Personal Data Processing Impact Assessment Consulting Service in Vietnam

Personal data is a critical asset in the digital economy. However, collecting, storing, analyzing, sharing, transferring, and deleting personal data may create legal, cybersecurity, operational, and reputational risks.

Vietnam’s Law on Personal Data Protection No. 91/2025/QH15 and Decree No. 356/2025/ND-CP establish obligations relating to personal data processing impact assessments. Relevant controllers, controller-processors, and processors must prepare and retain an assessment dossier from the commencement of processing activities.

A Personal Data Processing Impact Assessment is a structured process for identifying data flows, examining processing purposes and compliance, assessing potential impacts on data subjects, and establishing proportionate safeguards.

The dossier should reflect actual processing practices across websites, applications, customer databases, employee records, marketing systems, cloud services, vendors, and internal information systems.

• Information on the controller, controller-processor, processor, and relevant third parties.
• Details of the personal data protection department, personnel, or external service provider.
• Processing purposes, data categories, processing activities, and personal data flow diagrams.
• Consent mechanisms and policies on retention, deletion, and destruction.
• Organizational and technical security measures, system design, and applicable standards.
• Compliance assessment, risk analysis, possible consequences, and mitigation measures.

The dossier generally includes the assessment report under Form No. 10, relevant data processing agreements, internal policies, procedures, forms, and supporting evidence.

Common issues include incomplete data inventories, unclear controller-processor roles, overly broad consent language, excessive retention periods, inconsistent vendor contracts, undocumented data flows, and insufficient evidence of security controls.

1. Review business activities, information systems, and applicable requirements.
2. Interview relevant departments and prepare a personal data inventory.
3. Identify legal roles for each processing activity.
4. Prepare data flow diagrams and identify domestic and overseas recipients.
5. Assess legal, operational, cybersecurity, and data-subject risks.
6. Draft the assessment report and supporting documents.
7. Review consent forms, privacy notices, contracts, policies, and procedures.
8. Support dossier submission, explanation, amendment, and updating.

Our approach combines legal analysis, data governance, risk management, and information security. The objective is not only to prepare a dossier but also to establish a practical and sustainable personal data protection framework.

KM UNION’s service is designed for Vietnamese and foreign-invested enterprises that collect or use personal data in daily operations. Typical clients include technology companies, e-commerce platforms, schools, hospitals, clinics, financial service providers, manufacturers, retailers, hotels, recruitment agencies, logistics businesses, professional service firms, and organizations operating websites or mobile applications. Even a company with a small workforce may process a substantial volume of customer, employee, supplier, camera, location, payment, or online identifier data.

The service is especially valuable when an organization is launching a new digital product, implementing customer relationship management software, centralizing employee records, engaging a marketing vendor, using artificial intelligence, changing its cloud environment, or preparing for investment and legal due diligence. KM UNION can also assist organizations that have already started processing personal data but have not yet documented their data inventory, processing purposes, legal roles, risks, or internal controls in a consistent manner.

A standard form cannot identify how data actually moves through an organization. Two companies in the same industry may use different applications, vendors, retention periods, access controls, consent mechanisms, and business purposes. Copying a generic dossier can therefore create contradictions between the written report and operational reality. Those contradictions may become apparent during an authority review, customer audit, security incident, investment transaction, or dispute with a data subject.

KM UNION builds the assessment from evidence. Our consultants review relevant contracts, privacy notices, consent language, system descriptions, vendor relationships, internal policies, and interviews with responsible departments. This evidence-based approach helps the dossier explain not only what data is processed, but why it is necessary, who participates, how it is protected, what could go wrong, and which measures reduce the identified risks.

KM UNION begins with a focused scoping exercise so the project remains proportionate to the client’s size and risk profile. We identify high-priority systems and processing activities, assign information owners, and provide a clear document request list. Workshops are conducted in plain business language, allowing legal, human resources, marketing, sales, customer service, information technology, and security teams to contribute without needing specialist privacy knowledge.

