A data protection inspection in Vietnam is carried out by the personal data protection authority of the Ministry of Public Security, the Department of Cybersecurity and High-Tech Crime Prevention, known as the A05 Department. It normally announces an inspection 15 days ahead, but it may inspect immediately and without notice when it needs to verify, detect or stop a violation (Article 31(4) of Decree 356/2025/ND-CP). There is no grace period to assemble files once inspectors are at reception, so a foreign-invested company has to keep its inspection documents in a state where they can be produced the same day.
This guide covers who can inspect and fine, the documents an inspection actually tests, how to run the day, and what follows: fines under Decree 330/2026/ND-CP, remedial orders and the one-year limitation period. It reflects the texts in force on 13 October 2026.
Who can carry out a data protection inspection in Vietnam?#
Law 91/2025/QH15 leaves inspection to the Government (Article 35), and the Government set the rules in Article 31 of Decree 356. The inspecting body is the "specialised personal data protection agency", a unit of the Ministry of Public Security (Article 39(1) of Decree 356). Decree 330 names it: the Department of Cybersecurity and High-Tech Crime Prevention (Article 55(1)(b)). It is the same A05 Department that receives DPIA and transfer dossiers under Decision 778/QD-BCA-A05.
Article 31 of Decree 356 defines three things:
- Triggers. Inspections take place on a routine or ad hoc basis when there are grounds to suspect a violation, when a competent authority directs one, or as part of ordinary State management (Article 31(1)).
- Who can be inspected. Any organisation that processes personal data, any business providing personal data processing services, any organisation required to carry out a DPIA or a cross-border transfer impact assessment, and anyone connected with a violation (Article 31(2)). In practice that is every operating company.
- What is examined. The company's overall compliance, its DPIA and cross-border transfer assessment work, and any processing-services business (Article 31(3)).
Cross-border transfers have their own rhythm. The A05 Department may inspect them periodically, no more than once a year, or ad hoc when it detects a violation or when personal data is leaked or lost (Article 20(4) of Law 91). For a subsidiary that sends HR or customer data to its parent, a breach at group level can therefore lead straight to an inspection in Vietnam.
Inspection and fining are related but separate. Decree 330 spreads the power to fine for data protection violations across the police and other authorities: the Director of the A05 Department and provincial police directors may impose the maximum fine, heads of operational divisions in A05 and in provincial police up to 80% of it, commune police chiefs up to 50% (Article 72(2), (3), (5) and (6)), and chairs of provincial People's Committees also up to the maximum (Article 73(2)). Some sectoral authorities, such as provincial Departments of Industry and Trade, have fining powers too (Article 77), each within its own field and territory (Article 78). Inspectors and police officers on duty may draw up a violation record (Article 79). Do not assume that the A05 Department is the only authority that can act on what an inspection finds.
The 15-day notice and the unannounced inspection#
Under Article 31(4) of Decree 356, the A05 Department issues an inspection decision and notifies the company at least 15 days in advance of the timing, scope and members of the team. The exception is an unannounced inspection "to promptly verify, detect or prevent" a violation, which can start at once.
When notice is given, the company must prepare everything the decision asks for and everything within the scope of Article 31(3) (Article 31(5)). Read the decision closely: it sets the scope. A notice that mentions cross-border transfers tells you where the questions will go.
When no notice is given, there is still a decision. Ask to see it, check the names of the team members against it, and record the time they arrived. Decree 356 does not lay down a separate procedure for the visit itself, and the general rules on inspections sit in other legislation, so a company facing a contested inspection should get advice on its procedural rights.
Which inspection documents does a data protection inspection in Vietnam test?#
The texts point to six sets of documents. The useful way to read them is through the Decree 330 penalties that apply when a company cannot produce them, because several fines are triggered specifically by failing to show something when inspected.
