A cross-border data transfer impact assessment in Vietnam is a dossier that any organisation sending personal data out of Vietnam must prepare and file, as one original copy, with the A05 Department of the Ministry of Public Security within 60 days from the first day of the transfer (Article 20(2) of the Personal Data Protection Law 91/2025/QH15). For a foreign-invested company the trigger is usually ordinary group life: customer records in the group CRM, staff files in a global HR system, a Microsoft 365 or Google Workspace tenant hosted abroad, monthly reports to the parent.
The dossier is not an approval to transfer. It is a filing, built around the report in Form 09 of Decree 356/2025/ND-CP, which the A05 Department reviews and marks as meeting or not meeting the requirements. This guide follows a Vietnamese subsidiary through the work: mapping its group data flows, applying the exemptions, writing the report, filing, and keeping the file current. For the definition of a transfer and the general conditions, start with the handbook entry on cross-border data transfer. The texts cited are those in force on 13 October 2026.
Which group data flows trigger a cross-border data transfer impact assessment in Vietnam?#
Article 20(1) of Law 91 lists three kinds of transfer, and Article 17(1) of Decree 356 restates them in operational terms:
- (a) storage abroad: personal data collected or stored in Vietnam is moved to servers outside Vietnam, or stored on the cloud service of a provider located abroad;
- (b) disclosure to a recipient abroad: an organisation in Vietnam transfers personal data to an organisation or individual abroad;
- (c) processing on a foreign platform: personal data collected in Vietnam is sent to a platform outside Vietnam for further processing.
The obligation is not limited to the controller. Article 17(1) of Decree 356 names the controller, the controller-and-processor, the processor and the third party that carries out the transfer. Form 09 also asks whether data leaves through a partner or intermediary agent in Vietnam (Part A, II.1.4), so routing a flow through a local vendor does not take it outside the regime.
The table below is our reading of how common group arrangements map onto these limbs. Each flow has to be checked on its facts; the label of a tool decides nothing.
| Group arrangement | Usual limb | Dossier needed? |
|---|---|---|
| Customer and lead data in a global CRM (Salesforce, HubSpot, Dynamics) hosted abroad | (a) and (c) | Yes |
| Monthly sales or receivables reports with customer names sent to the regional or global parent | (b) | Yes |
| Group email and file storage tenant hosted abroad, holding customer and supplier contacts | (a) | Yes, unless the tenant holds only the company's own employee data (see the exemptions below) |
| Global HRIS or payroll platform run by the parent for group HR management | (a), (b) or (c) | Possibly exempt under Article 17(3)(d) of Decree 356; see below |
| Passenger and passport data sent to an overseas hotel or embassy for a business trip or visa | (b) | No, Article 17(3)(dd) |
| A generative AI or analytics API called with customer data | (c) | Yes; see our guide on using foreign CRM and SaaS tools |
One cross-border data transfer impact assessment in Vietnam covers all of the company's transfers for its whole period of operation (Article 20(3) of Law 91). A subsidiary therefore prepares one dossier describing every flow, rather than a dossier per system or per recipient.
Exemptions from the cross-border data transfer impact assessment in Vietnam#
Article 20(6) of Law 91 and Article 17(3) of Decree 356 together exempt eight situations. Three of them rarely concern a private company: transfers by competent State agencies, press and media activity, and transfers already made public under the law. The remaining five are the ones to test:
- Own employees' data on a cloud service. An organisation that stores the personal data of its own employees on a cloud service is exempt (Article 20(6)(b) of Law 91). The wording covers storage of the company's own staff data; it does not reach customer data held in the same tenant, or employee data passed to another group company for its own purposes.
- Cross-border HR management. Transfers made to manage personnel across borders under labour rules, internal regulations and collective labour agreements in accordance with the law are exempt (Article 17(3)(d) of Decree 356). In our view a global HRIS is easier to fit within this exemption when the Vietnamese company's internal labour rules or HR regulations actually describe the group HR process and the transfer. Neither text says what those documents must contain, so treat this as a point to confirm rather than a safe harbour.
- Contracts, logistics, payments, travel. Providing personal data to sign a contract or to carry out procedures for cross-border transport, logistics, money transfers, payments, hotels, visas or scholarships is exempt (Article 17(3)(dd)).
- Emergencies and legal duties. Transfers that are truly necessary in an emergency to protect life, health or property, or to perform a duty under the law (Article 17(3)(c)).
- The data subject's own transfer. When the individual sends his or her own data abroad (Article 20(6)(c) of Law 91).
An exemption applies to a flow, not to the company. A subsidiary whose HR transfers are exempt still files for its CRM.
