FLAT LAW FIRM
Request a consultation

Data, Technology and Compliance

Cross-Border Transfer of Personal Data from Vietnam: Conditions and Procedures from 1 January 2026

22 min readFLAT LAW FIRM
Cận cảnh cáp quang màu xanh cắm vào thiết bị mạng trong trung tâm dữ liệu

Synchronising HR data with an overseas head office, running corporate email, CRM or ERP systems on servers located outside Vietnam, or engaging a foreign IT vendor to process customer data — for foreign-invested enterprises (FDI) in Vietnam, these are everyday operations, often treated as purely technical matters. From 1 January 2026, that view is no longer tenable: cross-border transfer of personal data is a standalone regulated activity, governed directly by the Law on Personal Data Protection No. 91/2025/QH15 (Article 20) and Decree 356/2025/ND-CP (Article 18), with the central obligation of preparing a cross-border personal data transfer impact assessment dossier and notifying the specialized personal data protection authority.

This guide sets out the full conditions, dossier components, notification procedure, exemptions and sanctions applicable from 1 January 2026, with emphasis on real-world scenarios faced by FDI enterprises in Vietnam.

Contents

1. Why FDI enterprises must prioritise this from early 2026

Three reasons put the cross-border transfer obligation at the top of every FDI enterprise's 2026 compliance agenda.

First, ubiquity. Virtually no FDI enterprise operates without at least one outbound data flow: periodic HR reporting to headquarters, a global HRIS, corporate email and cloud storage hosted abroad, ERP/CRM platforms operated internationally, or technical support from the group's overseas IT team. Many businesses still assume that "intra-group transfers" need no formalities — the current law recognises no such concept.

Second, the heaviest sanctions in the regime. Under clause 4, Article 8 of the 2025 Law on Personal Data Protection, the maximum administrative fine for an organisation violating cross-border transfer rules is 5% of the revenue of the immediately preceding year — materially higher than the VND 3 billion cap applicable to other personal data violations. For an FDI enterprise with hundreds of billions of dong in revenue, this figure dwarfs any administrative fine previously associated with a "paperwork" obligation.

Third, the shift from ex-post to ex-ante review. Under Decree 13/2023/ND-CP, enterprises could transfer first and file within 60 days of processing. From 1 January 2026, Decree 356/2025/ND-CP requires the dossier to be assessed by the specialized authority, which must notify whether it meets or fails the requirements within 15 days of receiving a complete and valid dossier. In other words, transferring data while the dossier has not been assessed as "meeting requirements" places the enterprise in a legal risk zone — even though the Law retains the 60-day filing window from the first transfer.

The current framework rests on two foundational instruments, both effective from 1 January 2026:

  • The Law on Personal Data Protection No. 91/2025/QH15, passed by the XVth National Assembly on 26 June 2025, comprising 5 chapters and 39 articles. Article 20 is the central provision on cross-border transfer of personal data, covering the transfer cases, the impact assessment dossier obligation, filing deadlines, inspection mechanisms, the power to order suspension, and exemptions. Clause 7 of Article 20 delegates to the Government the detailed regulation of clauses 1, 5 and 6, as well as dossier components, conditions, order and procedures for the impact assessment.
  • Decree 356/2025/ND-CP dated 31 December 2025, detailing a number of articles and implementation measures of the Law on Personal Data Protection, effective from 1 January 2026 and replacing Decree 13/2023/ND-CP (clause 2, Article 42 of Decree 356). Article 18 of Decree 356 sets out the specific conditions, order, procedures and dossier components for cross-border transfer impact assessments.

One transitional point deserves attention: under Article 39 of Law 91/2025/QH15, impact assessment dossiers already received by the specialized authority under Decree 13/2023 before the Law's effective date remain usable, but enterprises must update them in accordance with the new Law after 1 January 2026. In practice, because Decree 356 fundamentally changes both the form and substance of the dossier (adding requirements on internal policies and procedures, data flow diagrams and recipient assessments), enterprises that prepared dossiers under the old forms should conduct a full review rather than assume "the old dossier still works".