| Document | Legal basis | What happens if it is missing |
|---|---|---|
| DPIA dossier: Form 10 report, copies of processing contracts, internal policies and forms; proof of filing with A05 | Article 21(1) Law 91; Article 19(2)–(4) Decree 356 (the dossier "must always be available" for inspection) | VND 20–30 million for not preparing or keeping it at the head office, with an order to stop processing until it is filed and confirmed; same range for not filing within 60 days (Article 55(1)(a), (b) and (3) Decree 330) |
| Cross-border transfer dossier (Form 09) where data leaves Vietnam, including group systems | Article 20(2) Law 91; Article 18 Decree 356 | VND 30–50 million for not preparing or filing it, and separately for not keeping it ready for inspection (Article 56(1)(a), (b) and (dd)) |
| Records of consent: who agreed, when and to what | Article 6(1) and (2) Decree 356 (the controller bears the burden of proof) | VND 30–50 million for not logging consent or being unable to prove it when inspected (Article 43(1)(g)) |
| Legal basis for processing without consent (contract, legal obligation, labour management) | Article 19 Law 91 | VND 30–50 million for being unable to prove the legal ground when inspected (Article 47(3)(b)) |
| Appointment of the data protection officer or department, or the service contract with an outside provider | Article 33(2) Law 91 | VND 20–30 million for having no formal appointment; warning or VND 10–20 million where the appointment does not set out functions and powers or there is no confidentiality agreement (Article 57(1) and (2)) |
| Processing agreements with every processor, plus breach records | Article 37(2)(a) and Article 23(2) Law 91 | VND 10–20 million for not drawing up the breach confirmation record (Article 54(1)(b)) |
The amounts are for organisations; an individual committing the same violation faces half (Article 7(1) of Decree 330). Inspectors also look at whether the paperwork matches reality. A Form 10 report that describes one HR system when the company runs three is an "update" failure: dossiers must be updated every six months when there are changes, and immediately in the cases in Article 22(2) of Law 91, with fines under Article 55(1)(d) and (dd) and Article 56(1)(d) of Decree 330.
Two items are easy to overlook in a group setting:
- Consent collected by the parent. If a global web form or app collects consent from Vietnamese customers, the Vietnamese company still needs to produce the log for its own processing. A screenshot of the group privacy policy does not show who agreed and when, which Article 6(1) of Decree 356 requires.
- Default settings. Pre-ticked boxes and unclear "agree/decline" choices are prohibited (Article 6(3) of Decree 356) and fined VND 30–50 million (Article 43(1)(c) of Decree 330). Group consent templates designed for opt-out regimes should be checked before an inspector does it.
For the content of each dossier, see what a DPIA is, the cross-border transfer impact assessment guide and what a DPO is.
Running the day of an unannounced inspection#
Nothing in Decree 356 tells a company how to receive inspectors, so this part is practice rather than law. What the law does require is cooperation: a controller must work with the Ministry of Public Security and provide information to support the investigation and handling of violations (Article 37(1)(i) of Law 91). Not cooperating, or obstructing, is itself a violation in some contexts: obstructing an inspection of cross-border transfers carries VND 50–100 million (Article 56(2)(d) of Decree 330), and failing to cooperate with A05 in handling a violation carries VND 60–80 million (Article 54(4)(b)).
A workable protocol for an FDI subsidiary:
- Reception calls one person. Name a single internal contact, usually the data protection officer or head of legal, plus a deputy. Reception should not answer questions or hand over documents.
- Check the inspection decision. Note the scope, the team members and the issuing authority. Keep a copy.
- One room, one log. Work from a meeting room, keep a log of every document requested and provided, and make a copy of everything handed over.
- Speak through the people who know. The data protection officer presents the data map and dossiers; the IT lead answers technical questions. Avoid speculation. If an answer is not known, say it will be provided and note the deadline.
- Inform the parent, carefully. Group legal will want to know at once. Sending the inspection decision, inspectors' requests or copies of personal-data-heavy documents to a server or person abroad can itself be a cross-border transfer of personal data (Article 20(1) of Law 91). Brief headquarters with a summary that does not contain personal data, and route any data through channels already covered by the company's transfer dossier.
- Read the record before signing. The legal representative or an authorised person should read every finding, ask for missing context or disagreement to be recorded, and keep a copy. Remediation deadlines in the record start running immediately.
There is no legal privilege to invoke. Vietnamese law has no attorney-client privilege for documents in the company's hands. The company inspected must prepare what the inspection decision asks for (Article 31(5) of Decree 356), the texts carve out nothing for legal advice, and obstructing personal data protection activities is fined VND 40 to 60 million (Article 39(2)(a) of Decree 330). The lawyer's duty of confidentiality in Article 25 of the Law on Lawyers binds the lawyer and the law firm; it does not shield a memo the company holds, and nothing protects in-house counsel's communications. What a company can legitimately do:
- Hand over what falls within the scope of the inspection decision, not the whole legal file, and record each document handed over in the log and the minutes.
