Every company in Vietnam that processes personal data must either designate a qualified data protection officer or department, or hire an outside individual or organisation to do the job (Article 33(2) of the Law on Personal Data Protection 91/2025/QH15). For a foreign-invested subsidiary the realistic choices are three: an in-house DPO appointed by the Vietnamese entity, an outsourced DPO in Vietnam hired under a service contract, or a mix of the two. A fourth option that many groups want, simply naming the regional DPO who already covers Asia, is the one the texts do not clearly accommodate.
This guide compares the routes as Decree 356/2025/ND-CP sets them out, explains how a regional DPO can lawfully serve a Vietnamese subsidiary, and shows what each choice means for dossiers and fines. For the basic concept, see what a DPO is under Vietnamese law. It reflects the texts in force on 13 October 2026.
Does a subsidiary need an in-house or outsourced DPO in Vietnam at all?#
Article 33(2) of Law 91/2025 is addressed to every agency and organisation. Unlike Article 37 of the GDPR, it has no trigger based on core activities, large-scale monitoring or sensitive data: the default is that a data protection officer, department or provider is needed. Two reliefs exist (Article 38(2) and (3) of the Law; Article 41 of Decree 356):
- Household businesses and micro enterprises do not have to apply Article 33(2) at all, with no time limit.
- Small enterprises and start-ups may choose not to apply it for 5 years from 1 January 2026.
Neither relief applies to a business that provides personal data processing services, directly processes sensitive personal data, or processes the data of 100,000 or more data subjects, counted cumulatively from the point that scale is reached (Article 41(1) and (2) of Decree 356). Medium and large enterprises get no relief.
For a foreign-invested company, two points decide whether the relief is real:
- Size is measured on the Vietnamese company alone. Law 91 and Decree 356 do not define "small" or "micro", so the general SME criteria apply: Article 4 of the Law on Support for SMEs 04/2017/QH14 and Article 5 of Decree 80/2021/ND-CP. A small enterprise in trade or services has up to 50 employees on social insurance and revenue of up to VND 100 billion or total capital of up to VND 50 billion; in industry or construction, up to 100 employees and VND 50 billion revenue or VND 20 billion capital. The figures are the company's own prior-year figures, self-declared, and nothing in these texts adds in the parent or affiliates (unlike the EU "linked enterprise" test). A draft Law on SME Development before the National Assembly would raise the thresholds, so recheck before relying on them.
- In our reading, almost every employer "directly processes sensitive personal data". "Directly" is not defined, processing includes collection (Article 2(6) of Law 91), and both health information and images of citizen ID cards are sensitive (Article 4(1)(d) and (i) of Decree 356). A company that collects health check results or keeps ID card copies in HR files therefore falls within the exception on a literal reading. No guidance from the A05 Department softens this, so do not build the DPO decision on the relief.
In-house, individual or outsourced DPO in Vietnam: the conditions side by side#
Decree 356 sets different conditions for each route:
| In-house DPO or department | Individual hired as a provider | Organisation hired as a provider | |
|---|---|---|---|
| Education | College degree or higher | College degree or higher | At least 3 staff who meet the individual provider conditions |
| Experience after graduation | At least 2 years in legal, IT, cybersecurity, data security, risk management, compliance, HR or personnel work | At least 3 years in legal, personal data processing, cybersecurity, data security, risk management or compliance | Has provided security, cybersecurity, IT, standards assessment or data protection advisory services |
| Training | Trained in data protection law and skills | In-depth data protection training | Through its staff |
| Paperwork | Written appointment setting out duties and powers; confidentiality agreement | Contract for the use of a data protection officer; details published to data subjects | Review of its capability profile; service contract and a data processing agreement; details published |
| Basis (Decree 356) | Article 13 | Article 15 | Article 16 |
Three details are easy to miss. An in-house appointment is the company's own assessment: it chooses the person and is responsible for that choice (Article 13(4)), and it must train the person itself (Article 13(6)). The confidentiality agreement with an in-house DPO may set out when the officer is exempt from liability for breaches or damage (Article 13(5)), which is worth using to define the role. And an organisation hired as a provider must be a business whose functions or registered lines cover technology, legal work or advice on them (Article 16(1)(a)); a generic shared-services company may not qualify.
