, for inspection.
What a cross-border transfer impact assessment dossier contains
Transfers are chronically under-scoped because they hide inside daily tools: CRM software hosted abroad, analytics tools, group HR systems and even the cloud services of the data center itself. Each flow is a transfer activity to inventory in the data map and cover in the corresponding assessment; using a large cloud provider does not exempt the procedure, and the data processing agreement with that provider must reflect its true role as overseas recipient so the assessment matches operational reality.
Important and core data: the Data Law’s separate control layer
A separate control layer runs in parallel under Data Law No. 60/2024/QH15 for core data and important data: holders of these categories face dedicated requirements on transferring and providing data abroad, markedly stricter than the ordinary personal data regime. A business operating in a sector on the important-data lists must classify its data stores before designing transfer flows, because a perfect personal data assessment still cannot legitimise moving core data against data law conditions.
Frequently Asked Questions
What procedure applies to moving customer data to overseas servers?
Prepare a cross-border personal data transfer impact assessment and file it with the specialised authority under the Ministry of Public Security per Law 91/2025/QH15 and Decree 356/2025/ND-CP, which replaced the Decree 13/2023/ND-CP frame on 1 January 2026, with contracts binding the recipient.
What does a transfer impact assessment dossier contain?
Transferor and recipient details, data types and subject counts, the purpose and legal basis of the transfer, protection measures at destination, a risk assessment and an update commitment when flows change, on Decree 356/2025/ND-CP forms.
Do foreign cloud tools trigger the transfer assessment?
Yes. Every flow taking personal data out of Vietnam through foreign software and cloud is a transfer activity to inventory and assess; provider size creates no exemption, and the processing agreement must match the overseas recipient role.
This article has been quality-reviewed by the FLAW AI Legal Council