3. What counts as "cross-border transfer of personal data"?

Clause 1, Article 20 of the 2025 Law on Personal Data Protection lists three cases constituting cross-border transfer of personal data. FDI enterprises should map each of their data flows against all three, as many routine operational flows fall within scope.

Case 1: Transferring personal data stored in Vietnam to a data storage system located outside the territory of Vietnam. The most direct scenario: backing up or synchronising HR or customer databases from servers in Vietnam to servers abroad, or migrating data to the group's regional data centre.

Case 2: A Vietnamese agency, organisation or individual transferring personal data to an overseas organisation or individual. The classic FDI scenario: a Vietnamese subsidiary sending HR lists, payroll data or performance reviews to its overseas head office for global management; providing customer or partner lists to an overseas distributor; sharing candidate or employee profiles with a global recruitment function. A critical note: the law provides no separate exemption for intra-group transfers — a Vietnamese subsidiary is an independent legal person, and transferring personal data to its overseas parent remains a cross-border transfer.

Case 3: A Vietnamese or overseas agency, organisation or individual using a platform located outside Vietnam's territory to process personal data collected in Vietnam. This is the most easily overlooked case: using email, cloud storage or management software (HRIS, ERP, CRM) whose servers or processing platforms sit outside Vietnam to process data of employees or customers collected in Vietnam. The enterprise does not actively "send" data anywhere, yet processing on an offshore platform constitutes a cross-border transfer.

4. Four conditions for lawful cross-border transfer of personal data

Reading Article 20 of the Law together with Article 18 of Decree 356 yields four conditions an enterprise must satisfy (except for the exempted cases in section 7):

Condition 1 — Prepare a cross-border personal data transfer impact assessment dossier. This is the central obligation. Clause 1, Article 18 of Decree 356/2025 provides that agencies, organisations and individuals conducting cross-border transfers under clause 1, Article 20 of the Law must prepare a cross-border personal data transfer impact assessment dossier. This is not a formalistic document — its required contents (section 5) demand a genuine review of data flows, risk assessment and protective measures.

Condition 2 — Submit one original to the specialized authority within 60 days of the first transfer. Clause 2, Article 20 of the Law requires the transferring party to prepare the impact assessment dossier and submit one original to the specialized personal data protection authority within 60 days from the first cross-border transfer of personal data. The "first transfer date" is the critical milestone: for recurring flows (e.g., daily data synchronisation with the parent company), the 60-day period runs from the first transfer in the flow, not from the date the enterprise "realises" it has an obligation.

Condition 3 — Have a legal basis for processing, principally the data subject's consent. Cross-border transfer is a form of personal data processing and must therefore satisfy the Law's general processing conditions — including consent under Article 9. Consent must be voluntary and based on the data subject being "fully informed" of minimum information (data categories, processing purposes, data controller identity, etc.), and the Law expressly provides that "silence or non-response shall not be deemed consent". In practice, the impact assessment report (point d, clause 3, Article 18 of Decree 356) must describe and explain how consent was obtained — the specialized authority will examine this. FDI enterprises should therefore review existing privacy notices and consent forms: do they clearly state that data will be transferred abroad, to whom, to which country and for what purpose?

Condition 4 — Pass the specialized authority's assessment (15-day ex-ante review). This is Decree 356's watershed change from Decree 13/2023. The specialized authority must assess the dossier and notify whether it meets or fails the requirements within 15 days of receiving a complete and valid dossier; where the dossier is incomplete or non-compliant, the enterprise has 30 days to complete it. The practical consequence: although the Law allows filing within 60 days of the first transfer, a prudent enterprise should complete and file the dossier before the first transfer, to avoid the situation of having transferred data while the dossier is assessed as "failing requirements". The official interpretation of how the two timelines interact may be further clarified by the specialized authority in enforcement — enterprises with material transfer flows should work with counsel to design an appropriate timeline.