A company may combine routes, for example an internal officer supported by an outsourced DPO in Vietnam who reviews dossiers and handles incidents (Article 16(4)). The full list of tasks the function must cover, from policies and data subject requests to DPIA and transfer dossiers and breach reporting, is in Article 14; under an outsourcing contract the provider carries out those tasks to the extent agreed (Article 16(5)).
The regional DPO question#
Group privacy programmes usually have a regional DPO in Singapore, Hong Kong or Tokyo who signs off on every entity in the region. The GDPR accommodates this: a group may appoint a single DPO if that person is easily accessible from each establishment (Article 37(2) GDPR). Decree 356 has no equivalent provision, but in our reading a regional DPO can still serve a Vietnamese subsidiary through one of two routes. Neither Article 13 nor Article 15 imposes a nationality or residence condition.
- Make the regional DPO the subsidiary's own officer under Article 13. Law 91 speaks of data protection staff "in" the organisation (Article 33(1)(b)), so the person must become part of the Vietnamese company, for example through a secondment or a concurrent appointment. The company issues a formal written appointment setting out duties and powers (Article 13(1)), signs a confidentiality agreement with the person (Article 13(5)) and checks the degree, 2 years' experience and training conditions (Article 13(2)).
- Contract with the regional DPO as an individual provider under Article 15. The subsidiary itself signs a contract for the use of a data protection officer with the person, checks the stricter conditions (3 years' experience, in-depth training) and publishes the officer's details to data subjects (Article 15(2) and (3)).
What usually does not work is naming the parent company as an organisation provider under Article 16: that requires registered technology or legal business lines, at least 3 staff who meet the Article 15 conditions and a track record of providing these services, which a holding company rarely has.
Whichever route is used, keep a Vietnamese-speaking contact in the country. The regional DPO keeps oversight; the local contact can answer the A05 Department and meet the 72-hour breach timetable. The dossier forms annexed to Decree 356 are Vietnamese forms, and the contact details of the data protection function go into the DPIA report (Article 19(3)(b)), the cross-border transfer report (Article 18(3)(b)) and every breach notice (Article 28(1)(b)).
Independence and conflict of interest#
Vietnamese law does not prohibit giving the DPO role to someone who also runs IT, marketing or HR, and it has no counterpart to the GDPR's rules that a DPO must not receive instructions on the performance of tasks or be dismissed for performing them (Article 38(3) and (6) GDPR). That leaves the design to the company.
In practice the conflict of interest is real. A head of IT who owns the systems, or a marketing director who owns the customer database, is asked to assess risks in their own processes and to report breaches that reflect on their own team. Groups that already require an independent DPO under their global policy should apply the same standard in Vietnam. Where a subsidiary is too small for a full-time independent officer, the combined route helps: an in-house DPO handles daily requests while an outside provider runs the periodic compliance assessment the function must carry out (Article 14(1)(c)).
What an outsourced DPO in Vietnam does, and what stays with the company#
An outsourced DPO in Vietnam can take on most of the Article 14 tasks: drafting policies and forms, organising data subject requests, preparing the DPIA and cross-border transfer dossiers, receiving and reporting breaches, planning training and proposing security measures. What it cannot take over is the company's own accountability. In particular:
- Someone inside still has to feed the provider. An external officer does not know when HR adds a new system or sales starts a new campaign. Name an internal contact who must tell the provider about new processing.
- The contract must be in place before the work starts. For an organisation provider, Decree 356 requires both a service contract and a data processing agreement (Article 16(3)). Decree 330 fines the provider VND 30 to 50 million for providing the service without them (Article 58(2)(c)).
- The provider's details must be made public to data subjects and other parties (Article 15(3) and 16(3)). Decree 356 puts this on the company that hires; Decree 330 fines the provider organisation if it is not done (Article 58(2)(d)). Do it on the privacy notice and keep a record.
