What is a record of processing activities? A business guide to RoPA in Vietnam

What is a record of processing activities? RoPA in Vietnam under compliance governance standards

A record of processing activities (RoPA) is the data inventory document that lets a business keep comprehensive control over all of its internal information flows. One of the biggest challenges businesses face when implementing personal data protection compliance, and the first problem a RoPA in Vietnam should solve, is 'data blindness': management and the legal team do not know how many personal data flows exist in the business, which department collects the data, which server stores it, which partners it is shared with and who has access. Without an accurate inventory and data map, every effort to draft policies or invest in technical security solutions becomes meaningless.

To solve this problem, international governance practice (Article 30 GDPR) and compliance practice in Vietnam have popularised a core tool called the record of processing activities (RoPA). Note: the Personal Data Protection Law No. 91/2025/QH15 does not separately name an obligation called a 'RoPA'; however, a data inventory is the foundation that allows a business to fulfil the accountability obligations that are genuinely mandatory — the impact assessment dossier under Article 21 and the accountability of the controller and processor under Article 37. The RoPA is therefore regarded as a near-mandatory governance practice for both personal data controllers and personal data processors.

1. The strategic role of the RoPA in compliance governance

The RoPA is often likened to the 'data genome map' of the whole organisation. Far from being a passive spreadsheet, the RoPA plays a decisive role in 3 governance respects:

• The foundation of the DPIA dossier (Article 21): Preparing the DPIA dossier submitted to the A05 Department (Ministry of Public Security) is a mandatory obligation; the impact assessment report in the dossier (Form No. 10, Point a, Clause 2, Article 19 of Decree 356/2025/ND-CP) must describe in detail the processing activities, the types of data and the protective measures. If the business does not yet have a complete data inventory, it cannot prepare the DPIA dossier accurately.
• Evidence of the accountability principle: When a data leak occurs or when the A05 Department carries out an unannounced inspection, an up-to-date data inventory is a key document proving that the organisation understands its data flows and actively controls their risks.
• The basis for exercising data subject rights (Article 4): When customers or employees ask to access or delete their personal data, the RoPA helps the IT team and the DPO pinpoint exactly which databases hold the data so it can be deleted within the statutory time limit.

2. Controller RoPA vs processor RoPA

Depending on the legal role under Article 2 of Law 91/2025/QH15, the content of the RoPA is designed from 2 angles:

• Controller RoPA: A comprehensive record of the processing activities whose purposes and means the organisation itself decides (e.g. recruitment, customer care, customer loyalty programmes, office security cameras).
• Processor RoPA: A record of the processing activities the organisation carries out on behalf of its clients under a data processing agreement (DPA) (e.g. an HRM SaaS provider recording each corporate client's HR data flows, or an outsourced customer care call centre).

3. Eight fields a RoPA in Vietnam should contain

With reference to Article 30 GDPR and the content that must be described in the impact assessment dossier under Article 21 of Law 91/2025/QH15, each processing workflow in the RoPA should record the following 8 groups of information:

1. Name and contact details: The business name, legal representative, responsible department and the data protection officer (DPO).
2. Specific purpose of processing: The specific reason the organisation needs to process the data (e.g. payroll and social insurance contributions, e-commerce order delivery).
3. Categories of data subjects: Clearly identify whose data is collected (employees, individual customers, job applicants, partners).
4. List of personal data fields: List each data field in detail, clearly separating basic personal data from sensitive personal data under Articles 3 and 4 of Decree 356/2025/ND-CP.
5. Recipients and third parties: The internal departments that access the data and the external subcontractors (courier companies, cloud services, payment banks).
6. Cross-border data flows: Determine whether the data is transferred outside Vietnam; if so, record the receiving country and the corresponding transfer dossier under Article 20.
7. Expected retention period: How long each category of information is kept and the criteria for setting the period (under accounting law, labour law or by agreement).
8. General description of security measures: The technical and organisational measures applied to protect the data (data encryption, multi-factor authentication, least-privilege access, backups).

4. A 5-step guide to building and running a RoPA in Vietnam for your business

To build a complete RoPA from scratch, a business should follow a standard 5-step process:

Step 1: Set up an internal data privacy taskforce

Appoint a data protection point person (the DPO or the legal team) to lead, working with representatives of the key departments: IT, HR, Marketing, Sales, Accounting and Customer Care.

Step 2: Design and issue a data discovery survey

Send a questionnaire to each department head to gather information: What information does the department collect? From which sources? Is the data stored in personal Excel files or in centralised software? Who is it shared with?

Step 3: Interview business users and draw a data flow map

The taskforce interviews operational staff directly to bring 'data blind spots' (shadow IT) to light, and draws a visual map of the data's journey from the entry point, through internal processing, to the storage points and the points where it is shared externally.

Step 4: Consolidate the information into a master RoPA

Standardise the collected information into a centralised governance register (a highly secured file or specialised data privacy management software). Check that the information in the RoPA is consistent with the DPAs signed and the privacy policy published on the website.

Step 5: Set up a periodic review & audit cycle

The RoPA is a living document; it cannot be prepared once and then left in a drawer. The business should set a review cycle of at least once every 06 months, or update it immediately whenever the business launches a new product, deploys new IT software, changes cloud service provider or undergoes a merger.

5. Indirect legal risks of having no data inventory under Decree 330/2026/ND-CP

Decree 330/2026/ND-CP currently has no separate penalty provision for 'failing to keep a RoPA'. However, lacking a data inventory prevents a business from fulfilling its statutory obligations, and it will be penalised through the violations that directly result:

• Failing to prepare, submit or update the impact assessment dossier (DPIA) because accurate input data is missing: Article 55 — a fine of VND 20–30 million for organisations; deliberately falsifying figures or providing misleading information in the dossier: VND 50–100 million.
• Being unable to prove the data subject's consent, or processing without valid consent: Article 43 — a fine of VND 30–50 million (Points a and g, Clause 1).
• Delaying or failing to respond to requests to access, correct or delete data because the data cannot be located: the group of provisions on exercising data subject rights (Articles 44–46), with a range of around VND 10–50 million depending on the violation.
• Being caught unprepared in an unannounced inspection or audit: being unable to present an overall picture of data flows increases the risk of being found in breach of the data protection principles (Article 39, range of VND 20–60 million).

For the full penalty framework, see the handbook entry Penalties for personal data protection violations; for the process of preparing the impact assessment dossier, see the handbook entry The DPIA dossier.

A record of processing activities is only useful if it is kept up to date with real-world changes. Businesses that need a point person for periodic monitoring can consider an outsourced DPO service to help maintain compliance records, with the review schedule and scope of work set out in the agreement.