5. Components of the cross-border transfer impact assessment dossier

5.1. Three mandatory document groups (clause 2, Article 18 of Decree 356/2025)

The cross-border personal data transfer impact assessment dossier comprises:

a) The impact assessment report on cross-border personal data transfer in accordance with Form No. 09 in the Appendix to Decree 356;

b) A copy of the contract or data transfer instrument evidencing the binding commitments and responsibilities between the organisations/individuals transferring and receiving personal data across borders;

c) Policies, procedures, regulations, forms and other relevant documents on personal data protection of the agency, organisation or individual conducting the cross-border transfer.

Point (b) is where FDI enterprises typically need the most work: contracts with overseas data recipients (parent companies, service providers, partners) must clearly evidence binding commitments and the allocation of data protection responsibilities — a generic clause in a framework agreement will not suffice. Point (c) requires the enterprise to already have an internal system of personal data protection policies and procedures; if none exists, it must be built in parallel and cannot be produced "for the file" in a few days.

5.2. Nine contents of the impact assessment report (clause 3, Article 18)

The Form No. 09 report must include:

a) Information and contact details of the transferring party, the receiving party, the data processor and other parties involved in the cross-border transfer;

b) Contact details of the personal data protection department/personnel, and of any personal data protection service provider (if any), of both the transferring and receiving parties;

c) A description of and rationale for the purpose of the cross-border transfer, the categories of personal data transferred, details of the transfer and processing activities, together with a personal data processing flow diagram;

d) A description of and rationale for obtaining the data subjects' consent, and policies on data retention, erasure and destruction;

dd) A plan for ensuring data safety after the cross-border transfer, the personal data protection measures and the data protection standards applied;

e) A system diagram and description of the features of the data storage and processing system after receiving the cross-border personal data;

g) Procedures governing the onward transfer or provision of personal data to third parties by the receiving party;

h) The results of the self-assessment of compliance with personal data protection regulations by the party conducting the cross-border transfer;

i) An assessment of the receiving party's level of personal data protection; the degree of impact and risk of the cross-border transfer and processing; unintended consequences and losses that may occur; and measures to mitigate or eliminate such risks.

In practice, points (c), (dd), (e) and (i) are the backbone of the report — and the parts the specialized authority scrutinises most closely. FDI enterprises should invest in a detailed data flow diagram (what data — from where — through which systems — into whose hands — stored where — deleted when), a substantive assessment of the overseas recipient's data protection capability (not merely generic contractual assurances), and a risk analysis with concrete mitigations (encryption, anonymisation, access controls, purpose limitation). A report copied from a template without reflecting actual operations will not only be assessed as "failing requirements" but will also create exposure in the event of a surprise inspection.

6. The notification procedure: where to file, how long, what outcome

The corresponding administrative procedure is titled "Notification of submission of the cross-border personal data transfer impact assessment dossier". The steps are as follows:

Step 1 — Prepare the dossier. The notification file includes: the notification of dossier submission in Form No. 01a (for organisations) or Form No. 01b (for individuals) — one original; the impact assessment report in Form No. 09 — one original; legal documents of the filer (copy of the enterprise registration certificate or equivalent); the decision assigning the personal data protection department/personnel (copy); a copy of the data transfer contract or instrument with the relevant parties; and other supporting documents evidencing capacity, policies and procedures.

Step 2 — File the dossier. The dossier is filed via the Ministry of Public Security's public service portal or submitted directly to the Department of Cybersecurity and Hi-Tech Crime Prevention (A05), Ministry of Public Security — the unit that in practice performs the specialized personal data protection authority function. As a matter of written law, Article 39 of Decree 356/2025 defines the role of the specialized authority; when preparing to file, enterprises should verify the published list of administrative procedures to confirm the receiving channel and filing method applicable at that time.

Step 3 — Assessment and notification of results. Within 15 days (excluding public holidays) of receiving a complete and valid dossier, the specialized authority assesses the dossier and sends a notification that the dossier meets or fails the requirements to the filing organisation or individual. Where the dossier is incomplete or non-compliant, the filer has 30 days from receipt of the notification to complete the dossier.