- Keep legal memos and advice separate from operating records and the compliance dossier, so they are not swept in by default.
- Mark trade secrets as confidential and ask in writing that the team keep them confidential.
- Have the external lawyer attend as the company's authorised representative, and review the minutes before anyone signs.
Do not refuse outright: a refusal turns a compliance finding into an obstruction fine.
A separate practical point: an English-only group policy is harder to present to Vietnamese inspectors than a Vietnamese version. Having the core policies, consent texts and the data protection officer's appointment in Vietnamese saves time on the day.
Fines, remedial orders and the one-year limit after a data protection inspection in Vietnam#
Most data protection fines in Decree 330 are set in bands of tens of millions of dong per violation. The ceilings are higher: VND 3 billion per violation generally, 10 times the revenue from the violation for buying or selling personal data, and 5% of the previous year's revenue for an organisation that breaches the cross-border transfer rules (Article 7(4)). Article 56(3) applies the revenue-based fines (1% to 5% of revenue in the Vietnamese market) where a company transfers data without a dossier, hides or misdeclares data flows and this leads to a leak, or continues transferring after a stop order. For the full map, see PDPL penalties in Vietnam.
The Decree 330 penalties rarely come alone. Article 5 lists the remedial measures the authority can order, including forcing the company to carry out data subjects' rights, to correct or delete unlawfully collected data, to remove violating elements from processing activities and contracts, and to hand back unlawful gains. Specific articles add sharper ones:
- Stop processing until the DPIA dossier is filed and confirmed, but only where the company started processing without preparing or keeping the dossier (Article 55(1)(a) and (3)(b)). A company that has the dossier but filed it late is ordered to file it (Article 55(3)(a)).
- Stop transferring abroad until the transfer dossier is complete and confirmed, where no dossier was prepared or filed, or where there is no transfer contract or consent (Article 56(6)(b)).
- Suspension of an activity for 1 to 24 months as an additional penalty where a specific article provides for it (Article 4(2)(b)); for the revenue-based transfer violations, suspension of cross-border transfers for 6 to 12 months (Article 56(5)(b)).
For a group whose Vietnamese HR, CRM or finance data runs on regional platforms, an order to stop transferring is more disruptive than the fine itself.
Limitation period. The limitation period for data protection fines is one year (Article 3(1) of Decree 330). For a continuing failure, the clock runs from the day the company actually performs the obligation or the violation is confirmed to have ended (Article 3(2)). On that reading, a DPIA or transfer dossier that was never filed remains open to a fine until it is filed. Decree 330 has applied since 19 August 2026 (Article 80); conduct that occurred earlier is judged under the rules in force at the time unless Decree 330 is more lenient (Article 81(1)).
Where foreign-invested companies are usually exposed#
The pattern in group structures is consistent. Personal data from Vietnam flows to regional HR, CRM or analytics platforms, but no transfer dossier names those recipients; see foreign SaaS and group systems in Vietnam. Consent is collected through group templates that cannot show who agreed and when. The data protection role sits with a regional privacy lead abroad, with no formal appointment in the Vietnamese entity. And DPIAs prepared under the old Decree 13 have not been updated for changes since 2026.
Each of these gaps maps onto a specific line in the table above, and each is something a data protection inspection in Vietnam will test. If you are reviewing a programme built before 2026, the Decree 356/2025 gap list shows what changed.
Staying ready for a data protection inspection in Vietnam#
Readiness is partly a legal duty: Decree 330 fines a failure to carry out periodic checks of compliance with the law and the company's own processing rules at VND 10–20 million (Article 47(1)(b)), in the article on processing that relies on grounds other than consent, which covers most HR processing. A practical cycle is a mock inspection every six months, timed with the six-month dossier update in Article 22(1) of Law 91:
- ask someone outside the data protection team to request each item in the table and time how long it takes to produce;
- compare the DPIA and transfer dossiers with the systems actually in use, and update them where they differ;
- pull a sample of consent records and check that each shows identity, time and content;
- confirm that the appointment of the data protection officer, or the outside provider's contract, is current and in Vietnamese;
- record what was missing, who owns it and the deadline.
LexData can play the inspection team in a mock audit and prepare the missing dossiers through its PDPL compliance consulting service; for the officer role itself, see outsourced DPO.
