Compliance Consulting2–6 weeks
Vietnam PDPL compliance consulting for businesses
Review your processing activities, map personal data flows and build a compliance roadmap that fits your business.
Personal data protection counsel in Vietnam
Personal data protection
compliance in Vietnam,
with a lawyer at your side.
LexData advises on compliance, provides outsourced DPO services and prepares DPIA and cross-border transfer dossiers under Law 91/2025/QH15 and Decree 356/2025/ND-CP, for Vietnamese and foreign-invested businesses.
Or talk to us now:Call +84 348 573 267Zalo
- Lawyer admitted to the Ho Chi Minh City Bar Association
- Reply within 1 business day
- Confidential discussion
Vietnam has raised data protection from a decree to a full Law, with specific penalties for each violation.
- 1–5%of prior-year revenue in Vietnam
The revenue-based fine applies only to certain cross-border personal data transfer violations.
- 10×unlawful proceeds · max
Unlawful sale or purchase of personal data: 2–10 times the proceeds, with separate fine brackets where those conditions apply.
- 1 January 2026
The Personal Data Protection Law 2025 took effect; Decree 13/2023 was repealed and replaced by Decree 356/2025.
- RequiredDPO / unit
Many organisations must appoint personal data protection staff or a unit, or engage a data protection service provider.
Services
End-to-end services to reach and stay in compliance.
LexData's DPO, compliance consulting, training and DPIA services are combined to fit each business's needs and size on the way to compliance with Vietnam's Personal Data Protection Law.
DPO-as-a-Service1–2 weeks to activate
Outsourced Data Protection Officer (DPO) services in Vietnam
Compliance monitoring, record keeping and coordination of data subject requests under an agreed scope.
DPIA · Dossiers3–8 weeks
DPIA and cross-border data transfer impact assessment dossiers
Prepare, file and maintain DPIA and cross-border transfer dossiers as required by law.
Training & AwarenessHalf-day to 3 days
Data Protection Officer (DPO) training for businesses in Vietnam
DPO courses that build the legal knowledge and practical skills to run personal data protection in your business.
Beyond data protection, LexData also advises on
- M&A and due diligence
M&A deal advisory, legal due diligence and data due diligence on the target.
- Investment & licensing
Setting up foreign-owned companies and representative offices, amending the IRC and ERC, and business licences for FIEs.
- Ongoing corporate counsel
Legal retainers, commercial contracts, employment, work permits, restructuring and dissolution.
Process
A clear path from risk to lasting compliance.
- 01
Weeks 1–2Assess
Map every personal data flow and assess the current position against applicable regulations.
Gap and risk report
- 02
Weeks 3–6Design
Build policies, procedures, templates and technical measures that fit the size of your business.
Compliance document set
- 03
Weeks 6–8Implement
Put procedures into practice, train staff and publish notices to data subjects.
Operation & training
- 04
OngoingMonitor
Periodic reviews, incident response and updates when regulations or your business change.
Ongoing compliance
Why LexData
Leave compliance to specialists — and focus on your business.
- Legal
Deep expertise in Vietnam's legal framework
Our lawyers and data security specialists follow Law 91/2025, Decree 356/2025 and regulator guidance closely — not a foreign template imposed on Vietnamese rules.
Law 91/2025/QH15 · Decree 356/2025/ND-CP · regulator guidance
- Delivery
Deliverables, not just advice
You receive policies, procedures, templates and tools ready to operate — not a report that sits on a shelf.
Handover: DPIA dossier templates, DPO operating procedures, training materials
- Security
Security by design
We work to the security standards we recommend to clients, and handle your data on the principle of minimisation.
Data minimisation in every client exchange
Your lawyer
Advice led by a lawyer, from start to finish.
Every LexData engagement has a lawyer accountable for the substance, from the risk assessment to the legal opinion we hand over.
Founding Lawyer & Lead Counsel
Ho Thi Ha Nhi, Lawyer
Ho Thi Ha Nhi shapes LexData's advice under the Personal Data Protection Law No. 91/2025/QH15 and Decree 356/2025/ND-CP, and personally reviews the legal accuracy of LexData's Handbook and in-depth publications.
Free references, reviewed by our lawyer
- Legal entity
- LEXDATA CONSULTING LIMITED LIABILITY COMPANY
- Tax ID
- 0319715235
- Office
- 14th Floor, HM Town Building, 412 Nguyen Thi Minh Khai Street, Ban Co Ward, Ho Chi Minh City, Vietnam
FAQ
What businesses often ask.
Need an answer for your specific situation?Book a consultation →
How does Vietnam's Personal Data Protection Law 2025 differ from Decree 13/2023?
Law 91/2025/QH15 raises data protection from a decree to a law, effective 1 January 2026. Decree 356/2025/ND-CP, effective the same day, replaces Decree 13/2023 as the implementing regulation. The Law introduces de-identified data, expands data subject rights and extends its reach to foreign entities involved in processing the personal data of Vietnamese citizens.
Do small businesses and start-ups have to comply now?
Yes. Under Article 41 of Decree 356/2025/ND-CP, small enterprises and start-ups may choose not to perform certain obligations for 5 years from 1 January 2026. Household businesses and micro-enterprises are exempt only from Articles 21, 22 and Clause 2 of Article 33 of Law 91/2025/QH15 and must meet all other obligations; the exemptions do not apply in the three exceptions listed in Article 41.
What are the penalties for violations?
Penalties depend on the violation and the party. Clause 3, Article 56 of Decree 330/2026/ND-CP sets 1–5% of total revenue in the Vietnamese market for the preceding financial year for certain cross-border data transfer violations; Clause 4 sets alternative fine brackets where there is no revenue or the percentage-based amount is below VND 3 billion. Article 53 sets 2–10 times the proceeds for unlawful sale or purchase of data under Clause 1, with separate fine brackets under Clauses 2–3. All conditions must be checked before determining a fine.
How does an outsourced DPO work?
LexData acts as your personal data protection specialist or unit as required by law: liaising with the authority, monitoring compliance, handling data subject requests and reporting to management — without you having to hire in-house. See our outsourced DPO service →
How long does it take to become compliant?
It depends on your size and the complexity of your processing. An initial assessment usually takes a few weeks; remediation is prioritised by risk so the most important gaps are addressed first. See our compliance consulting service →