- The provider's duties are limited to the contract. It must stay within the agreed scope, must not use the engagement to break the law, and must delete or destroy personal data processed during the service when the contract ends (Article 15(4) and 16(6)). Write those duties, with a handover procedure, into the contract.
Before signing, ask for the provider's capability profile. Article 16(2) requires it to show the business lines, scale and experience, service policy, staff qualifications and supporting documents. For individual DPOs within the provider, check degrees, years of relevant experience after graduation and evidence of in-depth data protection training. LexData provides an outsourced DPO service on this basis.
Changing the officer or the provider: dossier updates#
The choice of model affects how often the A05 Department has to be told about changes.
- Changing provider. A change in information about the organisation or individual providing data protection services is one of the events that require an immediate update to the DPIA dossier and the cross-border transfer dossier (Article 22(2)(b) of the Law), within 10 days (Article 20(2)(b) of Decree 356).
- Changing an in-house officer. This is not on the 10-day list. The contact details are still part of the dossiers, and the Law requires a dossier to be updated whenever its content changes (Article 21(5)), with the 6-monthly cycle in Article 22(1) of the Law and Article 20(1) of Decree 356 as the routine channel. Do not leave a departed officer as the named contact.
A provider that loses its eligibility, for example because it no longer has 3 qualified staff, can be ordered to notify its clients so that they can arrange a replacement (Article 58(5)(c) of Decree 330). Build a substitution clause into the contract rather than relying on that notice.
Fines on each side of the model#
Fines for personal data violations in Section 6 of Decree 330/2026/ND-CP are stated for organisations; an individual committing the same violation pays half (Article 7(1)).
| Who | Violation | Fine (VND) | Decree 330 |
|---|---|---|---|
| Company with an in-house DPO | No confidentiality agreement; no training for the officer; appointment document that does not set out functions, duties and powers | Warning or 10 to 20 million | Article 57(1) |
| Company with an in-house DPO | Appointing a person without the degree or the 2 years' experience; appointing an untrained person; no appointment document or decision at all | 20 to 30 million, plus an order to replace the person | Article 57(2) and (3)(a) |
| Individual provider | Lacking the degree, the 3 years' experience or the in-depth training while providing the service; exceeding the contract; not deleting data after the contract | 10 to 30 million | Article 58(1) |
| Organisation provider | No or incomplete capability profile; fewer than 3 qualified staff; no contract and processing agreement; details not published | 30 to 50 million; suspension of 6 to 12 months for the first two | Article 58(2) and (4)(b) |
Article 58(1) is worded for individual providers while Article 7(1) halves Section 6 amounts for individuals, so the amount actually imposed on an individual DPO may be lower than the figure listed. For the company, the bigger risk with an outsourced DPO in Vietnam is not a provider fine but a gap: if the provider is suspended or drops out, the company is left without the function that Article 33(2) requires and with dossiers naming a contact that no longer exists.
Outsourced DPO in Vietnam or in-house: four typical subsidiaries#
A small sales subsidiary with a handful of staff and a CRM. If it qualifies as a small enterprise on its own figures and genuinely holds no sensitive data (no health files, no ID card copies), it may opt out of Article 33(2) until the end of 2030. It should still name someone to receive requests and incidents, because breach notification and data subject rights are not covered by the relief.
A manufacturing subsidiary with a large workforce. Employee health, insurance and biometric attendance data make the relief unlikely to apply. A combined model works well: an in-house DPO, often in HR or legal with the 2 years' experience and training, and an outsourced DPO in Vietnam for the dossiers, the periodic assessment and incident response. Our DPO training covers the training condition for the internal officer.
A consumer-facing business with 100,000 or more customers. The relief is lost once that scale is reached. The function needs enough capacity to handle requests on the deadlines in Decree 356 and to stand behind the DPIA; see the Decree 356/2025 changes for foreign-invested companies.
A regional hub whose group DPO sits abroad. Appoint the regional DPO under Article 13 as the subsidiary's own officer, or contract with them under Article 15, and add a local contact in Vietnam, as explained above.
Whichever model you choose, decide it before the first DPIA or cross-border transfer dossier is filed, because those dossiers name the data protection function and must be updated when it changes.
