Personal data processing services in Vietnam: the 9 licensed service types and business conditions under Decree 356

What are personal data processing services in Vietnam?

The Personal Data Protection Law No. 91/2025/QH15 (PDPL) does not define "personal data processing services" in Article 2. Clause 3 of Article 33 leaves this to the Government. Article 21 of Decree 356/2025/ND-CP then lists nine types of personal data processing services, and Articles 22 to 27 set the conditions and the procedures to issue, reissue, amend and revoke the certificate of eligibility for this business.

Two concepts need to be kept apart. A personal data processor is a role in a specific processing activity: an organisation that processes data on a controller's instructions under a contract (Clause 8, Article 2 of the PDPL). A personal data processing service is a line of business listed in Article 21. A company can act as a processor without offering one of the nine listed services. Conversely, a licensed provider must still meet all the duties of a processor or of a controller-processor (Clause 1, Article 23 of Decree 356). For the roles, see controller vs processor.

For readers used to the GDPR: the EU has no licensing regime for processors. In Vietnam, some processing activities are now a regulated business that needs a certificate before the first contract is signed.

The 9 types of personal data processing services under Article 21

The examples are LexData's own assessment, not an official list. Clauses 1 and 6 are broad, so many software and data vendors that serve Vietnamese businesses may need a certificate. The decree does not yet explain where selling software ends and running a processing service begins, so each business model needs its own analysis.

Conditions for providing personal data processing services in Vietnam

Article 22 of Decree 356/2025/ND-CP sets four groups of conditions:

1. Legal status: an organisation or enterprise established and operating under Vietnamese law.
2. Staff: the head of data processing is a Vietnamese citizen who resides permanently in Vietnam; the management team meets the professional requirements; and there are at least three staff who meet the competence conditions in Clause 2, Article 13 of Decree 356.
3. Infrastructure: facilities, equipment and technology suited to the service.
4. Impact assessment: an approved data protection impact assessment (DPIA) dossier, plus a cross-border transfer impact assessment if data is transferred abroad.

Under Clause 2, Article 13 of Decree 356, a qualified staff member needs at least a college degree, at least two years of experience in legal affairs, IT, cybersecurity, data security, risk management, compliance, HR or personnel management, and training in personal data protection. For more on this role, see what is a DPO.

Note: two decrees use two different experience thresholds.

Point b, Clause 3, Article 59 of Decree 330/2026/ND-CP fines a licensed provider whose data protection staff do "not have at least 03 years of experience", while Clause 2, Article 13 of Decree 356/2025/ND-CP requires two years. LexData has checked both official texts. Until the authorities clarify this, providers of personal data processing services in Vietnam should staff the role with people who have at least three years of experience, to reduce the risk at an inspection.

Applying for a certificate for personal data processing services in Vietnam

The Ministry of Public Security issues, reissues, amends and revokes the certificate, and has assigned this to the A05 Department, Ministry of Public Security (Article 24 of Decree 356). Under Clause 1, Article 25, the application includes:

• An application form (Form No. 04 in the Appendix to Decree 356);
• A copy of the enterprise registration certificate (not needed if the authority can retrieve it from a database);
• The document appointing the data protection unit, or a contract with a data protection service provider;
• A business proposal for the certificate;
• Degrees and other evidence of the staff members' competence.

The business proposal must cover ten items (Clause 2, Article 25). The most important are the business plan, the expected scale of processing, the risk management framework, the plan for annual compliance and trust assessments, the data security standards applied and the plan for electronic identification and authentication.

The application can be filed online, in person or by post. The authority reviews it within 10 days; if it is incomplete, the applicant supplements it within 15 days. Within 30 days of receiving a complete and valid application, the authority issues the certificate or refuses it in writing with reasons (Clauses 3 and 4, Article 25). Reissue of a lost or damaged paper certificate, and amendment after a change of details, take 5 working days (Article 26).

Practical note (updated 25 September 2026): applications are not yet being accepted.

The certificate procedure for personal data processing services in Vietnam is set out in Articles 24 and 25 of Decree 356/2025/ND-CP and is listed as an administrative procedure in Decision 778/QD-BCA-A05, but as LexData has observed, the Ministry of Public Security had not yet started accepting applications in practice as of 25 September 2026. In the meantime, providers should prepare their staff, impact assessment and business proposal, keep evidence of that preparation, and follow announcements from the A05 Department on the National Personal Data Protection Portal. There is no guidance yet on how the fine for operating without a certificate applies while the procedure is not in operation. LexData will update this page once the Ministry starts accepting applications.

Duties after licensing and grounds for revocation

Article 23 of Decree 356 requires a licensed provider to build a risk management framework, assess its compliance and trust level once a year, apply data security standards, authenticate its organisational identity under the e-identification rules and limit collection, transfer and storage to the stated purpose. When it acts as a processor, it must ask the controller to obtain the data subjects' consent before the service starts, so that data subjects know the data types, the purpose and the service provider (Clause 7, Article 23). The contract between the two should follow a data processing agreement.

The certificate is revoked if the provider no longer meets the conditions, has not operated the service for 12 months or more, is dissolved or bankrupt, fails to remedy a violation when required, or asks to stop operating (Clause 1, Article 27). The revocation is published on the National Personal Data Protection Portal, and the provider must return the certificate within 5 working days.

Fines for personal data processing services without a certificate

Article 59 of Decree 330/2026/ND-CP sets these fines for organisations (individuals pay half):

• VND 20 to 30 million: no risk management framework, no internal responsibility rules, no data security standards, or no organisational identity authentication (Clause 1).
• VND 30 to 50 million: not asking the controller to obtain consent, processing for another purpose, or no annual trust assessment (Clause 2).
• VND 50 to 80 million: providing personal data processing services without a certificate; staff who do not meet the conditions; fewer than three qualified staff (Clause 3).
• VND 80 to 100 million: continuing the business after the certificate has been revoked (Clause 4).

Remedial measures include deleting all personal data collected or processed unlawfully and handing over the revenue earned from operating without a certificate. For a service business, the revenue to be handed over is often far larger than the fine. For other penalties, see PDPL penalties.

Do small business exemptions cover personal data processing services in Vietnam?

No. Clauses 2 and 3 of Article 38 of the PDPL let small businesses and start-ups opt out of Article 21 (DPIA), Article 22 (updating impact assessment dossiers) and Clause 2 of Article 33 (appointing data protection staff) for five years, and exempt household businesses and micro-enterprises from these provisions. Both clauses exclude businesses that provide personal data processing services (Article 41 of Decree 356 repeats this). A data analytics start-up with only a handful of staff still needs a DPIA and qualified data protection staff from day one.

Checklist before providing personal data processing services in Vietnam

1. Map the business model against the nine clauses of Article 21 of Decree 356 and keep a record of the analysis.
2. Identify the company's role for each client: processor or controller-processor.
3. Hire or appoint at least three qualified staff, with a head of data processing who is a Vietnamese citizen residing permanently in Vietnam.
4. Prepare the DPIA dossier, and a cross-border transfer dossier if any infrastructure is outside Vietnam.
5. Build the risk management framework, internal responsibility rules and the annual trust assessment plan.
6. Draft the ten-item business proposal and file the application as soon as the Ministry of Public Security starts accepting it; until then, keep evidence that the conditions have been met.
7. Update the DPA template so that clients must obtain data subjects' consent as required by Clause 7, Article 23.