What is a cross-border data transfer in Vietnam? Conditions and the dossier filed with the A05 Department

What is a cross-border data transfer in Vietnam under Law 91/2025/QH15?

What counts as a cross-border data transfer in Vietnam is a critical question for businesses that operate online or use international technology solutions. Under Article 20 of Law 91/2025/QH15, this is one of the activities most closely supervised by the authorities in order to protect national data sovereignty. Many businesses may already have this obligation without realising it because they use international cloud storage tools.

3 common situations that usually amount to a cross-border data transfer in Vietnam (to be assessed against the actual set-up):

• Renting cloud servers (AWS, Azure, GCP, DigitalOcean) with data centres located outside Vietnam (Point a, Clause 1, Article 20 of Law 91/2025; Point a, Clause 1, Article 17 of Decree 356/2025/ND-CP).
• Using a foreign parent company's HR, accounting or CRM software running on a platform abroad to process data collected in Vietnam (Point c, Clause 1, Article 20). Note the cases where no impact assessment dossier is required, such as an organisation storing its own employees' data on a cloud computing service (Point b, Clause 6, Article 20) or transferring data to manage personnel across borders under labour rules (Point d, Clause 3, Article 17 of Decree 356/2025/ND-CP).
• Integrating payment APIs or advertising APIs (Meta CAPI, Google Tag Manager Server) that send user data to servers abroad (Points b and c, Clause 1, Article 20).

Businesses with cross-border data flows can consider the cross-border personal data transfer impact assessment dossier service. The transfer dossier is reviewed separately from the DPIA dossier; its scope and any exemptions should be determined before implementation.

The three types of cross-border data transfer in Vietnam in Clause 1, Article 20

Article 20 of Law No. 91/2025/QH15 on Personal Data Protection does not use a single definition. It lists three situations, and a business only needs to fall within one of them.

Article 17 of Decree 356/2025/ND-CP adds that Point a also covers storing data collected in Vietnam on a cloud service of a provider located abroad (Point a, Clause 1, Article 17). Point c is the one that most often catches foreign-invested companies. It applies even when no file is "sent" anywhere: if data collected in Vietnam is processed on a platform outside Vietnam, the case is covered. It also applies to organisations located abroad, which matters for regional headquarters that run systems for their Vietnamese subsidiaries.

How this differs from GDPR. GDPR allows transfers on the basis of an adequacy decision, standard contractual clauses or binding corporate rules. Law 91 has no equivalent mechanism. Instead, the transferring party prepares its own impact assessment dossier and files it with the A05 Department (Ministry of Public Security). Signing EU standard contractual clauses does not replace the Vietnamese dossier, although the same contract can serve as supporting evidence in it.

When no transfer impact assessment is required

Clause 6, Article 20 lists the cases where the impact assessment rules do not apply:

1. Cross-border transfers by competent state agencies (Point a).
2. An agency or organisation storing personal data of its own employees on a cloud computing service (Point b).
3. A data subject transferring their own personal data across borders (Point c).
4. Other cases provided for by the Government (Point d). Clause 3, Article 17 of Decree 356/2025/ND-CP lists five:
   • press and media activities as provided by law;
   • cross-border transfers that have been made public as provided by law;
   • emergencies where providing the data abroad is genuinely necessary to protect a person's life, health or property, or to perform duties and obligations under the law;
   • transfers to manage personnel across borders under labour rules, regulations and collective labour agreements;
   • providing data abroad to conclude contracts or complete procedures for cross-border transport, logistics, remittances, payments, hotels, visas or scholarships.

The last exemption matters for travel, logistics and payment businesses, but it only covers the data needed for the specific transaction. Read these exemptions narrowly. The employee cloud exemption covers storing staff data on a cloud service. It does not cover sending customer data to the same cloud, or sharing employee data with a foreign insurer or benefits provider. Other obligations under Law 91, such as a legal basis for processing, security measures and a DPA with the cloud provider, still apply in the exempt cases.

The cross-border data transfer in Vietnam dossier: form, deadline and updates

• Contents (Clause 2, Article 18 of Decree 356): an impact assessment report on Form No. 09 in the appendix to Decree 356/2025/ND-CP (replacing Form No. 06 under the former Decree 13/2023/ND-CP); a copy of the contract or transfer document binding the transferring party and the recipient; and the related data protection policies, procedures and forms. The dossier is sent with a cover notice on Form No. 01a (organisations) or 01b (individuals).
• Deadline: one original copy must be sent to the A05 Department within 60 days from the first day personal data is transferred abroad (Clause 2, Article 20), online, in person or by post. The A05 Department returns a pass or fail result within 15 days; an incomplete dossier must be completed within 30 days (Clauses 4–6, Article 18 of Decree 356).
• Done once: the assessment is carried out once for the whole period of operation of the organisation (Clause 3, Article 20).
• Periodic updates: every 6 months from the first filing when there is a new transfer purpose, or a new or changed controller, processor or third party (Clause 1, Article 22 of the Law; Clause 1, Article 20 of Decree 356).
• Immediate updates: required when the organisation is reorganised, ceases operation, is dissolved or goes bankrupt; when information about the personal data protection service provider changes; or when business lines or services related to processing that were registered in the dossier are added or changed. These updates are due within 10 days (Clause 2, Article 22 of the Law; Clause 2, Article 20 of Decree 356), using Form No. 03a/03b.
• Where: updates are made on the National Personal Data Protection Portal or at the A05 Department (Clause 3, Article 22).
• Dossiers filed under Decree 13/2023: a transfer dossier accepted by the A05 Department before 1 January 2026 remains valid, and no new dossier is needed under Law 91; later updates follow Law 91 (Clause 2, Article 39).

