The Munich parent wants direct access to the Vietnamese subsidiary HR system and CRM. An operation that looks like IT is in fact two “cross-border data transfers” under two legal systems. This article stays on the Vietnam–Germany flow; the general comparison of the Vietnamese and German data protection regimes has its own article. One point must be fixed first: the current Vietnamese framework is Personal Data Protection Law 91/2025/QH15 and Decree 356/2025/ND-CP — Decree 13/2023/ND-CP expired on 01/01/2026 and is no longer a legal basis.
The two legal directions of one data flow
On the Vietnamese side, a Vietnam-based entity transferring personal data of Vietnamese employees and customers to the German parent is a cross-border personal data transfer, disciplined by Personal Data Protection Law 91/2025/QH15 and Decree 356/2025/ND-CP. The parent “only viewing, not downloading” does not remove the transfer character: access from abroad into data stored in Vietnam is itself a form of transfer in the Vietnamese regulator understanding.
On the EU side, the GDPR governs mainly the German parent conduct when processing received data, and governs the reverse flow (Germany to Vietnam) through its international transfer chapter. Because Vietnam has no European Commission adequacy decision, every personal data flow from the EU into Vietnam needs another transfer tool, typically standard contractual clauses. Designing the data architecture once for both directions avoids doing compliance twice.
The cross-border transfer impact assessment dossier
The Vietnamese compliance centrepiece is the cross-border personal data transfer impact assessment dossier, prepared under Decree 356/2025/ND-CP and filed with the personal data protection authority under the Ministry of Public Security as prescribed. Its core contents: the transferring and receiving parties (the German parent, each side processing role), the data types and data subject groups involved (staff, customers), the purpose and legal basis of the transfer, technical and organisational safeguards at both ends, and a risk assessment for data subject rights with mitigations.
This dossier is not a “permit before transfer” licensing step, but it is a duty to prepare and file or keep as prescribed at or around the start of the transfer, updated on material changes (new data types, new recipients, new purposes). The biggest practical error of subsidiaries is letting the parent access data for years and only building the dossier retroactively when asked — a retroactive dossier does not erase the period of transfer without an impact assessment.
Can EU SCCs be used for the Vietnam-to-Germany leg?
European Commission Standard Contractual Clauses (SCCs) are designed for data flows from the EU to third countries without adequacy. For the Vietnam-to-Germany leg, data flows into the EU, so the GDPR does not require SCCs for that leg itself; instead, the Vietnamese side requires a data transfer agreement between sender and recipient with commensurate protection commitments inside the impact assessment dossier. A well-drafted intra-group data transfer agreement can serve both sides at once: as an annex to the Vietnamese dossier and as the governance frame for the parent GDPR duties.
Do not confuse the instruments: holding SCCs does not replace the Vietnamese impact assessment dossier, and holding the Vietnamese dossier does not replace GDPR duties when data flows back from Germany to Vietnam (for example processed HR reports sent to the subsidiary). The two duty sets run in parallel; neither offsets the other.
Penalties at both ends: different risk shapes
On the EU side, breaches of GDPR transfer and processing rules can be fined up to 4% of the group worldwide turnover or EUR 20 million, whichever is higher — the framework that usually makes the German board the strongest compliance driver in internal data projects. On the Vietnamese side, Decree 356/2025/ND-CP builds its own administrative sanction regime for personal data protection violations, and beyond fines there is the risk of being ordered to suspend the transfer activity — an operational consequence heavier than fines for a subsidiary dependent on group systems.
Practical priorities for a business already running this flow: (1) map the data actually flowing between the two countries; (2) complete the Vietnamese impact assessment dossiers for live flows; (3) sign an intra-group data transfer agreement covering both directions; (4) design access on a least-privilege basis — the parent accesses only the data fields it truly needs, instead of opening the entire Vietnamese HR database.
FAQs
Does a German parent company need permission to access HR/customer data in Vietnam?
Vietnamese duties may well apply. Giving the German parent access to HR and customer data in Vietnam is a cross-border personal data transfer under Personal Data Protection Law 91/2025/QH15 and Decree 356/2025/ND-CP, even if the parent only views and never downloads — access from abroad is itself a form of transfer.
What does the impact assessment dossier for transferring data abroad include?
Under the Decree 356/2025/ND-CP framework it covers: the transferring and receiving parties with each side processing role, data types and data subject groups, the purpose and legal basis of the transfer, technical and organisational safeguards at both ends, and a risk assessment for data subjects with mitigations. It must be updated on material changes to data, recipients or purposes.
Can EU standard contractual clauses (SCC) be used for data transfers from Vietnam?
SCCs are designed for flows from the EU to third countries without an adequacy decision; the Vietnam-to-Germany leg flows into the EU, so the GDPR does not require SCCs for that leg itself. But SCCs do not replace the Vietnamese impact assessment dossier, and when data flows back from Germany to Vietnam, GDPR transfer tools such as SCCs become necessary. The two duty sets run in parallel.
How are violations penalised on each side? (check current penalty levels)
On the EU side, GDPR transfer and processing breaches can be fined up to 4% of worldwide group turnover or EUR 20 million, whichever is higher. On the Vietnamese side, administrative sanctions apply under Decree 356/2025/ND-CP, potentially with an order to suspend transfers — for a subsidiary dependent on group systems, a transfer suspension is often heavier than the fine.
This article has been quality-reviewed by the FLAW AI Legal Council
