Updated: 23 September 2026<\/p>\n
A personal data processing impact assessment dossier describes processing activities, assesses their effects and sets out safeguards. It is not a certificate confirming that a business has met every data obligation. The main provisions are Articles 21\u201322 of the Personal Data Protection Law and Articles 19\u201320 of Decree No. 356\/2025\/ND-CP.<\/p>\n
Under Article 21, controllers and controllers-cum-processors must prepare, retain and submit dossiers as required; processors prepare and retain them as agreed with controllers. Article 19(1), (2) and (4) of Decree No. 356 also addresses preparation, contents and submission for all three categories. Processors must follow the detailed rules rather than assume that working under contract exempts them from filing. Check Article 38 of the Law and Article 41 of the Decree for special arrangements.<\/p>\n
A retailer operating a loyalty programme, for example, must describe its decisions on data collection and use. The platform provider supplies information about infrastructure, processing flows, subcontractors and safeguards within its scope. The parties should not use the same generic description where their roles and activities differ.<\/p>\n
Article 19 of Decree No. 356 prescribes the assessment report in Form No. 10. It covers the parties, data protection contacts, purposes, data categories, processing processes and flows, notices and consent, retention periods, safeguards, impact assessment and mitigation measures.<\/p>\n
Processing contracts or agreements, internal rules and related documents must be checked against that article. The application uses Form No. 02a or 02b as applicable. Take the precise checklist from the current annex rather than reuse the forms under Decree No. 13\/2023\/ND-CP unchanged.<\/p>\n
A useful assessment identifies specific risks. Customer data might be downloaded in bulk by employees, accessed beyond scope by subcontractors or retained in backups beyond its purpose. Corresponding controls may include restricted permissions, access logs, data export approvals and deletion procedures. These are examples of controls, not the only legally acceptable measures.<\/p>\n
One original dossier must be sent to the Ministry of Public Security's specialised personal data protection authority within 60 days of the first day of personal data processing, as prescribed. Article 19 permits online, in-person or postal submission. Check the procedure published on the public service portal and the Ministry's correct receiving unit when filing.<\/p>\n
The Decree provides a 15-day assessment period and, where completion is requested, a 30-day period to complete the dossier. These periods should not be presented as guaranteed approval deadlines: quality, completeness and supplementary requests may affect processing.<\/p>\n
Article 22 requires updates every six months where contents have changed, and immediate updates in specified cases such as restructuring, cessation or other listed changes. It should not be described as requiring resubmission of the entire dossier every six months when nothing has changed.<\/p>\n
Internal governance should trigger reassessment when a processing purpose is added, a provider changes, sensitive data is introduced or the storage model changes. Then apply Article 22 and Article 20 of Decree No. 356 to determine the update type, documents and timing.<\/p>\n
The Personal Data Protection Law Handbook describes two organisation-level dossiers: a processing impact assessment covering processing activities, and a cross-border transfer impact assessment covering transfers. This does not mean each CRM, website or provider needs a separate dossier. The essential requirement is complete coverage of the relevant activities, parties and flows under Articles 18\u201319 of Decree No. 356.<\/p>\n
Consolidation does not mean a corporate group may use one legal entity's name to replace every subsidiary's obligations. Identify the responsible organisation, its role and each activity's scope before consolidating documents.<\/p>\n
System diagrams, data inventories and access permissions can inform both impact assessments and cybersecurity plans. However, the purposes and competent authorities differ: impact assessments examine data processing and its effects on individuals, while security level dossiers establish system protection requirements under the Cybersecurity Law and Decree No. 331.<\/p>\n
If a contract states that the provider retains no copies but the design includes overseas backups, resolve the inconsistency before completing the dossier. This is why the transfer and security level articles are useful alongside a report template.<\/p>\n
Must a dossier prepared before 1 January 2026 be completely replaced? Article 39 provides transitional arrangements for dossiers already received. Check the existing dossier and make updates under current rules when required.<\/strong><\/p>\n Does a DPIA replace an overseas transfer dossier? Not automatically. Transfers are governed by Article 20 of the Law and Article 18 of Decree No. 356; obligations and exemptions must be identified separately.<\/strong><\/p>\n Personal Data Protection Law No. 91\/2025\/QH15<\/a><\/p>\n Decree No. 356\/2025\/ND-CP implementing personal data protection requirements<\/a><\/p>\n Cybersecurity Law No. 116\/2025\/QH15<\/a><\/p>\n Decree No. 331\/2026\/ND-CP on cybersecurity assurance by security level<\/a><\/p>\n Sources checked through 23 September 2026.<\/em><\/p>\n Article 02 Vietnam Personal Data Protection Law and Business Responsibilities in 2026<\/a><\/p>\n Article 05 Overseas Cloud and CRM Services and Vietnam Data Transfer Filings<\/a><\/p>\n Article 12 Vietnam Information System Security Level Dossiers and Approval Authorities<\/a><\/p>\nLegal sources<\/h2>\n
Related articles<\/h2>\n