Insights
Practical guides to Vietnamese company, employment and data protection law, written by LexData lawyers for investors, general counsel and HR teams.
Data localization in Vietnam from 2026: which companies must store user data in Vietnam under Law 116/2025 and Decree 333/2026, why a local subsidiary is caught sooner than an offshore provider, how it fits with cross-border transfers under the PDPL, and the fines.
How a data protection inspection in Vietnam works under Decree 356/2025: when the A05 Department may arrive unannounced, the inspection documents it tests, handling the visit, and the Decree 330 penalties and one-year limitation period.
Vietnam has no cookie statute, but Law 91/2025 and Decree 356/2025 make tracking an opt-in, sensitive-data question. What a global consent platform must change for Vietnamese visitors, and why GA4 and ad pixels also need a transfer dossier.
How a foreign-invested company completes the DPIA template in Vietnam: Form 10 of Decree 356 part by part, the documents filed with it, three FDI scenarios (group HRIS, face-recognition attendance, marketing CRM), filing with the A05 Department and updates.
Generative AI and personal data in Vietnam: when a ChatGPT, Claude or Gemini API call is a cross-border transfer, what the vendor contract must cover, what users must be told and which Decree 356 duties apply to AI systems.
Choosing between an outsourced DPO in Vietnam, an in-house data protection officer and the group's regional DPO: the Decree 356 conditions for each route, how a regional DPO can be used, conflicts of interest, dossier updates and the Decree 330 fines on each side.
How an FDI subsidiary in Vietnam prepares the cross-border data transfer impact assessment for data sent to its parent and group systems: which flows need it, what goes into Form 09, the 60-day filing with the A05 Department, updates and fines.
Data protection due diligence in Vietnam for foreign acquirers: which PDPL exposures stay with the target, what to request, personal data in the virtual data room, SPA protection and moving data into group systems after closing.
Decree 13/2023/ND-CP ceased to have effect on 1 January 2026. What Article 39 of Law 91/2025 keeps from a Decree 13 programme, what it does not, and what a foreign-invested company should redo.
Get started
Book a free 30-minute consultation. We'll outline your priority risks and next steps for your size and sector — no obligation.
Or contact us directly
Sent!
We'll get back to you within 1 business day.