Step 4 — Retain the dossier. Clause 4, Article 18 of Decree 356/2025 requires the cross-border transfer impact assessment dossier to remain available at all times for inspection and assessment by the specialized personal data protection authority. This is not a "file and forget" procedure: the enterprise must keep the dossier in a state ready for production at any moment, including subsequent updates.

7. Exemptions from the impact assessment dossier

Clause 6, Article 20 of the 2025 Law on Personal Data Protection provides four cases exempt from the cross-border transfer impact assessment requirements:

a) Cross-border transfer of personal data by competent state agencies;

b) An agency or organisation storing the personal data of its own employees on cloud computing services;

c) A data subject personally transferring his or her own personal data across borders;

d) Other cases as prescribed by the Government.

Point (b) is the most practically significant exemption for FDI enterprises: if an enterprise merely stores its own employees' data on a cloud service (even where the cloud servers are located abroad), no impact assessment dossier is required for that storage activity. The scope must be read carefully, however: the exemption covers only the employees' data of that agency or organisation and only the storage activity on the cloud. If the same cloud system also processes customer or candidate data, or if the enterprise transfers employee data to an overseas third party for other purposes (e.g., providing it to the parent company for HR decision-making), the portion falling outside the exemption must still be covered by a dossier.

For point (d), the Government has detailed additional exempted cases, including groups such as: press and media activities in accordance with the law; transfers of personal data already made public in accordance with the law; genuine emergency situations necessary to protect an individual's life, health or asset safety, or to perform duties and obligations prescribed by law; cross-border transfers for cross-border HR management under internal rules, labour regulations and collective labour agreements; and provision of data for entering into contracts or carrying out procedures relating to cross-border transport, logistics, money transfer, payment, hotel booking, visa applications or scholarship applications. When relying on these exemptions, enterprises should verify the scope and specific conditions directly against the corresponding provision of the original Decree 356/2025.

A point of principle: exemption from the impact assessment dossier does not mean exemption from all obligations. The enterprise must still comply with the Law's general duties — obtaining valid consent, applying security measures, safeguarding data subjects' rights, and reporting violations. The exemption removes only the dossier preparation and filing obligation, not a licence for unrestricted transfer.

8. Post-transfer obligations: retention, updates, inspections

Completing the notification procedure is not the end of the road. The Law and the Decree impose continuing obligations after data has been transferred abroad:

Retain the dossier and keep it available. As noted, the impact assessment dossier must remain available at all times for inspection and assessment by the specialized authority (clause 4, Article 18 of Decree 356).

Update the dossier when circumstances change. Clause 3, Article 20 of the Law provides that the cross-border transfer impact assessment is conducted once for the entire duration of operation of the agency, organisation or individual, and is updated as prescribed. According to practice analyses of Decree 356, the dossier should be updated every 06 months when new transfer or processing purposes arise or when there are changes to the data controller, joint controller-processor, data processor or third parties; and updated promptly within 10 days upon reorganization, cessation of operations, dissolution or bankruptcy, changes to the personal data protection service provider, or the emergence of or changes to business lines or services relating to personal data processing registered in the dossier. Enterprises should verify the decree's provisions directly when building an internal update calendar — and in any event, each change of cloud provider, processing system or expansion of transferred data scope is a moment to review the dossier.

Undergo periodic and surprise inspections. Clause 4, Article 20 of the Law provides that the specialized authority shall decide on periodic inspections no more than once a year or surprise inspections upon detecting violations of personal data protection law or upon the occurrence of a data leak or loss incident. For FDI enterprises, a data breach anywhere in the processing chain — including at the overseas recipient — may trigger a surprise inspection in Vietnam.

Risk of a suspension order. Clause 5, Article 20 empowers the specialized authority to order the suspension of cross-border personal data transfer upon discovering that transferred personal data is used for activities potentially harmful to national defence or security. This is a strong measure aimed primarily at security-risk situations, but enterprises should be aware that their transfer activities remain under continuous regulatory oversight.

