Decree 356/2025/ND-CP is the Government decree that implements Vietnam's Law on Personal Data Protection No. 91/2025/QH15. It was signed on 31 December 2025, took effect on 1 January 2026, and on that day Decree 13/2023/ND-CP ceased to have effect (Article 42(1) and (2)). For a foreign-invested company that built its privacy programme around Decree 13 in 2023, Decree 356/2025 does not force a restart: consents and filed dossiers carry over. What it changes is the detail. The sensitive data list now catches online tracking data and ID card images, data subject requests run on fixed deadlines, every company needs a data protection officer or an outside provider, cloud contracts need Vietnam-specific terms, and group HR transfers have their own exemption from the transfer dossier.
This is a working guide for compliance, legal and IT teams: what Decree 356/2025 means for an existing programme and what to update first. For an article-by-article overview of the decree itself, see our English summary of Decree 356/2025/ND-CP. It reflects the texts in force on 13 October 2026.
What survives from a Decree 13/2023 programme#
The transition rules sit in the Law, not in the decree. Article 39 of Law 91/2025 protects two things:
- Ongoing processing based on consent or an agreement under Decree 13/2023 continues. You do not need to collect consent again or re-sign the agreement (Article 39(1)).
- Impact assessment and overseas transfer dossiers that the A05 Department received before 1 January 2026 remain valid. You do not prepare new dossiers under the Law, but every update after that date follows the new rules (Article 39(2)).
Two practical limits follow from the wording. Article 39(1) protects processing that is "ongoing"; a new purpose added in 2026 needs its own legal basis under the new rules. And Article 39(2) protects dossiers the authority received. A dossier drafted in 2024 but never filed is not grandfathered, so it must be redone on the new forms: Form 10 for the processing impact assessment and Form 09 for the cross-border transfer report (Articles 18(2)(a) and 19(2)(a) of Decree 356/2025).
The policies, notices and contracts written for Decree 13/2023 still need a pass. Most cite Decree 13 articles that no longer exist, and several of the points below change their substance.
Decree 356/2025 against Decree 13: the gap list#
| Area | Under Decree 13/2023 | Under Law 91/2025 and Decree 356/2025 | What to update |
|---|---|---|---|
| Online tracking data | Data on online activity was basic personal data | Sensitive personal data (Article 4(1)(l)) | Consent wording, cookie and SDK inventory, access controls |
| Data protection officer | Tied to processing sensitive data (Article 28(2)) | Every organisation designates qualified staff or hires a provider (Article 33(2) of the Law) | Written appointment, qualifications, published contact details |
| Data subject requests | Timings in existing procedures were set under the old decree | 2 working days to reply, then 10 to 30 days to complete (Article 5) | Request procedure, processor clauses |
| Cross-border transfer report | Form 06 | Form 09, with a list of exempt cases (Articles 17 and 18) | New filings, update calendar |
| Dossier updates | Updated when the content changed | Every 6 months when there are changes; within 10 days for listed events (Article 20) | Change-management trigger in the compliance calendar |
| Breach of biometric or location data | Notice to the authority | Also notify affected individuals within 72 hours (Article 29) | Incident response plan |
| Cloud contracts | No cloud-specific article | Mandatory content and encryption at rest and in transit (Article 12) | Vietnam addendum to global cloud terms |
The sections below take these one at a time.
Sensitive personal data under Decree 356/2025: tracking, ID card images and health records#
Article 4(1) lists 12 groups of sensitive personal data. Three of them reach data that foreign-invested companies hold as a matter of routine:
- Tracking data. "Data tracking behaviour and activity in the use of telecommunications services, social networks, online media services and other services in cyberspace" is now sensitive (point l). Decree 13/2023 listed data on online activity as basic data. Analytics tags, advertising pixels and mobile SDKs that profile users therefore process sensitive data.
- ID card images. Images of the citizen identity card, the old citizen ID card and the identity card are sensitive (point i). HR onboarding files and customer KYC folders usually hold copies. The passport number, by contrast, stays in the basic data list (Article 3(7)); passport images are not named in point i.
- Health status (point d). Sick-leave certificates and medical examination results kept in HR files are sensitive.
