Foreign SaaS in Vietnam: when your group CRM, HRIS or Microsoft 365 tenant is a cross-border data transfer

Using foreign SaaS in Vietnam is lawful, and so is using foreign CRM in Vietnam. Vietnam has no rule that a subsidiary must run its CRM, HR system or email on local software. But once personal data collected in Vietnam sits on, or is processed through, a platform operated from abroad, the Vietnamese company is making a cross-border transfer under Article 20 of Law 91/2025/QH15 on Personal Data Protection. That brings three duties: a binding transfer agreement with the recipient, notice to the people whose data moves, and a transfer impact assessment dossier filed with the A05 Department, Ministry of Public Security, within 60 days of the first transfer (Article 20(2)).

For a foreign-invested company the question is rarely one CRM. It is the whole group stack: Salesforce or HubSpot, Workday or SuccessFactors, a Microsoft 365 or Google Workspace tenant, Zendesk or ServiceNow, all contracted by the parent and switched on for the Vietnamese entity. This guide works through that stack. The definitions are covered in our handbook entries on cross-border data transfer and controllers and processors; here the focus is how they land on a subsidiary's systems.

Is foreign SaaS in Vietnam a cross-border transfer at all?#

Article 20(1) of Law 91 lists three situations, and a typical SaaS deployment hits at least one:

• (a) personal data stored in Vietnam is moved to a storage system outside Vietnam;
• (b) an organisation in Vietnam transfers personal data to an organisation or individual abroad;
• (c) a platform outside Vietnam is used to process personal data collected in Vietnam.

Decree 356/2025/ND-CP closes the obvious gap. Its Article 17(1)(a) counts as a transfer the storage of data collected in Vietnam "on the cloud service of a service provider abroad", not only on servers physically located abroad. So the question "which region is our tenant in?" does not settle the analysis: a provider abroad, a parent abroad with access, or processing on an offshore platform can each bring the system within Article 20.

Two differences from the GDPR matter for group privacy teams. Vietnam has no adequacy decisions and no standard contractual clauses that make a transfer lawful by themselves. The core mechanism is a dossier filed with the authority, and the A05 Department may inspect transfers periodically, no more than once a year, or at any time when it detects a violation or a data leak occurs (Article 20(4)). The group's EU SCCs or intra-group agreement can be reused as evidence, but they do not replace the Vietnamese filing.

Data localisation rules under the cybersecurity legislation are a separate question, covered in data localization in Vietnam.

Foreign SaaS in Vietnam, system by system#

For foreign SaaS in Vietnam, exemptions exist, but they are narrow and each covers one kind of data, not a whole platform. Article 20(6) of Law 91 exempts three cases from the impact assessment, and Article 17(3) of Decree 356 adds five more. The ones an FDI subsidiary actually meets are these:

System	Typical personal data	Exemption that may apply	Practical reading
CRM (Salesforce, HubSpot, Dynamics)	Customer and prospect contacts, sales notes, call logs	None as a rule	Include in the dossier
Group HRIS (Workday, SuccessFactors)	Employee records, payroll, performance	Article 20(6)(b) Law 91: storing the organisation's own employees' data on a cloud service. Article 17(3)(d) Decree 356: transfers for cross-border HR management under labour rules, regulations and collective agreements	Often exempt from the dossier, but candidates' data, dependants' data and use by the parent for its own purposes need a separate look
Microsoft 365 / Google Workspace	Employees, but also every customer, supplier and candidate who emails you	Article 20(6)(b) covers only the employee part	Treat the tenant as in scope
Ticketing, customer support, chat	Customer identities, complaints, recordings	None as a rule	Include in the dossier
Travel booking, payroll payments, visa agents	Traveller and payee data	Article 17(3)(dd) Decree 356: data provided to conclude contracts or for cross-border transport, logistics, money transfers, payments, hotels, visas, scholarships	Usually exempt, limited to what the procedure needs

For most groups, then, it is using foreign CRM in Vietnam, the support desk and the mail tenant that put the subsidiary into the dossier, not the HR system. The exemption removes only the impact assessment. The other rules still apply: a legal basis, a transfer agreement under Article 7 of Decree 356 and security measures. A group HRIS can therefore be outside the dossier and still need a proper intra-group agreement.

Read the Article 17(3)(dd) contract exemption narrowly. It speaks of providing data "to conclude a contract" or to carry out the listed procedures. It does not, on its wording, cover keeping a customer database on an offshore CRM for as long as the relationship lasts.

