The DPIA template in Vietnam, section by section: completing Form 10 for a foreign-invested company

The DPIA template in Vietnam is Form 10 in the Appendix to Decree 356/2025/ND-CP, the "personal data processing impact assessment report". Decision 778/QD-BCA-A05 publishes the filing procedure; the report itself is Form 10. A controller completes Form 10 once for the whole company, attaches its processing contracts and data protection policies, and sends one original to the A05 Department of the Ministry of Public Security within 60 days from the first day it processes personal data, under cover of a notice on Form 02a (Article 21(1) of Law 91/2025/QH15; Article 19(2) and (4) of Decree 356).

This guide works through the DPIA template in Vietnam section by section from the position of a foreign-invested subsidiary, flags the entries group compliance teams most often get wrong, and applies the form to three situations FDI companies meet in practice. When a DPIA is required, and who is exempt, is covered in the handbook entry what is a DPIA. The texts cited are those in force on 13 October 2026.

Why a group GDPR DPIA does not fit the DPIA template in Vietnam#

Most foreign groups already run a GDPR data protection impact assessment process. It is useful raw material, but it answers a different question, and copying it into the DPIA template in Vietnam produces a report the A05 Department is likely to send back.

	GDPR DPIA (Article 35 GDPR)	Vietnamese DPIA (Article 21 Law 91; Form 10)
Trigger	A processing operation likely to result in a high risk	Any processing by a controller, from the first day; no risk threshold
Scope	One operation or a set of similar operations	One dossier for the whole company, done once "for the whole period of operation" and then updated (Article 21(2))
Filing	Internal document; the authority sees it only on prior consultation or request	One original filed with the A05 Department within 60 days (Article 21(1))
Review	None unless consulted	A05 returns "meets" or "does not meet" requirements within 15 days; gaps must be fixed within 30 days (Article 19(5) and (6) Decree 356)
Content	Free form, risk-focused	A fixed government form: company details, a checklist of every data category, consent, retention, deletion, security, compliance results, then a risk assessment

The practical consequence: a Vietnamese subsidiary does not file one DPIA per system. It files one data protection impact assessment of the company, in which each system appears as a processing flow. Who files is set by the Law. Article 21(1) of Law 91 puts the filing duty on controllers and controller-processors; a processor prepares and keeps its own dossier as agreed with the controller (Article 21(3)). Article 19(4) of Decree 356 says the dossier is filed without naming who files, and LexData reads it subject to the Law. In practice the point rarely matters: every processor is also the controller of its own employees' data and files a DPIA for that, so a company that processes for clients, such as a group shared-services entity running payroll for sister companies, should describe the client processing as a separate role and flow in the same dossier (items II.1 and II.2) rather than leave it out. Competent State agencies are outside the regime (Article 21(6)).

Small, micro and start-up companies have the relief in Article 38(2) and (3) of Law 91 and Article 41 of Decree 356. Two points decide whether a foreign group's subsidiary can use it:

• Size is measured on the Vietnamese company alone. Neither Law 91 nor Decree 356 defines the categories, so the general criteria of Law 04/2017/QH14 on Support for Small and Medium-sized Enterprises (Article 4) and Decree 80/2021/ND-CP apply. They use the company's own insured headcount and its own revenue or total capital for the previous year, self-declared, with no rule adding in the parent or affiliates (Articles 5 and 7 to 10 of Decree 80). A small company in trade or services has no more than 50 insured employees and either revenue up to VND 100 billion or total capital up to VND 50 billion.
• "Directly processing sensitive personal data" ends the relief, and most employers do it. The word "directly" is not defined. On the wording, an employer that collects health check results (Article 4(1)(d) Decree 356) or keeps images of employees' ID cards (Article 4(1)(i)) directly processes sensitive data, and no guidance from the A05 Department narrows this. LexData therefore advises subsidiaries not to rely on the relief and to prepare the DPIA.

What the dossier contains besides the Form 10 DPIA report#

Under Article 19(2) of Decree 356 the dossier has three parts:

1. The DPIA report on Form 10.
2. Copies of the contracts or agreements on personal data processing that bind the parties involved. For a subsidiary this usually means vendor data processing agreements, the intercompany agreement with the parent, and any shared-services agreement. See the handbook entry on the data processing agreement.
3. Policies, procedures, rules, forms and other documents on personal data protection: the privacy notice, consent forms, retention and deletion policy, access-control rules, the breach response procedure.

The cover notice on Form 02a identifies the company (including its investment certificate or enterprise registration and whether it is a domestic or foreign enterprise), lists the documents and carries the company's commitment to the accuracy and lawfulness of the dossier. The commitment sits in Form 02a, not in Form 10.

The dossier must be kept available for inspection (Article 19(4) Decree 356), and the fine for failing to keep it refers to keeping it at the company's head office (Article 55(1)(a) of Decree 330/2026/ND-CP). A file held only by a regional privacy team abroad does not meet that.