The dossier is prepared by the agency, organisation or individual that carries out the transfer (Clause 2, Article 20). Where a Vietnamese subsidiary uses a platform run by its foreign parent, both entities may fall within Point c, so the group should decide early which entity files and make sure the dossier reflects the real data flows, even if the parent's team prepares much of the technical content.

What the Form No. 09 report must cover

Clause 3, Article 18 of Decree 356/2025/ND-CP requires the impact assessment report to cover:

1. Details and contacts of the transferring party, the recipient, any processor and other parties involved.
2. Contact details of the data protection unit or officer (or service provider) of both the transferring party and the recipient.
3. A description and justification of the purpose, the data types, the transfer and processing activities, with a data flow diagram.
4. How consent is obtained, and the retention, deletion and destruction policy.
5. The plan for keeping the data safe after transfer, and the protective measures and standards applied.
6. A system diagram and a description of the recipient's storage and processing systems.
7. The procedure for the recipient's onward transfers to third parties.
8. The result of the transferring party's own compliance self-assessment.
9. An assessment of the recipient's level of protection, the impact and risks of the transfer, possible harm, and mitigation measures.

The dossier must always be ready for inspection (Clause 4, Article 18). Items 6, 7 and 9 need input from the recipient abroad, so build an obligation to provide it into the contract.

On inspections, the authority may inspect cross-border transfers periodically, but no more than once a year. It may also inspect without notice when it detects a violation or when personal data is leaked or lost (Clause 4, Article 20). It can order a transfer to stop if the data is used for activities that infringe national defence or national security, or if a violation may harm national defence or national security (Clause 5, Article 20 of the Law; Clause 2, Article 17 of Decree 356).

Penalties for getting cross-border data transfer in Vietnam wrong

Article 56 of Decree 330/2026/ND-CP sets the fines for organisations:

• VND 30–50 million for failing to prepare the dossier before or during the transfer, missing the 60-day deadline, not completing it within 30 days of a request, failing to update it or keep it ready for inspection, failing to give the contact details of the recipient's data protection officer, or failing to control onward transfers (Clause 1).
• VND 50–100 million for transferring without a binding contract between the transferring party and the recipient; for failing to ensure consent to the transfer purpose or to inform data subjects that their data goes abroad, to whom and why; for lacking appropriate security measures; for obstructing an inspection; for continuing after a stop order; or for failing to notify the A05 Department and stop the recipient's processing after an incident at the recipient (Clause 2).
• 1% to 5% of the previous year's revenue in Vietnam where a transfer without a dossier, or with concealed or misdeclared data flows, leads to the leak or loss of data of Vietnamese citizens: 1–2% for 10,000 to under 100,000 people, 2–3% for 100,000 to under 1,000,000, and 3–5% for 1,000,000 or more. The 3–5% band also covers continuing transfers after a stop order where this harms national defence or national security (Clause 3); otherwise continuing after a stop order falls under Clause 2. Where the organisation has no revenue in Vietnam or this calculation gives less than VND 3 billion, fixed ranges of VND 200 million to VND 3 billion apply (Clause 4).
• Additional measures: suspension of cross-border transfers for 6 to 12 months, and an order to stop transferring until the dossier is completed and confirmed.

See data protection fines in Vietnam for how these compare with other violations.

Checklist for a cross-border data transfer in Vietnam

1. Map data flows from your record of processing activities: cloud regions, SaaS tools, group systems, SDKs, support desks and vendors with offshore teams.
2. Classify each flow under Point a, b or c of Clause 1, Article 20, and check whether an exemption in Clause 6 applies.
3. Confirm the legal basis for each flow, obtain consent to the transfer abroad where consent is the basis, and tell data subjects where their data goes and why.
4. Sign a transfer agreement or DPA with each recipient before data moves. See controller vs processor to decide which contract you need.
5. Prepare the Form No. 09 dossier and file it within 60 days of the first transfer.
6. Set a 6-month review in your compliance calendar, plus a trigger for immediate updates.
7. Plan for incidents at the recipient's end, so that you can meet the 72-hour breach notification rule.

Regulated sectors carry extra requirements. Banks and insurers in particular should read our guides on data protection in banking and data protection in insurance alongside this entry.