Foreign SaaS in Vietnam: who is the controller when the parent signs the contract?#

In most groups the master subscription agreement and the vendor's data processing agreement are signed by the parent or a regional hub, and the Vietnamese company simply receives user licences. Vietnamese law still looks at the roles in Article 2 of Law 91:

• The Vietnamese subsidiary decides why it collects its customers' and employees' data. For that data it is normally the controller (Article 2(7)), and it carries the controller duties in Article 37(1), including choosing a suitable processor.
• The SaaS vendor processes on instructions under a contract, so it is a processor (Article 2(8)). Under Article 37(2)(a) a processor may receive personal data only after a processing agreement or contract with the controller is in place.
• The parent can play either role. It is a processor if it only operates the group platform for the subsidiary. It becomes a controller, or a "controller and processor" (Article 2(9)), once it uses the Vietnamese data for its own purposes such as group sales analytics or global talent reviews.

Sharing data "between units within the same organisation" is a separate ground in Article 17(1)(b). The parent is a separate legal entity, though, so treating the transfer to it as internal sharing is risky. The safer reading treats it as a transfer to another organisation abroad under Article 20(1)(b).

The paperwork follows from those roles. Article 7(1) of Decree 356 requires a transfer agreement with the recipient that states the purpose, the data subjects and data types, the processing period and deletion, the legal basis, protection responsibilities, responsibility for data subject rights, and cooperation when a violation is found. Article 18(2)(b) then asks for a copy of the contract binding "the organisations transferring and receiving" the data to be filed with the dossier. If the subsidiary is not a party to anything, it has nothing to file. The usual fix is an intra-group data transfer agreement between the subsidiary and the parent, together with written confirmation that the vendor's DPA extends to the subsidiary's data. Failing to have a binding agreement that sets out who handles data subject rights after the transfer is fined VND 50 to 100 million (Article 56(2)(a) of Decree 330/2026/ND-CP).

What the vendor's DPA usually lacks under Vietnamese law#

Global vendor DPAs are written for the GDPR and are a good base for foreign SaaS in Vietnam. Measured against Decree 356 and our data processing agreement checklist, the same few gaps come up:

1. An express commitment to Vietnamese data protection law. For cloud services, Article 12(2)(a) requires the contract to state that the provider complies with Vietnamese personal data protection law, to give details of its data protection unit or staff, and to cover compliance with the related administrative procedures.
2. A described data flow and allocation of roles. Article 12(2)(b) asks for the flow of personal data, each party's role and the matching responsibilities. A generic "customer is controller" clause does not describe the flow.
3. Immediate notice of changes. Article 12(2)(d) requires immediate notice of any change that may affect the personal data, which is wider than the usual sub-processor change notice.
4. Retention and deletion tied to the transfer purpose, as Article 7(1)(c) and Article 12(2)(dd) require.
5. Encryption at rest and in transit with strict access control (Article 12(4)), and tiered access rights (Article 12(2)(g)).
6. Control of onward transfers. The dossier must describe how the recipient passes data on to third parties (Article 18(3)(g) of Decree 356). Having no mechanism to control onward transfers, so that data is processed outside the scope declared in the dossier, is fined VND 30 to 50 million (Article 56(1)(g) of Decree 330). Map the vendor's sub-processors and the integrations you add yourself, such as email tools, telephony, enrichment and AI add-ons.

Where the vendor will not amend its standard terms, a short Vietnam addendum signed between the subsidiary and the parent can carry most of these points. The vendor-facing items, especially Article 12(2)(a), still need the vendor's acceptance or at least documented confirmation.

One transfer dossier for all foreign SaaS in Vietnam#

The impact assessment is done once for the organisation's whole period of operation and then kept up to date (Article 20(3) of Law 91). It is not done once per vendor. In practice that means one dossier for the subsidiary that covers every in-scope system and recipient:

• the assessment report on Form 09 of Decree 356, covering the parties and their contacts, purposes, data types, a data flow diagram, consent and retention, security after transfer, the recipient's systems, onward transfers, a self-assessment and a risk assessment (Article 18(3));
• copies of the transfer contracts (Article 18(2)(b));
• the company's data protection policies, procedures and forms (Article 18(2)(c)).

The dossier is filed with the cover form (Form 01a or 01b) online, in person or by post within 60 days of starting the transfer (Article 18(4)). The A05 Department returns a result within 15 days. If the dossier is incomplete, the company has 30 days to complete it (Article 18(5) and (6)). The dossier must stay ready for inspection at all times.