9. Sanctions: 5% of revenue and VND 3 billion

The sanction framework for violations of cross-border personal data transfer rules is set out in Article 8 of the 2025 Law on Personal Data Protection:

  • Clause 4, Article 8: the maximum administrative fine for an organisation violating cross-border personal data transfer regulations is 5% of the revenue of the immediately preceding year of that organisation. Where there is no revenue in the immediately preceding year, or the revenue-based fine is lower than the maximum under clause 5, the clause 5 fine applies — i.e., VND 3 billion.
  • Clause 6, Article 8: these maximum fines apply to organisations; for an individual committing the same violation, the maximum fine is one-half of the organisational level.
  • Clause 1, Article 8: in addition to administrative sanctions, violators may face criminal prosecution depending on the nature, seriousness and consequences of the violation, and must compensate for any damage caused in accordance with the law.

Note that Article 8 sets statutory maximums; the specific fine for each act (failure to prepare a dossier, late filing, transferring after a suspension order, etc.) will be set by the Government's detailed administrative sanctions decree. Enterprises should not infer that "no sanctions decree means no penalties" — the statutory maximums have been in force since 1 January 2026, and the authorities may already apply other measures such as suspension orders and surprise inspections.

10. Five typical cross-border transfer scenarios for FDI enterprises

The five most common scenarios at FDI enterprises in Vietnam, with a quick assessment of obligations:

Scenario 1 — Periodic HR reporting to the parent company. The Vietnamese subsidiary sends employee lists, payroll data and performance reviews to its overseas headquarters for global management. This is case 2 of clause 1, Article 20 (transfer to an overseas organisation). A dossier is required, unless the flow stays within mere storage of employee data on the cloud under point (b), clause 6 — which it typically does not, since the data is transferred to the parent for processing (HR decision-making), not mere storage.

Scenario 2 — Using cloud/SaaS systems hosted abroad. Corporate email, HRIS, ERP and CRM run on platforms with servers outside Vietnam, processing employee and customer data collected in Vietnam. This is case 3 of clause 1, Article 20. A dossier is required for customer data and other data categories; the employee-data storage portion on the cloud may fall under the point (b), clause 6 exemption — but the enterprise must be able to delineate the scope in its report.

Scenario 3 — Engaging an overseas IT service provider. The group's or a vendor's overseas technical support and system operations team has access to personal data (customers, employees) for troubleshooting and maintenance. This is a transfer to an overseas organisation (case 2), with the recipient acting as a data processor. A dossier is required, and the service contract must clearly evidence the vendor's binding data protection commitments and responsibilities.

Scenario 4 — Sharing customer data with an overseas distribution partner. The enterprise provides customer lists and transaction data to an overseas distributor or agent for sales and marketing. A dossier is required; the most sensitive point here is often the consent basis — whether customers consented to their data being shared with a third party abroad (Article 9).

Scenario 5 — Providing data in an M&A transaction. An overseas buyer or adviser accesses the target company's employee and customer data in Vietnam during due diligence. A dossier is required if the access constitutes a cross-border transfer; in practice, parties typically design a data room with anonymisation and access-scope limitations from the outset to mitigate risk.

11. A 10-step implementation checklist for FDI enterprises

  1. Map your data flows: list every flow of personal data leaving Vietnam's territory — what data, whose, to where, through which systems, for what purpose.
  2. Test against the three cases in clause 1, Article 20: determine which flows constitute cross-border transfer of personal data.
  3. Check exemptions: whether each flow falls within the four cases of clause 6, Article 20 or the Government-prescribed cases; document the exemption basis in writing.
  4. Review the consent basis: update privacy notices and consent forms — clearly stating the outbound transfer, the recipient, the destination country and the transfer purpose (Article 9).
  5. Finalise transfer agreements: execute or amend contracts with overseas recipients to clearly evidence binding commitments and the allocation of data protection responsibilities.
  6. Prepare the impact assessment report in Form No. 09: covering all nine contents of clause 3, Article 18 of Decree 356, with particular care on the data flow diagram, recipient assessment and risk analysis.
  7. Prepare and file the notification (Form 01a) with the dossier: file before the first transfer where possible, consistent with the 15-day ex-ante review mechanism.
  8. Track the assessment outcome: receive the pass/fail notification within 15 days; complete the dossier within 30 days if required.
  9. Establish ongoing governance: assign the personal data protection department/personnel, keep the dossier available at all times, and build a dossier update calendar.
  10. Embed into operations: every vendor change, system change, data-scope expansion or M&A transaction must pass through a cross-border transfer review step.