Completing the DPIA template in Vietnam, part by part#

Form 10 has two parts. Part A is the assessment of the filing company; Part B lists the other parties involved. Article 19(3) of Decree 356 sets the minimum content the report must cover, and the form follows it closely.

Part A, section I: basic information#

Name in Vietnamese and in the foreign language, tax code, head office, the business lines that involve personal data with their registered industry codes, the number of branches and representative offices, and the data protection unit or officer.

Common mistakes. Listing the group DPO instead of the Vietnamese entity's own appointee. Item I.8 asks for the internal unit or officer with a copy of the appointment decision (I.8.3), or the outside individual or organisation providing data protection services with the service contract (I.8.1, I.8.2). Industry codes copied from the investment certificate without checking which lines actually involve personal data are a second frequent problem. If the officer role is outsourced, see outsourced DPO in Vietnam.

Part A, section II: the processing activities#

This is the longest section and the one most often returned.

• II.1 Role. For each role the company plays (controller or controller-processor, processor, third party) state the groups of data subjects and how many. A subsidiary that runs payroll for sister companies is a processor for that activity and a controller for its own staff; both belong here.
• II.2 Processing flows. For each role: data subjects, purpose, basic and sensitive data processed and the processing activities, with a model of the process and the systems. Draw the flow from collection to deletion, including every onward transfer. A list of applications is not a flow.
• II.3 Data categories. Tick boxes against the list of basic data in Article 3 and sensitive data in Article 4(1) of Decree 356, with totals. Two categories surprise foreign teams: data tracking behaviour or use of online services (Article 4(1)(l)) and location determined through location services (Article 4(1)(h)) are both sensitive under Vietnamese law. A website with analytics or advertising tags, or a delivery app, will usually tick sensitive boxes.
• II.4 Consent. For each group of data subjects, describe the content, form and process of obtaining consent, and attach the forms. Where sensitive data is processed on consent, the person must be told that the data is sensitive (Article 6(4) Decree 356). Where a flow relies on a ground in Article 19 of Law 91 instead, say which one.
• II.5 and II.6 Retention and deletion. Attach the policies. For employees, Article 25(2) of Law 91 requires data to be kept for the period set by law or agreement and deleted when the contract ends unless an agreement or the law provides otherwise; the policy should show both.
• II.7 to II.10 Yes/No questions. Transfer of data to other parties (Article 17 of Law 91), whether for a fee, participation in a data exchange, providing personal data processing services, and cross-border transfer. Answer them factually. Ticking "Yes" at II.10 does not replace the separate cross-border dossier on Form 09; see the cross-border data transfer impact assessment.
• II.11 Security. The security plan, the technical, managerial and training measures, the standards applied, a system design diagram, and the security testing programme (content, scope, frequency, purpose).
• II.12 Compliance assessment. The form, date and result of the company's own compliance assessment. A company filing for the first time should run a gap assessment before drafting, or this line will be empty.

Part A, section III: the impact assessment itself#

III.1 asks for an overview of the business and why the processing is necessary, including the difficulties and risks. III.2 is the risk assessment, by quantitative and qualitative methods, setting out unwanted consequences and the measures to reduce or remove them. It has three heads, each answered in five steps: the aspects affected and the problem; the objective; the measures applied and proposed; how effective those measures are and their effect on those directly affected and others; and the recommended measures.

• III.2.1 impact on data subjects' rights and interests;
• III.2.2 impact on the security and integrity of the company's information systems (leaks, unauthorised access or alteration, disruption, vulnerabilities);
• III.2.3 impact on national security and social order, required only where the company processes basic data of more than 100,000 data subjects or sensitive data of more than 10,000.

The sensitive-data threshold in III.2.3 is low for an employer. A manufacturer with 12,000 workers enrolled in face-recognition attendance must complete it.

A DPIA report built from a GDPR register tends to fail here because it scores risk per system but never states the "objective" and "recommended measure" steps, or because it treats III.2.2 as a copy of the ISO 27001 statement of applicability. A short risk table per flow, with likelihood, impact, existing control, residual risk and an owner, followed by prose covering the five steps, satisfies the structure without padding.

Part A, section IV and Part B#

Section IV is the list of attached documents. Part B has three tables (controllers, processors, third parties) with name, tax code, data protection contact, the number and date of the processing contract, the service and a note. Every party named in the flows in II.2 should appear here with a signed agreement. Intra-group arrangements without a written contract are the gap seen most often in FDI groups.

Three FDI scenarios in the DPIA template in Vietnam#

Group HRIS run by the parent company#

The Vietnamese company employs the staff and decides why their data is processed, so it is the controller. The parent or a group shared-services entity operates the HRIS and appears in Part B under an intercompany agreement.

