Updated: 23 September 2026<\/p>\n
The certificate of eligibility to provide personal data processing services is a separate mechanism under Decree No. 356\/2025\/ND-CP. It should not be confused with an impact assessment dossier or the amended data analysis and aggregation procedures under Decree No. 169. Assess each layer of a business model separately.<\/p>\n
Article 21 of Decree No. 356 lists personal data processing services. Categories include automated processing systems for controllers, credit scoring, online data collection, certain healthcare and education services, personal data analysis or use, encryption, automated processing using advanced technology and location-related platforms.<\/p>\n
A software name does not determine the entire scope. A product marketed as analytics may actually receive, organise and use customers' personal data. Conversely, processing employee data for a business's own administration does not automatically mean it provides processing services to the market. Compare Article 21's descriptions with the actual service and contract.<\/p>\n
Article 22 sets conditions for organisations established under Vietnamese law, the professional lead, management structure and personnel. These include at least three staff meeting the competency requirements referenced in Article 13(2). The professional lead must meet the nationality, residence and other conditions in that article.<\/p>\n
The organisation must also have suitable infrastructure, equipment, facilities and technology, and satisfactory results for its personal data processing impact assessment dossier and cross-border transfer dossier where transfers occur. Certification preparation is therefore linked to operational design, not merely collecting copies of qualifications.<\/p>\n
Article 25 requires an application using Form No. 04, the enterprise registration certificate, a document appointing a data protection department or a service contract, a project proposal and evidence of staff competence. The registration document need not be submitted where the authority can retrieve the information from a database under the prescribed conditions.<\/p>\n
The proposal must describe objectives, requested service areas, the business plan, processing scale, risk management framework, compliance assessment plan, relevant standards and technical regulations, identification and authentication, responsibilities and personnel. It should accurately reflect intended data flows, customers and technology.<\/p>\n
Under Article 24, the Ministry of Public Security has authority, exercised through the specialised personal data protection authority assigned by the Minister. Article 25 provides for one dossier to be submitted to that authority online, in person or by post.<\/p>\n
The process includes 10 days for dossier assessment, 15 days for the organisation to complete it when requested, and 30 days from receipt of a complete valid dossier for a decision as prescribed. Do not add or compress these periods into a promised result date for every case. Check the current forms and procedure published by the competent authority when filing.<\/p>\n
Article 23 requires compliance with data protection law, risk management and service obligations. Changes to the model, scope or certificate contents require review of replacement, reissuance and related rules. The certificate does not authorise every use of customers' data.<\/p>\n
One company may provide a cloud platform, analyse personal data and add cybersecurity monitoring. These raise three different questions: telecommunications service notification, personal data processing conditions under Decree No. 356, and cybersecurity business scope under Decree No. 332. Only actual activities within the relevant scope trigger the corresponding duties.<\/p>\n
Data roles can also differ by task within one contract. Storing data on customer instructions differs from using it independently to improve a product. Reassess purposes, roles and grounds for independent use; describing a provider as a processor does not override the facts.<\/p>\n
Before asking how many licences are needed, list services, inputs, outputs and each party's decision-making powers. The data services, cloud and cybersecurity licensing articles help assess each part of this inventory.<\/p>\n
Does Decree No. 347's repeal of analytics procedures also abolish this certificate? That cannot be inferred. This mechanism arises under Decree No. 356 and must be checked independently of amendments to Decree No. 169.<\/strong><\/p>\n Does sufficient staffing guarantee certification? No. Staffing is only one set of conditions; the authority assesses all conditions and the complete dossier.<\/strong><\/p>\n Personal Data Protection Law No. 91\/2025\/QH15<\/a><\/p>\n Decree No. 356\/2025\/ND-CP implementing personal data protection requirements<\/a><\/p>\n Decree No. 347\/2026\/ND-CP amending Decree No. 169<\/a><\/p>\n Decree No. 332\/2026\/ND-CP on cybersecurity products and services businesses<\/a><\/p>\n Telecommunications Law No. 24\/2023\/QH15<\/a><\/p>\n Sources checked through 23 September 2026.<\/em><\/p>\n Article 04 Vietnam Personal Data Processing Impact Assessment Requirements<\/a><\/p>\n Article 08 Vietnam Data Analytics Licensing Changes from 15 September 2026<\/a><\/p>\n Article 13 Vietnam Cybersecurity Licences and the 2026 Transition from ATTTM<\/a><\/p>\n Article 19 Vietnam Cloud Service Notification and Data Protection Responsibilities<\/a><\/p>\nLegal sources<\/h2>\n
Related articles<\/h2>\n