The group HR platform hosted in Singapore and the CRM on a US cloud — the standard IT architecture of an FDI enterprise — are precisely a cross-border personal data transfer under Clause 1, Article 20 of Personal Data Protection Law 91/2025/QH15. From 2026 the enterprise must follow an ordered compliance roadmap, and the most important detail is that the two systems do not attract the same filing regime.
Governing Instruments
Article 20 of Law 91/2025: one duty, two fates for HR and CRM
Clause 1, Article 20 of Law 91/2025 defines three cases of cross-border personal data transfer: moving data stored in Vietnam to a storage system outside the territory; transferring data to organisations or individuals abroad; and using an offshore platform to process data collected in Vietnam. Both the HR platform and the cloud CRM fall into the third case. Clause 2 requires the transferor to prepare a cross-border transfer impact assessment file and send one original to the specialised authority within 60 days of the first day of transfer; the file is made once for the whole operating life and updated under Article 22 (Clause 3).
Clause 6 of Article 20, however, exempts from the transfer-file duty the case where an organisation stores its own employees’ personal data on a cloud computing service. The group HR system — where employee data sits on cloud — is therefore exempt from the transfer impact assessment file. A CRM holding customer data matches none of the Clause 6 exemptions: the Article 20 file is mandatory. The exemption removes only the transfer file; the Article 21 processing impact assessment, the data protection principles and incident responsibility continue to apply to both systems in full.
Application Analysis
The correctly ordered roadmap has four steps. Step one, data-flow mapping: which system holds whose data, where the servers and backups sit, and whether the vendor uses sub-processors in third countries — the answers decide which systems need an Article 20 file. Step two, complete the processing basis and the vendor paperwork: the data processing agreement (DPA) must commit the vendor to process only on the enterprise’s instructions, to security measures, incident notification, support for data-subject rights, and return or deletion of data on termination. Step three, prepare and file the Article 20 file for non-exempt flows within 60 days of the first transfer day under the new law, aligned with the Article 21 file. Step four, run it as a living mechanism: the specialised authority may inspect transfers periodically no more than once a year or extraordinarily (Clause 4, Article 20) and may order transfers stopped where data is found to be used for activities capable of harming national defence and security (Clause 5) — the enterprise needs a technical fallback to pull data back if ordered.
On employee consent: processing employee data within the employment relationship rests mainly on the labour contract and the employer’s legal duties, so not every flow needs a separate consent. Three situations must be separated out: sensitive data (biometric timekeeping, periodic health-check data) needs its corresponding explicit basis and consent; moving employee data to the group for purposes outside ordinary HR administration in Vietnam (such as global workforce analytics or cross-border performance scoring) goes beyond the ordinary employment scope and requires transparent notice to employees; and employees always retain the right to know which systems process their data and where that data is stored.
Recommended Actions
- Map data for each system (HR, CRM, ERP, email): data types, server locations, sub-processors — classify which flows are exempt from the Article 20 file under Clause 6 and which are not.
- Sign a data processing addendum (DPA) with every cloud/SaaS vendor: instruction-bound processing, security, incident notification, data-subject rights support, return/deletion on termination.
- Prepare and file the transfer impact assessment (Article 20) for CRM customer data within 60 days of the first transfer day; keep it aligned with the Article 21 file.
- Issue a dedicated employee data notice (systems used, storage locations, purposes) and obtain separate consent for sensitive data outside the labour-contract scope.
- Keep a fallback plan to repatriate data to Vietnam or switch vendors if the authority orders a transfer stop under Clause 5, Article 20.
Frequently Asked Questions
Which cross-border transfer rules must an FDI enterprise with HR and CRM systems hosted abroad follow from 2026?
The main frame is Article 20 of Personal Data Protection Law 91/2025/QH15: using an offshore platform to process data collected in Vietnam is a cross-border transfer (Point c, Clause 1), and the transferor must prepare a transfer impact assessment file and send one original to the specialised authority within 60 days of the first transfer day (Clause 2), updated under Article 22. The key exception in Clause 6: storing employees’ personal data on a cloud service is exempt from the transfer file — so the HR system is exempt from that file, while a CRM holding customer data is not and must be filed in full. Both systems remain subject to the Article 21 processing impact assessment.
What does the compliance roadmap cover on impact assessment, notice and vendor contract clauses?
Four sequential steps: (1) map data flows and classify them under Clause 6 of Article 20 to learn which systems need a transfer file; (2) the impact assessments — the Article 21 processing file for both systems and the Article 20 transfer file for non-exempt flows, filed within the statutory 60-day marks; (3) transparent notice to data subjects (employees, customers) on systems, storage locations and purposes; (4) a data processing agreement with the vendor covering instruction-bound processing, security standards, prompt incident notification, support for data-subject rights, a ban on unapproved sub-processors, and return or deletion of data at contract end.
Does transferring employee data to group systems require the employees’ separate consent?
Not every flow does: processing employee data to perform the labour contract and the employer’s legal duties has a basis independent of consent. Separate consent becomes necessary in two zones: sensitive data (biometrics, health) where the processing basis relied upon is consent, and purposes outside ordinary HR administration in Vietnam, such as analytics and global workforce scoring at group level. Even where consent is not needed, the enterprise must still notify employees that their data is processed on group systems hosted abroad — the transparency duty is not replaced by the labour contract.
What if a foreign cloud vendor refuses Vietnamese compliance clauses?
Escalate in steps. First negotiate the standard addendum: most large SaaS vendors offer a GDPR data processing addendum that maps well onto Law 91/2025 requirements; the clauses usually to add are support for the Article 20 file and incident notification. If the vendor still refuses the core clauses (instruction-bound processing, incident notice, return/deletion), the enterprise should not keep transferring customer data to that system — legal responsibility stays with the Vietnamese transferor and cannot be shifted to the vendor. Alternatives include an equivalently committed vendor, a hybrid model (personal data stored in Vietnam, only anonymised data goes abroad), or encryption with enterprise-held keys so the vendor cannot access plaintext data.