Adding a new SaaS tool later does not need a new dossier. Under Article 20(1) of Decree 356 the dossier is updated every 6 months from the first filing when a new transfer purpose arises or when a controller, processor or third party is added or changed. A reorganisation, a dissolution or a change of the data protection service provider must be reported within 10 days (Article 20(2)). Updates use Forms 03a/03b. A subsidiary that filed a dossier under Decree 13/2023 before 1 January 2026 keeps using it and only updates it under the new rules (Article 39(2) of Law 91).

The 5-year option for small enterprises and start-ups in Article 38(2) of Law 91 covers the DPIA (Article 21), dossier updates (Article 22) and the data protection officer (Article 33(2)). It does not mention the Article 20 transfer dossier itself.

Telling customers and employees where their data goes#

The privacy notice must say that the data is transferred abroad, who receives it and for what purpose. Failing to obtain consent to the transfer purpose, or failing to notify data subjects of the transfer, the recipient and the purpose, is fined VND 50 to 100 million (Article 56(2)(b) of Decree 330). A useful privacy notice names the categories of recipients, such as "our parent company in Japan" or "our CRM provider, with servers in Singapore". A boilerplate "we may transfer data internationally" line is not enough.

The legal basis for the processing itself is the usual one. It is consent, given separately for each purpose (Article 9(4)(a) of Law 91), or one of the Article 19 grounds, of which performing an agreement with the data subject (Article 19(1)(d)) fits most customer and employment records. Watch free-text fields. A sales rep who types a customer's health condition into a CRM note, or an HR officer who uploads ID card images, adds sensitive personal data under Article 4(1) of Decree 356. The consent request must then say the data is sensitive (Article 6(4)), and the transfer needs encryption, anonymisation and physical security measures (Article 7(2)).

What an inspector can order over foreign SaaS in Vietnam#

Decree 330 sets the data protection fines at the level of an organisation (Article 7(1)), so the amounts below apply to the subsidiary itself:

• VND 30 to 50 million for not preparing the dossier, filing it late, not updating it, not keeping it ready for inspection, or not controlling onward transfers (Article 56(1)).
• VND 50 to 100 million for no binding transfer contract, no consent or notice, or inadequate security around the transfer (Article 56(2)).
• 1% to 5% of the previous year's revenue in Vietnam where the company transfers without a dossier, or conceals or misstates the data flows, and this leads to the leak or loss of data of 10,000 or more Vietnamese citizens. Where that percentage gives less than VND 3 billion, or the company has no Vietnamese revenue, fixed bands of VND 200 million to 3 billion apply instead (Article 56(3) and (4)). For these violations, cross-border transfers may also be suspended for 6 to 12 months (Article 56(5)(b)).

For a subsidiary that runs on group systems and foreign SaaS in Vietnam, the remedial measures matter more than the fines. For the core failures (no dossier, late dossier, no transfer contract, no consent or notice), the company can be ordered to stop the cross-border transfer until the dossier obligations are complete and confirmed by the A05 Department (Article 56(6)(b)). That would cut the Vietnamese team off from the group CRM or the email tenant. For violations under Article 56(2) and (3), the company can also be ordered to have the recipient delete the data irreversibly and to prove it (Article 56(6)(c)).

A workable setup for an FDI subsidiary#

Most of the work of bringing foreign SaaS in Vietnam into line is internal coordination between IT, HR, legal and the regional privacy team. A sequence that works:

1. Inventory first. List every system holding Vietnamese personal data, the contracting entity, the hosting region, who has admin or support access abroad and which integrations it feeds. The same list later becomes the data flow section of Form 09.
2. Sort by exemption. Separate employee-only storage and HR management flows from customer-facing systems, using the table above.
3. Paper the chain. Sign an intra-group transfer agreement covering the Article 7(1) items and get a Vietnam addendum or confirmation from key vendors on the Article 12(2) cloud points.
4. Update the notices for customers, employees and candidates.
5. File one dossier, then run a 6-monthly update cycle tied to IT's vendor onboarding process.

One point remains open. Decree 356 lists "providing and operating systems or automated software that process personal data on behalf of a controller" as a personal data processing service (Article 21(1)), and the business conditions for such services start with being an organisation established under Vietnamese law (Article 22(1)). The Decree does not say how this applies to a foreign SaaS vendor that serves Vietnamese customers without a local entity. If you buy through a local reseller or implementation partner, check that partner's role and ask about its certificate.

LexData prepares and updates transfer dossiers for foreign-invested companies, including the intra-group agreement and the vendor addenda, through its DPIA and cross-border transfer dossier service. Broader programme work, such as notices, the DPO and internal rules, sits under PDPL compliance consulting. Where the SaaS includes generative AI features, see also our note on Vietnam's AI law.