Location data from location services (point h) and biometric data (point dd) round out the list for most employers: fleet tracking, fingerprint or face recognition attendance terminals and access gates.
Three consequences follow. When you ask for consent, you must tell the data subject that the data is sensitive (Article 6(4)). Access must be restricted by role, with documented processing procedures and security measures (Article 4(2)). And because the small-enterprise relief does not apply to a company that directly processes sensitive data, these routine files matter for the question discussed further down. See sensitive personal data for the full list.
Consent mechanics also tightened. Consent must be verifiable as to who agreed, when and to what (Article 6(1)). The controller keeps the record and bears the burden of proof in a dispute (Article 6(2)). Pre-ticked boxes and default opt-ins are prohibited (Article 6(3)). Global consent banners copied from another market should be checked against all three points.
Data subject requests: the Decree 356/2025 timetable#
Article 5 requires a written procedure and forms for handling requests, and sets two clocks. The controller replies within 2 working days with information on the procedure, then completes the request:
- view, correct or obtain data: 10 days, or 15 days where a processor or third party must act (Article 5(3));
- withdraw consent, restrict or object to processing: 15 days, or 20 days where a processor or third party must stop processing (Article 5(2));
- delete data: 20 days, or 30 days where a processor or third party must act (Article 5(4)).
Each request can be extended once, by up to 15, 10 or 20 days respectively. The controller must tell the data subject why and be able to show that the extension was necessary and reasonable. The withdrawal deadline does not apply where the processing does not need consent under Article 19 of the Law (Article 5(2)).
For a group that routes requests to a regional privacy team, the 2-working-day reply is the tight one: it runs on Vietnamese working days from receipt in Vietnam. The longer windows assume the processor acts quickly, so group HRIS, CRM and helpdesk contracts should commit the vendor to Vietnamese deadlines, not to the 30-day GDPR month. See data subject rights.
Cross-border transfers under Decree 356/2025: what counts and what is exempt#
Article 17(1) of Decree 356/2025 details the three cases of cross-border transfer in Article 20(1) of the Law. For most foreign-invested companies the first is the one that matters: storing personal data collected in Vietnam on servers outside Vietnam or on the cloud service of a provider located abroad (point a). The test looks at who provides the cloud service, not only where the data centre sits. A transfer to an organisation abroad (point b) and processing on a platform outside Vietnam (point c) complete the list.
Every cross-border transfer needs an impact assessment dossier filed with the A05 Department within 60 days of the first transfer (Article 20(2) of the Law). The dossier contains the Form 09 report, the transfer contract and the relevant policies (Article 18(2)), and is filed with Form 01a or 01b (Article 18(4)). The authority gives its result within 15 days and may require completion within 30 days (Article 18(5) and (6)). The assessment is done once for the life of the business and then updated (Article 20(3) of the Law). Step-by-step guidance is in our handbook entry on cross-border data transfer in Vietnam.
Exemptions that fit group structures#
Article 20(6) of the Law and Article 17(3) of the decree remove the dossier requirement in a few cases. Three are relevant to multinational groups:
- an organisation storing its own employees' personal data on a cloud service (Article 20(6)(b) of the Law);
- transfers to manage personnel across borders under labour rules, labour regulations and the collective labour agreement in accordance with law (Article 17(3)(d) of the decree);
- providing personal data across borders to sign contracts or carry out procedures for cross-border transport, logistics, money transfers, payments, hotels, visas and scholarships (Article 17(3)(dd)).
The HR exemption is the one most groups will lean on, and it depends on documents. If the parent company runs the global HRIS, approves salaries or manages succession planning, those flows should be described in the Vietnamese company's internal labour rules and related regulations; a flow that the documents do not cover is harder to fit within point d. Customer, supplier and marketing data are not covered by any of these exemptions.
An exemption removes the dossier, not the other duties. A transfer to the parent or to a vendor still needs a transfer agreement with the seven items in Article 7(1) of the decree: purpose, data subjects and data types, processing period and deletion, legal basis, protection duties, responsibility for data subject rights, and cooperation if a breach occurs. Transfers of sensitive data need physical security, encryption or anonymisation during transfer (Article 7(2)).