12. Frequently asked questions (FAQ)

Q: My company uses email and cloud storage from an international provider (servers abroad) — is this a cross-border transfer? A: Yes. This is precisely case 3 of clause 1, Article 20: using a platform outside Vietnam's territory to process personal data collected in Vietnam. Even without actively "sending" data anywhere, processing on offshore infrastructure constitutes a cross-border transfer and triggers the dossier obligation — except for the employee-data cloud-storage portion exempted under point (b), clause 6, Article 20.

Q: Does storing employee data on the cloud require an impact assessment dossier? A: No, if the activity is limited to an agency or organisation storing the personal data of its own employees on cloud computing services (point (b), clause 6, Article 20). But if the enterprise also transfers employee data to its parent for decision-making, or the same system processes customer or candidate data — the portion outside the exemption still requires a dossier.

Q: What is the filing deadline? A: 60 days from the first cross-border transfer of personal data (clause 2, Article 20). However, given Decree 356's ex-ante review mechanism (pass/fail notification within 15 days), enterprises should complete and file the dossier before the first transfer to avoid legal risk.

Q: Must the impact assessment dossier be redone every year? A: No. Clause 3, Article 20 provides that the assessment is conducted once for the entire duration of operation and is updated when circumstances change. Enterprises need an update mechanism triggered by new transfer purposes, changes of recipients/processors, system changes or service-provider changes.

Q: Do intra-group transfers (parent–subsidiary) require a dossier? A: Yes. The law provides no separate exemption for intra-group transfers. A Vietnamese subsidiary is an independent legal person; transferring personal data to its overseas parent or sister companies remains a cross-border transfer subject to the full obligations.

Q: What is the penalty for failing to prepare an impact assessment dossier? A: The maximum fine for an organisation violating cross-border transfer rules is 5% of the immediately preceding year's revenue; where there is no revenue or the revenue-based amount is below VND 3 billion, the VND 3 billion level applies (clauses 4 and 5, Article 8). Specific fines per violation await the Government's detailed sanctions decree.

  • Vietnam's Personal Data Protection Law 91/2025: Obligations of FDI Enterprises from 1 January 2026 (T-521): a comprehensive overview of all eight obligation groups for FDI enterprises under Law 91/2025 — from consent and processing impact assessments to 72-hour breach notification. This article (T-523) takes a deep dive into one of those obligations: cross-border outbound transfers.
  • Vietnam Personal Data Protection Compliance Checklist for FDI Companies (T-529): a 14-step general compliance checklist — enterprises may use it alongside the 10-step transfer-specific checklist in section 11 of this guide.
  • T-543 and T-545 (same DAT cluster): forthcoming in-depth articles in the personal data protection cluster — links will be added upon completion.

14. When to work with counsel

FDI enterprises should engage counsel where: transfer flows are complex (multinational groups, multiple systems, recipients in several jurisdictions); an exemption assessment is needed — particularly the boundary of the "employee data on cloud" exemption; data transfer agreements with overseas recipients must be drafted or renegotiated; a "failing requirements" notification has been received and only 30 days remain to complete the dossier; or a cross-border data leak or loss incident has occurred and a surprise inspection is a risk.

FLAT Law Firm advises FDI enterprises comprehensively on personal data protection compliance: data flow reviews, exemption assessments, preparation of cross-border transfer impact assessment dossiers in Form No. 09, notification procedures, and engagement with the specialized authority. Contact us for advice tailored to your enterprise's specific situation.

References

  • Law on Personal Data Protection No. 91/2025/QH15 (passed 26/6/2025, effective 01/01/2026) — Articles 8, 9, 20.
  • Decree 356/2025/ND-CP dated 31/12/2025 detailing the Law on Personal Data Protection (effective 01/01/2026) — Articles 18, 39, 42.

—