Controller
Decides the purposes and means of processing, for example customer accounts, employee records or marketing campaigns.
Personal Data Processing Impact Assessment in Vietnam
Build an impact-assessment record from real processing activities, roles and safeguards, not a completed form detached from operations.
SERVICE GUIDE
Which role does your organisation play?
A company can be a controller in one data flow and a processor in another. The assessment starts with a role map, not with filling a template.
Controller and processor
Both decides and directly carries out relevant processing; responsibilities should be described for each activity.
Processor or recipient
Acts on another party’s instructions or receives data for a defined purpose; contracts and safeguards must match that role.
Article 38 of the 2025 Personal Data Protection Law gives qualifying small and start-up enterprises a five-year choice over the Article 21 assessment and Article 22 updates. Household businesses and micro-enterprises may also be exempt. Decree 356/2025 excludes certain data-processing service providers, direct sensitive-data processors and activities reaching 100,000 data subjects. We check the entity category, activity and cumulative scale before deciding whether an assessment is due.
SERVICE GUIDE
Separate processing and overseas transfer assessments
Decree 356/2025 provides different reports and notifications for the processing assessment and for qualifying cross-border transfers.
Processing assessment
Report Form 10 describes the parties, purposes, data types, data-flow diagram, protection measures and risk evaluation; it is sent with the applicable Form 02a or 02b notification.
Transfer assessment
A qualifying overseas transfer uses a separate Report Form 09 and the relevant transfer notification. It evaluates the recipient, destination and safeguards.
Case classification
A foreign cloud product is a signal to inspect the data route, but the legal answer depends on the actual location, recipient, access and applicable exceptions.
One filing cannot be presented as covering every transfer. We map both duties and the contracts before promising a filing package.
SERVICE GUIDE
Build a data map that can survive inspection
The report should correspond to systems and practices that teams can verify.
Collection and purpose
List website, app, CRM, HR, camera, support and marketing sources; record the legal basis and purpose of each use.
People and data
Identify customers, employees, candidates and other subjects; distinguish sensitive data and the scale of processing.
Storage and recipients
Record databases, cloud regions, internal access, vendors, group companies, retention and deletion.
Risk and safeguards
Document access control, encryption, incident response, contracts and the remaining risks for each flow.
Interviews with legal, IT, HR, marketing and operations usually reveal different versions of the same process. The draft assessment records the reconciled facts and any remediation that still needs implementation.
SERVICE GUIDE
The dossier is more than Form 10
The report is central, but an inconsistent contract or privacy notice can undermine the whole record.
Report and notification
Prepare the appropriate official forms and explain roles, purposes, flows, consent or other legal basis, risks and safeguards.
Contracts and policies
Review processor or transfer agreements, privacy notices, retention rules, access controls and incident procedures.
Evidence pack
Retain system diagrams, approvals, vendor lists and version history so the report can be updated and checked later.
The decree states a 60-day submission period from the start of processing for an assessment subject to filing, with the dossier kept available for inspection. The actual start date, role and any specific legal exception must be confirmed.
SERVICE GUIDE
Maintain the record after submission
Submitting an assessment is not a general licence for every later use of the data.
Authority feedback
Track whether the file is accepted or requires clarification and preserve the submitted and corrected versions.
Business change
Review the dossier when a new app, CRM, vendor, data category, purpose or overseas flow is introduced.
Operating controls
Assign an owner for retention, access, incidents and vendor oversight rather than leaving the report as a one-time legal document.
We scope initial mapping, report preparation, transfer analysis, contract remediation and ongoing updates separately. A quote depends on the number of systems, departments, data categories and external recipients.
SERVICE GUIDE
A practical sequence for new and existing businesses
A product still in design has a different starting point from a company that has processed personal data for years.
For a new app or website, map intended collection before launch and design the notice, access controls and vendor terms around it. For an operating business without an assessment, record when processing began, what data is in each system and what corrective work is needed. For a group that filed under an earlier regime, compare the old report with the new roles, vendors and forms before assuming it remains complete.
The team should identify a factual owner for each answer: product for user flows, HR for personnel records, IT for storage and access, procurement for vendors and legal for contract and notice language. A report assembled from one department’s assumptions is less useful than a reconciled map.
SERVICE GUIDE
Authority feedback, changes and enforcement risk
The impact-assessment file must be kept available and should continue to reflect actual processing after initial submission.
Track the submitted version, authority response, clarification requests and resulting corrections. New cloud regions, analytics tools, sensitive-data uses, recipients or purposes may require the data map and assessments to be updated. A cross-border flow should also be tested against the separate transfer rules rather than buried in the processing report.
The applicable sanction depends on the particular conduct, effective enforcement rule and facts. The service page therefore does not promise that submitting a form cures earlier non-compliance. It scopes risk review, report preparation, vendor-contract changes and ongoing controls as distinct tasks.
HOW WE WORK
From first review to next decision
- Map systems and data flowsMap each system, category of data subject, purpose, recipient and overseas access.
- Classify roles and assessment dutiesClassify the organisation’s role and test Article 38 relief and exceptions before deciding what must be filed.
- Document risks and safeguardsPrepare the applicable assessment, notification and supporting evidence, separately testing transfer duties.
- Prepare, file and maintain recordsTrack authority feedback and update the dossier as systems, purposes, vendors and risks change.
INITIAL REVIEW
What to send for a useful first review
These items let us classify the route and give a realistic scope before requesting originals, translations or formal signatures.
- A list of website, app, CRM, cloud, HR and internal systems processing personal data.
- Purposes, subject groups, sensitive data and collection points.
- Vendors, group entities, recipients, storage locations and overseas access.
- Current privacy notices, contracts, security policies and incident processes.
- When processing started, any earlier DPIA filing and changes since then.
SERVICE GUIDE
What the engagement can deliver
A processing inventory, role map, risk and safeguard record, draft impact assessment and an update schedule for business changes. The assessment should be available for inspection and updated when processing changes. Before setting a deadline or price, check whether an exemption or transitional treatment applies to the specific entity and activity. Separate the domestic processing assessment from any cross-border transfer assessment, vendor-contract remediation and wider privacy-policy work in the engagement scope.
Questions before you proceed
Is this only for technology companies?
No. Any organisation processing personal data should assess its actual role and applicable duties.
Does one form cover overseas transfers too?
A cross-border transfer can require a separate assessment. Review the specific flow and current rules.
Is this a permit to process personal data?
No. The authority reviews the impact-assessment dossier; submitting it is not a universal licence for all data processing.
Does being a small company remove the filing duty?
A qualifying small or start-up enterprise can choose not to perform the Article 21 assessment and Article 22 updates for five years from the law’s effective date. Household businesses and micro-enterprises may be exempt. Exceptions apply to certain processing services, direct sensitive-data processing and processing at the statutory scale; eligibility needs a factual check.
What happens after a system or vendor change?
Reassess the data map, contracts, risks and whether an updated dossier or separate transfer assessment is required.
Is the processing assessment the same as a cross-border transfer assessment?
No. Decree 356/2025 lists separate reports and notification forms; the transfer flow needs its own analysis.
LEGAL BASIS
Source and scope
This guide draws on Law 91/2025/QH15 and Decree 356/2025/ND-CP and the corresponding Vietnamese service page. Forms, deadlines and filing routes should be confirmed against the current rules and the facts of each matter before submission.
NEXT STEP
Discuss the facts before filing
Send the current records, your planned activity and any deadline. We will identify the initial questions and agree the scope of work.