Updating the dossier#
Article 20 of the decree sets a fixed update rhythm. The processing and transfer dossiers are updated every 6 months from the first filing when a new purpose arises or a controller, processor or third party is added or changes (Article 20(1)). They are updated within 10 days when the company is reorganised, ends operations, is dissolved or goes bankrupt, when the details of its data protection service provider change, or when a business line involving personal data is added or changed (Article 20(2)). Updates use Form 03a or 03b (Article 20(3)). A merger, a change of DPO provider or an amendment to the enterprise registration that adds a data-driven business line can each start the 10-day clock.
One relief for groups that also handle "core" or "important" data under the Law on Data: where such data is personal data, the PDPL dossiers are enough and the separate cross-border risk assessment under Decree 165/2025/ND-CP is not required (Article 42(3) of Decree 356/2025).
A data protection officer for every company#
Under Decree 13/2023, the duty to designate a data protection department and officer was framed as a measure for processing sensitive data (Article 28(2)). Article 33(2) of the Law now requires every organisation to designate qualified staff or a department, or to hire an outside provider. Decree 356/2025 sets the conditions:
| Route | Conditions | Article |
|---|---|---|
| Internal data protection officer or department | Written appointment setting out duties and powers; college degree or higher; at least 2 years' experience after graduation in legal, IT, cybersecurity, data security, risk, compliance, HR or personnel work; trained in data protection; a confidentiality agreement | Article 13 |
| Individual hired as a service | College degree or higher; at least 3 years' relevant experience; in-depth data protection training; a contract; contact details published to data subjects | Article 15 |
| Organisation hired as a service | A technology or legal business with at least 3 staff meeting the Article 15 conditions and a capability profile; a service contract with a data processing agreement; details published | Article 16 |
A company may combine routes, for example an internal officer supported by an outside provider (Article 16(4)). The officer's contact details appear in the transfer report (Article 18(3)(b)) and in every breach notice (Article 28(1)(b)), so the appointment has to exist before the first filing.
Unlike the GDPR, there is no threshold based on core activities or scale: the duty applies to every organisation unless the small-enterprise relief below applies. Articles 13 and 15 say nothing about nationality or residence. In our reading, a regional data protection officer employed by the parent abroad can serve the Vietnamese entity in two ways: by becoming its own officer under Article 13 (secondment or concurrent appointment, a formal written appointment and a confidentiality agreement), or under a contract with the Vietnamese entity as an individual provider under Article 15 (3 years' experience, details published). The parent itself rarely qualifies as an organisation provider under Article 16. Either way, keep a Vietnamese-speaking contact in the country, or engage an outsourced DPO. Background: what is a DPO.
Cloud, AI and big data: new contract terms and yearly assessments#
Article 12 is short but changes how a group signs cloud contracts. A contract with a cloud provider that involves personal data must state compliance with Vietnamese personal data protection law, name the data protection staff and commit to the related administrative procedures (Article 12(2)(a)). It must also map the data flows and each party's role, set out security requirements, require immediate notice of any change that may affect the data, and cover retention and deletion, data subject rights and tiered access (Article 12(2)(b) to (g)). Personal data on the cloud must be encrypted at rest and in transit, with strict access rights (Article 12(4)).
Standard global cloud terms rarely mention Vietnamese law, so the practical answer is a short Vietnam addendum or a data processing agreement that maps onto Article 12(2). Cloud providers themselves must carry out a compliance assessment once a year (Article 12(3)(d)).
Similar yearly assessments apply to organisations running AI or metaverse systems (Article 10(5)(dd)) and to finance, banking and credit information businesses, which must also log all processing (Article 8(1)). Where personal data is processed automatically, the controller must tell data subjects, explain how the algorithm works and how it affects them, and offer a way to opt out (Article 10(3)). Big data processing requires at least multi-factor authentication matched to the sensitivity of the data (Article 9(3)(b)). The AI rules now sit alongside the Law on Artificial Intelligence.
Breaches of biometric or location data under Decree 356/2025#
The 72-hour notice to the A05 Department comes from the Law: it applies when a breach may harm national defence, security or public order, or the life, health, honour, dignity or property of data subjects (Article 23(1)). Decree 356/2025 adds the content of the notice (Article 28(1)) and the channel: Form 08, sent to the authority or through the National Personal Data Protection Portal (Article 28(2)).
