Does your business use Google Workspace, Microsoft 365 or international cloud storage to process data collected in Vietnam? Under the new rules, this may already constitute a cross-border transfer of personal data — an activity subject to its own procedures and sanctions. This article analyzes the rules under Article 20 of the Law on Personal Data Protection 91/2025/QH15 and Decree 356/2025/ND-CP.
1. Three cases constituting cross-border personal data transfers
Under Article 20.1 of Law 91/2025/QH15, cross-border transfers of personal data cover three cases:
- Storing personal data outside the territory of Vietnam;
- Transferring personal data to foreign organizations or individuals;
- Using platforms outside Vietnam to process personal data collected in Vietnam.
The key point: the third case is very broad. In practice, a business using Google Workspace, Microsoft 365 or international cloud to process data collected in Vietnam = cross-border personal data transfer, wherever the physical servers sit. Many businesses fall within scope without realizing it.
2. Procedures: impact assessment dossier + filing with the Ministry of Public Security within 60 days
When transferring personal data abroad, organizations must:
- Prepare an impact assessment dossier for cross-border personal data transfer under Articles 17 and 18 of Decree 356/2025/ND-CP (effective 01/01/2026);
- Obtain the consent of the data subjects;
- File the dossier with the Ministry of Public Security within 60 days of the first transfer.
The related administrative procedure is the “Notification of filing the impact assessment dossier for cross-border personal data transfer” under Decision 778/QD-BCA-A05, processed by Department A05 within 15 days.
3. Four exemptions
Under Article 20.6 of Law 91/2025/QH15, four cases are exempt from cross-border transfer procedures:
- Competent state agencies transferring data in performing their functions and duties;
- Storing internal employees personal data on cloud platforms — i.e., foreign cloud storing internal staff data is exempt;
- Data subjects transferring their own personal data abroad themselves;
- Other cases prescribed by the Government.
The practical distinction: foreign cloud storing internal employee data is exempt; but processing customer data on the same platform is not — the impact assessment dossier and Ministry filing are still required.
4. Sanctions
Decree 330/2026/ND-CP (effective 19/8/2026) sanctions unlawful cross-border transfers of personal data: fines of up to 5% of revenue, with a floor of VND 3 billion. This is large enough that every business with cross-border data processing must review now.
5. What businesses should do now
- Map all data flows: which personal data is stored or processed on platforms outside Vietnam;
- Classify: internal employee data on cloud (exempt) versus customer/partner data (not exempt);
- For non-exempt data: prepare the impact assessment dossier, obtain data subject consent, and file with the Ministry of Public Security within 60 days of the first transfer;
- Update contracts with foreign cloud providers on data protection responsibilities.
Frequently asked questions
Does using Google Workspace/Microsoft 365 count as a cross-border transfer?
Yes. Using platforms outside Vietnam to process personal data collected in Vietnam constitutes a cross-border transfer (Article 20.1 of Law 91/2025).
Must employee data on foreign cloud go through the procedures?
No, for internal employee data — it falls under the exemption (Article 20.6).
What is the filing deadline with the Ministry of Public Security?
Within 60 days of the first transfer.
What are the fines for unlawful cross-border transfers?
Up to 5% of revenue, floor of VND 3 billion (Decree 330/2026/ND-CP).
Sources
- Law on Personal Data Protection 91/2025/QH15, Article 20 (effective 01/01/2026) — cross-border personal data transfers;
- Decree 356/2025/ND-CP, Articles 17 and 18 (effective 01/01/2026) — impact assessment dossier for cross-border transfers;
- Decree 330/2026/ND-CP (effective 19/8/2026) — sanctions: up to 5% of revenue, VND 3 billion floor;
- Decision 778/QD-BCA-A05 — procedure “Notification of filing the impact assessment dossier for cross-border personal data transfer” (15 days).
Conclusion
Cross-border personal data transfers under Article 20 of Law 91/2025 are broader than many businesses think: using international cloud to process data collected in Vietnam already constitutes a cross-border transfer, requiring an impact assessment dossier (Articles 17-18 of Decree 356/2025), data subject consent, and filing with the Ministry of Public Security within 60 days. The notable exception for day-to-day operations is that internal employee data on cloud is exempt — customer data is not. With sanctions of up to 5% of revenue, reviewing cross-border data flows cannot be delayed.
Does your business need to assess cross-border data transfer obligations? Contact FLAT Law Firm for advice.
For reference only; not legal advice. This content was prepared by AI and will undergo quality review by the AI Legal Council of FLAT Law Firm before any publication consideration; it is not the legal opinion of a licensed human lawyer. Laws and regulations may change; verify the current legal texts before applying them.