A foreign parent company requests HR reports, your CRM runs on servers in Singapore, or an overseas vendor processes customer data — all of these are outbound transfers of personal data and since 1 January 2026 must comply with Article 20 of Vietnam’s Personal Data Protection Law 91/2025/QH15 and Decree 356/2025/ND-CP.
This article walks through the impact assessment dossier procedure for cross-border personal data transfers, filing deadlines, and exemption cases.
1. What counts as an outbound transfer?
Under Law 91/2025/QH15, a cross-border transfer covers any act of moving Vietnamese citizens’ personal data outside Vietnam’s territory or allowing foreign organisations or individuals to access or process it — including storage on overseas servers, international cloud services, or intra-group data sharing across borders.
2. The mandatory 4-step procedure
Step 1 — Prepare the cross-border transfer impact assessment dossier: the dossier identifies the transferring party, the receiving party, transfer purposes, data categories, protective measures, and documents evidencing the allocation of responsibilities between the parties (Forms 09/10 issued with Decree 356/2025/ND-CP).
Step 2 — File with Department A05: submit one original to the specialised personal data protection authority — the Department of Cybersecurity and High-Tech Crime Prevention (A05) under the Ministry of Public Security — within 60 days of the first transfer (counted from the first day the transfer is carried out, not the contract signing date), accompanied by Form 01a/01b (filing notice). File online via the National Personal Data Protection Portal (once operational), in person, or by post.
Step 3 — Appraisal: the specialised authority evaluates the dossier and notifies the result (satisfactory/unsatisfactory) within 15 working days of receiving a valid dossier; if supplementation is required, complete it within 30 days.
Step 4 — Post-transfer notice and record-keeping: after completing the transfer, send a written notice to A05; retain the dossier, update it upon changes, and keep it ready for inspection.
3. Dossier updates: every 6 months, or within 10 days
- Update every 6 months from the first filing when: new transfer or processing purposes arise; the data controller, processor or third party changes;
- Update within 10 days when: reorganisation, termination, dissolution or bankruptcy; changes to the engaged data protection service provider’s information.
Updates are free of charge; processing time is 15 days (excluding public holidays).
4. Five exemption cases
Under Article 20.6 of Law 91/2025/QH15 and Decree 356/2025/ND-CP, no impact assessment dossier is required when:
- Transferring data for cross-border HR management under internal regulations, labour rules or collective labour agreements;
- Providing data to conclude or perform contracts relating to transport, logistics, money transfer, payment, hotel booking, visas or scholarships;
- Emergency medical examination or treatment;
- Small businesses and startups within their first 5 years (except data processing service businesses, sensitive-data processors, or those reaching 100,000+ data subjects);
- Other cases prescribed by law.
5. Frequently asked questions
Q: We use Google Workspace/Microsoft 365 hosted abroad. Must we file?
A: Yes, if personal data (employee emails, customer contacts) is stored or processed on overseas infrastructure and no exemption applies — an impact assessment dossier is required.
Q: Does an internal transfer to our parent company require filing?
A: Yes. Intra-group cross-border sharing is still an outbound transfer, unless it falls under the internal HR-management exemption.
Q: What if we never file?
A: It is a personal data protection violation, subject to administrative sanctions under Decree 330/2026/ND-CP and unannounced inspections (A05 inspects annually or ad hoc upon signs of violation).
Transferring data abroad and need a compliant dossier? Contact us for advice.
This article was prepared by the FLAW AI Legal Council. The content is pending QA Council review before submission for approval; information is for reference only and does not replace legal advice for your specific case.