Article 29 goes further for location and biometric data. The controller must notify the affected individuals within 72 hours of detecting the breach, report to the authority under Article 28 and keep the breach file for at least 5 years after the incident is resolved (Article 29(1)). The notice to individuals must cover, at minimum, when and how the breach was found, the data affected, the risks, the remedial steps, what individuals should do and who to contact (Article 29(2)). Where not everyone can be reached in time, the company posts a public notice on its website or app and notifies individuals as soon as it technically can (Article 29(3)).
A factory with face recognition gates or a logistics company with driver tracking falls squarely within Article 29. In finance, banking and credit information, a leak or loss of any sensitive data must be notified to both the authority and the data subjects within 72 hours (Article 8(3)). See the 72-hour rule.
Does the small-enterprise relief help a foreign-invested subsidiary?#
Many Vietnamese subsidiaries of foreign groups are small by headcount or revenue. Under Article 38(2) of the Law and Article 41(1) of Decree 356/2025, a small enterprise or start-up may choose not to prepare or update the processing impact assessment (Articles 21 and 22 of the Law) and not to designate a data protection officer (Article 33(2)) for 5 years from 1 January 2026. Micro-enterprises and household businesses are excused from the same obligations outright (Article 38(3) of the Law; Article 41(2)). Medium-sized enterprises get no relief. Decree 13/2023 had offered a 2-year opt-out to micro, small and medium-sized enterprises and start-ups, which no longer applies.
The relief is lost by a business that provides personal data processing services, directly processes sensitive personal data, or processes the data of 100,000 or more data subjects, counted cumulatively from the time that scale is reached (Article 41). "Directly" is not defined and processing includes collection (Article 2(6) of the Law), so in our reading an employer that keeps copies of employees' ID cards, medical results or fingerprint attendance records directly processes sensitive data and loses the relief. No A05 guidance says otherwise.
Size, by contrast, is measured on the Vietnamese company alone. Neither the Law nor the Decree defines "small" or "micro", so the general SME criteria apply (Article 4 of Law 04/2017/QH14 on Support for SMEs and Article 5 of Decree 80/2021/ND-CP): for trade and services, up to 50 employees on social insurance and revenue up to VND 100 billion or capital up to VND 50 billion. The company uses its own prior-year figures, and nothing aggregates the parent or affiliates. A draft Law on SME Development would raise these thresholds, so recheck before relying on them.
The relief never covers the cross-border transfer dossier (Article 20 of the Law), consent, data subject rights or breach notification.
When a Vietnamese subsidiary may need a processing services certificate#
Article 21 of Decree 356/2025 lists nine personal data processing services, including providing and operating systems or automated software that process data on behalf of controllers, data analytics, encryption services, and automated processing based on big data, AI, blockchain or the metaverse. A business offering them needs a certificate of eligibility issued by the Ministry of Public Security through the A05 Department (Article 24). Article 22 sets the conditions: the business must be established under Vietnamese law, its head of personal data processing must be a Vietnamese citizen residing in Vietnam, it needs at least 3 staff meeting the Article 13(2) conditions, suitable infrastructure, and passed processing and transfer impact assessments. The application is assessed within 10 days and decided within 30 days of a complete file (Article 25(3) and (4)).
This matters to foreign groups that run a SaaS business or a data-heavy outsourcing centre in Vietnam, and to those choosing between a local entity and selling cross-border. The decree does not say whether a subsidiary that processes data only for other group companies is "doing business" in these services; check that before setting up a shared-services centre. See personal data processing services.
Penalties and where to start#
Fines for breaching these rules are set by Decree 330/2026/ND-CP, in force since 19 August 2026; see PDPL penalties. For a company with a Decree 13/2023 programme, a sensible order is: confirm which dossiers the A05 Department actually received; fix the DPO appointment; re-map sensitive data, especially tracking, ID card images, health and biometric records; and then deal with the cloud contracts, the request procedure and the transfer update calendar. LexData reviews existing programmes against Decree 356/2025 and prepares the dossiers through its PDPL compliance consulting service.