After mapping the data lifecycle, KM UNION prepares a gap analysis and a prioritized remediation plan. Critical gaps, such as missing processor terms, unclear consent, unrestricted access, excessive retention, or undocumented sharing, are separated from longer-term improvements. The client therefore receives a usable compliance roadmap rather than a report that merely repeats legal provisions. Drafts are reviewed with relevant stakeholders before finalization to reduce factual inconsistencies and improve ownership across the organization.

Depending on the agreed scope, deliverables may include a completed impact assessment report, data inventory, processing activity register, data flow diagrams, role analysis, risk matrix, remediation plan, document checklist, consent wording, privacy notice recommendations, processor clauses, internal procedures, and a management summary. KM UNION can also prepare working notes that help the client’s responsible personnel explain the dossier and maintain it after completion.

Our goal is to create documents that remain useful after filing. A well-prepared assessment can support vendor onboarding, product design, security reviews, incident response, customer questionnaires, internal audits, and future updates. It also gives management a clearer view of where personal data is concentrated and which operations require closer oversight.

Personal data compliance is not only a defensive legal exercise. Enterprise customers, investors, business partners, and regional headquarters increasingly ask how an organization governs personal data. A credible assessment dossier can shorten due diligence, reduce repeated questionnaires, improve negotiations with major clients, and demonstrate that the company understands its technology and vendor risks.

Acting early is usually more efficient than responding under pressure. When documentation is prepared only after an incident or urgent request, departments may struggle to reconstruct data flows, locate contracts, verify access rights, or explain old processing purposes. KM UNION helps clients convert fragmented information into an organized compliance record and a realistic improvement plan before those pressures arise.

KM UNION combines legal interpretation with operational review. We do not treat privacy as the responsibility of one department because personal data normally crosses legal, human resources, technology, security, finance, sales, and marketing functions. Our multidisciplinary approach helps translate legal requirements into controls that employees can understand and apply.

Clients choose KM UNION for clear communication, structured project management, bilingual capability, and deliverables tailored to actual systems and contracts. We identify assumptions, distinguish confirmed facts from items requiring verification, and explain remediation priorities in practical terms. KM UNION also supports revisions when the authority requests clarification or when the client changes its processing purposes, systems, vendors, or organizational structure.

A preliminary review can quickly determine the likely scope of the dossier, the departments that should participate, the information that is already available, and the gaps that may affect timing. Contact KM UNION to discuss your business model, data environment, current documentation, and expected project schedule. We will propose a practical work plan aligned with your operational needs and compliance priorities.

The engagement normally starts with a kickoff meeting involving management and the principal data-owning functions. KM UNION confirms the project objectives, business entities, relevant products, systems, processing locations, and expected deliverables. A tailored information request is then issued so teams do not spend time collecting documents that have no impact on the assessment. KM UNION reviews the initial material, identifies inconsistencies, and uses focused interviews to close factual gaps. This disciplined discovery phase is essential because a reliable impact assessment depends on an accurate description of actual processing rather than assumptions based on an organization chart or a privacy policy alone.

The second stage converts collected information into a data inventory and processing map. Each important activity is examined from collection to deletion, including its purpose, data subjects, data fields, system owners, users, recipients, retention period, security controls, and supporting contracts. KM UNION then evaluates potential harm, existing safeguards, residual risk, and recommended treatment. Draft findings are discussed with the client so factual errors can be corrected and proposed controls can be tested against operational reality. The final stage consolidates the report, supporting documents, remediation plan, and filing package, followed by a management handover on maintenance and future updates.

A risk matrix is useful only when its conclusions can be explained. KM UNION avoids unexplained scores and generic labels. We describe the event that could occur, the weakness that may enable it, the people who could be affected, the likely consequences, and the controls that reduce likelihood or impact. Relevant scenarios may include unauthorized employee access, disclosure to an unintended recipient, excessive collection, use beyond the original purpose, inability to honor a data-subject request, retention after the business need ends, loss of a device, compromised credentials, vendor failure, or delayed incident response.

Risks are considered in context. The same technical weakness may create different consequences depending on whether the data relates to public business contacts, children, health, finance, biometrics, location, employees, or vulnerable individuals. Volume, frequency, duration, accessibility, reversibility, and the possibility of discrimination, fraud, financial loss, embarrassment, or physical harm are also relevant. KM UNION presents these factors in plain language and connects every priority recommendation to an identified risk, helping management decide which actions should be funded and implemented first.