• II.2: one flow per purpose (recruitment, payroll, performance, group reporting), not one flow per module.
• II.4: candidates must consent to the processing of the information they provide (Article 25(1)(b) Law 91), and unsuccessful candidates' data must be deleted unless otherwise agreed (Article 25(1)(c)).
• II.10: "Yes" if the HRIS is hosted abroad. Storing the company's own employees' data on a cloud service is exempt from the cross-border dossier (Article 20(6)(b) Law 91), and transfers for cross-border HR management under labour rules and collective agreements are exempt under Article 17(3)(d) of Decree 356. The DPIA still describes the flow; the exemption only removes the Form 09 filing.

Face-recognition attendance at a factory#

Biometric data is sensitive (Article 4(1)(dd) Decree 356). Law 91 requires physical security for the devices that store and transmit it, restricted access, and a monitoring system to detect intrusion (Article 31(4)(a)). Data collected through technical measures for managing employees may be processed only if the workers clearly know about the measure (Article 25(3)(a)).

• II.3: tick biometric data; if the gates log location, check whether it also counts as location data.
• II.4: the consent form must say the data is sensitive (Article 6(4) Decree 356). Offering an alternative such as a card or QR code is good practice rather than a statutory requirement, and it makes the consent easier to defend.
• III.2.3: required once more than 10,000 workers are enrolled.
• Breach readiness: a breach involving biometric or location data must be notified to affected data subjects within 72 hours of discovery and recorded, with the record kept for at least 5 years (Article 29(1) Decree 356). The breach procedure attached to the dossier should show this.

Marketing CRM with tracking and advertising tags#

A retail or consumer subsidiary runs a CRM fed by its website, app and loyalty programme, with advertising pixels and automated email and SMS.

• II.3: behavioural tracking data is sensitive under Article 4(1)(l) of Decree 356, so the sensitive section is not empty.
• II.4: processing customer data for advertising requires the customer's consent and a way to refuse (Article 28(3) Law 91). For behavioural, targeted or personalised advertising, data may be collected by tracking websites and apps only with consent, and there must be a way to refuse sharing, a retention period and deletion (Article 28(8)).
• II.7 and II.10: passing audiences to advertising platforms is a transfer to another party, and if the CRM or the platforms process data abroad, a cross-border transfer. Name the platforms in Part B.

Filing the DPIA report and the A05 review#

File one original of the dossier, with Form 02a, online, in person or by post to the A05 Department within 60 days from the start of processing (Article 19(4) Decree 356; Article 21(1) Law 91). The procedure is listed in Decision 778/QD-BCA-A05. The A05 Department replies within 15 days with "meets requirements" or "does not meet requirements". If the dossier is incomplete or not in order, it asks the company to complete it within 30 days and may consider penalties if the company does not (Article 19(5) and (6)).

Neither Law 91 nor Decree 356 sets a separate deadline for a company that was already processing data before 1 January 2026 and had no dossier received under the old rules. The safe course is to file now rather than argue about when the 60 days began. A DPIA already received by the authority under Decree 13/2023 remains usable and does not have to be redone, but updates after 1 January 2026 follow the new rules (Article 39(2) Law 91); see is Decree 13/2023 still in effect.

Keeping the DPIA current, and what a missing one costs#

Updates to a DPIA template in Vietnam already filed are made on Form 03a, which describes what changed and why (Article 20(3) Decree 356):

• every 6 months from the first filing where a new processing purpose has arisen or a controller, processor or third party has been added or changed (Article 20(1));
• within 10 days of a reorganisation, termination, dissolution or bankruptcy; a change in the data protection service provider; or a new or changed business line involving personal data registered in the dossier (Article 20(2); Article 22(2) Law 91).

For a group subsidiary, the events that trigger the 6-month update are routine: a new SaaS vendor, a new group entity receiving data, a new marketing purpose. A change log maintained by the data protection officer makes the half-yearly filing a short exercise.

Fines in Section 6 of Decree 330 are set for organisations (Article 7(1)):

Breach	Fine	Basis
Processing without preparing or keeping the dossier at the head office; not filing within 60 days; deliberately not completing it when asked; missing the 6-month or 10-day update	VND 20 to 30 million	Article 55(1)(a) to (dd) Decree 330
Falsifying figures or giving misleading information in the dossier; refusing to correct it after a written request	VND 50 to 100 million	Article 55(2)

The remedial measures weigh more than the fine. The company can be ordered to prepare, complete and file the dossier, and, where it began processing without one, to stop the processing until the dossier is filed and confirmed by the authority (Article 55(3)(a) and (b)). For a factory attendance system or a live CRM, that order is the real exposure. Fines for the cross-border dossier are separate (Article 56); the background on penalties is in PDPL penalties.

A company starting from a group register can map it to the DPIA template in Vietnam using the record of processing activities as the bridge: each register entry becomes a flow in II.2, its data fields become ticks in II.3, and its vendors become rows in Part B. LexData prepares and reviews DPIA and cross-border dossiers through its DPIA and cross-border transfer dossier service.