Small companies are not relieved of this dossier. For 5 years from 1 January 2026, small companies and start-ups may choose not to apply Articles 21 and 22 and Article 33(2) of Law 91, unless they provide personal data processing services, directly process sensitive personal data or process data of a large number of data subjects (Article 38(2)); Article 41(1) of Decree 356 sets the "large number" at 100,000 data subjects or more, counted cumulatively. Micro companies are exempt from the same articles without a time limit, subject to the same exceptions (Article 38(3) of Law 91; Article 41(2) of Decree 356). Article 20 is not on that list, so the cross-border dossier is still required. Article 22, however, governs updates to both the DPIA dossier and the transfer dossier. Read literally, a small company could therefore skip updates to its transfer dossier, but we would not rely on that reading without guidance from the A05 Department.
Who files when the data goes to the parent company?#
The filer is the party transferring the data out of Vietnam: in the usual structure, the Vietnamese subsidiary. The parent company abroad appears in the dossier as the recipient. Form 09 records each party separately (Part B): a table for any entity that transfers on the subsidiary's behalf, a table for each recipient abroad, and a table for other parties involved. For every entity it asks for the tax code, the data protection contact, the number and date of the contract or agreement for the transfer, and the service provided.
The dossier must include a copy of the contract or transfer document that binds the transferring and receiving parties to their responsibilities (Article 18(2)(b) of Decree 356). Within a group, that is usually an intra-group data transfer agreement, or a set of agreements, with an annex for each recipient. The penalty decree helps define what the agreement must contain. Under Article 56(2)(a) of Decree 330/2026/ND-CP, the fine is VND 50 to 100 million where no contract or transfer document binds the parties to protect the data, or where the agreement does not say who handles data subject requests after the transfer. For vendor terms, see the handbook entry on the data processing agreement.
How this differs from a GDPR transfer#
Groups that run an EU transfer programme should not assume it carries over. Vietnam has no adequacy decisions, no standard contractual clauses and no binding corporate rules route. Whichever contract the group uses, the core obligation is the dossier filed with the authority. A GDPR transfer impact assessment is an internal document focused on the law of the destination country. Form 09 instead assesses the recipient's own processing and safeguards, and whether they meet Vietnamese law (Part A, III.3.4), and adds a national security section for large volumes. EU clauses and an existing GDPR assessment are still useful raw material for the Vietnamese report. The handbook compares the two regimes in GDPR vs Vietnam's PDPL.
What goes into the Form 09 report#
Article 18(2) of Decree 356 sets out three components of a cross-border data transfer impact assessment in Vietnam:
- the cross-border transfer impact assessment report in Form 09;
- a copy of the contract or transfer document binding the transferring and receiving parties;
- the transferring party's policies, procedures, regulations, forms and other personal data protection documents.
The report itself must cover nine matters (Article 18(3)): contact details of the transferring party, recipient, processor and other parties; contact details of the data protection unit or staff, and any data protection service provider, on both sides; the purpose of the transfer, the categories of data, the transfer and processing activities and a data flow diagram; how consent is obtained, and the retention, deletion and destruction policy; the security plan after the transfer and the protection measures and standards applied; a diagram and description of the recipient's storage and processing systems; the recipient's procedure for onward transfers to third parties; the results of the transferring party's own compliance self-assessment; and an assessment of the recipient's level of protection, the risks and possible harm, and the measures to reduce or remove them.
Form 09 arranges this into a fixed template. In practice these are the sections that take the most time:
- Part A, I.8 (data protection staff). If the subsidiary uses an in-house data protection unit or officer, attach a copy of the appointment decision and evidence that the person meets the conditions in Decree 356 (I.8.3). If it uses an outside provider, attach the service contract (I.8.1, I.8.2). See what a DPO is under Vietnamese law.
- Part A, II (transfer activities). Each form of transfer is ticked with the category of data subjects and their number. II.2 asks for the purpose of each flow, whether sensitive data is involved, the processing after transfer, and a modelled diagram of the process and systems. II.3 is a tick-list of the basic and sensitive data categories in Articles 3 and 4 of Decree 356. Note that this list counts as sensitive several items that FDI teams often treat as ordinary, including location data from positioning services and behavioural data on the use of online services.
- Part A, III.2 (impact assessment). The impact on data subjects (2.1) and on the company's information security (2.2) must be assessed issue by issue, each with causes, solutions, positive and negative effects, and a recommendation, using quantitative and qualitative methods. Section 2.3, on the impact on national security and social order, is required where the transfer involves basic personal data of more than 100,000 data subjects or sensitive personal data of more than 10,000 data subjects. Group HR and CRM transfers of a large employer or consumer brand can cross these lines.
- Part A, III.3 (the recipient's level of protection). The subsidiary must describe how the parent or vendor processes and stores the data, its security plan and measures, and then evaluate their adequacy, their compliance with Vietnamese law and the residual risks. This needs input from the group's security team; a vendor's marketing page on certifications is not enough.
- Part A, IV and Part B. A list of attached documents, then the party tables described above.