Many assessment projects reveal that contractual documents do not match daily operations. A service agreement may say little about personal data, while the vendor can access a broad production database. A privacy notice may promise a short retention period even though backups are held much longer. A consent form may refer to one purpose, while marketing or analytics teams use the information for additional activities. KM UNION identifies these inconsistencies and recommends amendments that bring contracts, notices, consent language, procedures, and system settings into alignment.

Internal accountability is equally important. KM UNION can help define ownership for privacy notices, data-subject requests, vendor review, security incidents, retention decisions, access approval, and dossier updates. Responsibilities can be reflected in practical procedures and approval flows rather than broad policies that provide little guidance. When roles are clear, the organization is better able to maintain compliance after the consulting project ends and less dependent on individual employees who may later change positions or leave the company.

Preparation does not necessarily end when the initial dossier is completed. Questions may arise about a processing purpose, a recipient, a security measure, or the relationship between documents. KM UNION can assist the client in organizing explanations, identifying the evidence supporting a response, and updating affected sections consistently. We help avoid isolated edits that solve one question while creating a contradiction elsewhere in the dossier.

The assessment should also evolve with the business. New products, acquisitions, websites, artificial intelligence tools, vendors, databases, marketing programs, or changes in retention and access can alter the documented risk profile. KM UNION can provide periodic reviews or targeted update support, enabling the client to preserve an accurate record without repeating the entire project unnecessarily. This continuity is particularly valuable for growing companies whose technology and partner ecosystem changes quickly.

Project timing depends on the number of legal entities, systems, departments, processing activities, and vendors in scope, as well as the availability of responsible personnel and documentation. KM UNION therefore confirms the scope before proposing a schedule. A focused organization with organized records may progress quickly, while a group with multiple business lines and undocumented legacy systems will require deeper discovery. We explain these dependencies at the outset so the client can allocate internal resources and set realistic expectations.

Fees are similarly based on scope and complexity rather than the number of pages in the final report. Important factors include data sensitivity, system count, vendor relationships, contract review, workshops, required bilingual work, remediation documents, and submission support. KM UNION provides a clear proposal stating assumptions, inclusions, client responsibilities, and optional services. This enables clients to compare value and project coverage instead of choosing a low-cost template that may not withstand practical scrutiny.

A mature assessment process supports more than regulatory compliance. Product teams can use data maps to design proportionate collection; procurement teams can identify vendor requirements earlier; security teams can focus controls on higher-risk systems; legal teams can negotiate clearer responsibility; and customer-facing teams can answer privacy questions with confidence. These improvements reduce friction during sales, onboarding, audits, and partnerships.

KM UNION helps clients build this foundation without imposing a theoretical program disconnected from business priorities. The engagement is calibrated to what the organization can realistically maintain. Whether the immediate need is a first dossier, remediation of an incomplete file, preparation for due diligence, or integration of privacy into a new product, KM UNION provides a structured path from uncertainty to an evidence-based compliance position.

The quality and speed of an assessment improve when internal participants understand what information is required and why. KM UNION provides practical guidance before workshops so each department can identify its systems, data sources, recipients, vendors, storage practices, and current controls. Participants are not expected to interpret the law themselves. Instead, they explain the business process while KM UNION asks follow-up questions and translates the answers into the assessment structure. This division of responsibility reduces confusion, avoids unnecessary drafting by the client, and helps subject-matter owners verify the parts of the dossier that relate to their work.

KM UNION also helps the project sponsor manage decisions that cross departmental boundaries. Questions about retention, access, consent, vendor responsibility, or risk acceptance may require management direction rather than a technical answer from one employee. We summarize the available options, the risk addressed by each option, the operational impact, and the evidence needed to support the final decision. This makes the assessment process a useful governance exercise and creates a record of informed choices that can be revisited when the business or legal environment changes.

Contact KM UNION for an initial review of your personal data processing activities and a tailored compliance roadmap.