The same form also asks whether the company transfers data for a fee, trades on a data exchange, or provides personal data processing services (Part A, II.6 to II.8). A "yes" to the last question raises separate obligations.
Filing the cross-border data transfer impact assessment in Vietnam with the A05 Department#
Timing. The dossier must exist before or at the start of the transfer. Article 56(1)(a) of Decree 330 fines failure to prepare it "before or during" the transfer. The original must reach the A05 Department within 60 days from the day the transfer starts (Article 20(2) of Law 91; Article 18(4) of Decree 356). The cross-border data transfer impact assessment in Vietnam is not a prior authorisation; the law lets transfers begin before filing.
How. One complete original copy is filed online, in person or by post, with the cover notice in Form 01a (organisations) or 01b (individuals) (Article 18(4)). Filing the cross-border transfer dossier is one of the A05 procedures announced in Decision 778/QD-BCA-A05, which points online filings to the Ministry of Public Security's public services portal.
What happens next. The A05 Department returns a result, meeting or not meeting the requirements, within 15 days (Article 18(5)). If the dossier is incomplete or incorrect, the company must complete it within 30 days, failing which penalties may follow (Article 18(6)). The authority may inspect transfers on a schedule no more than once a year, or without notice when it detects a violation or a data leak occurs (Article 20(4) of Law 91), and may order a transfer to stop where data is used for activities that could harm national defence or security (Article 20(5)).
Illustration. A Vietnamese subsidiary of a Japanese group moves its customer records into the group's CRM, hosted in Singapore, on Monday 16 November 2026. The 60-day period starts the next day (Article 147(3) of the Civil Code) and ends at the end of Friday 15 January 2027 (Article 148(1)). The project team should have the Form 09 report, the intra-group agreement and the policy pack ready at go-live and file well before mid-January, leaving room for a request to complete the dossier.
Dossiers filed under Decree 13. Decree 13/2023/ND-CP ceased to have effect on 1 January 2026 (Article 42(2) of Decree 356). A transfer impact assessment dossier that the authority received under Decree 13 before that date continues to be used; a company does not have to prepare a new dossier under Law 91, but any update after 1 January 2026 follows the new rules (Article 39(2) of Law 91). See what replaced Decree 13.
Keeping the dossier current after group changes#
Article 22 of Law 91 and Article 20 of Decree 356 set two update tracks, both filed using Form 03a/03b online, in person or by post:
- Every 6 months from the first filing, where a new transfer purpose has arisen or a controller, controller-and-processor, processor or third party has been added or changed (Article 20(1) of Decree 356). Adding a new SaaS vendor, a new group company that receives data, or a new use of HR data by the parent all fall here.
- Within 10 days where the company is reorganised, ceases operations, is dissolved or goes bankrupt; where the information about its data protection service provider changes; or where business lines or services involving personal data processing that were declared in the dossier arise or change (Article 20(2) of Decree 356). A merger, a change of outsourced DPO or a new licensed activity therefore starts the 10-day clock.
For acquirers, the transfer dossier is one of the first documents to request in a target review; see data protection due diligence in Vietnam.
Fines for a missing or stale dossier#
The amounts in the personal data section of Decree 330 apply to organisations; an individual committing the same violation is fined half (Article 7(1)).
| Violation | Fine for an organisation | Decree 330 |
|---|---|---|
| No dossier prepared, not filed within 60 days, not completed within 30 days of a request, not updated, not kept ready for inspection, recipient's data protection contact not notified, no control over onward transfers by the recipient | VND 30 to 50 million | Article 56(1) |
| No binding transfer contract; consent for the transfer purpose not ensured or data subjects not told about the transfer, the recipient and the purpose; no adequate security; obstructing inspection; continuing after a stop order; failing to notify the authority and stop the recipient after a breach at the recipient | VND 50 to 100 million | Article 56(2) |
| Transferring without a dossier, concealing or misdeclaring data flows, leading to a leak of data of 10,000 or more Vietnamese citizens, or continuing after a stop order | 1% to 5% of prior-year revenue in Vietnam, with a fixed scale of VND 200 million to VND 3 billion where there is no such revenue or the percentage gives less than VND 3 billion | Article 56(3) and (4) |
On top of the fine, the A05 Department can suspend transfers for 6 to 12 months for violations under Article 56(3), and can order the company to stop transferring until the dossier obligations are complete and confirmed by the authority (Article 56(5)(b) and (6)(b)). For a group that depends on shared systems, that last remedy is usually the real risk. The wider penalty picture is in PDPL penalties.
The practical starting point for a cross-border data transfer impact assessment in Vietnam is an inventory: every system, vendor and group company that receives personal data from Vietnam, with the data categories and the number of data subjects, checked against the exemptions above. LexData prepares and files cross-border transfer and DPIA dossiers for foreign-invested companies through its DPIA and cross-border transfer dossier service; the handbook explains how the Form 09 dossier differs from the DPIA in Form 10.
