What is a DPIA in Vietnam? When must a DPIA report be prepared under Law 91/2025?
A DPIA in Vietnam (personal data processing impact assessment) is the analysis and assessment of risks that may arise in processing personal data, so that measures can be applied to mitigate them and protect personal data (Clause 12, Article 2 of Law 91/2025/QH15). The dossier is prepared from the start of processing and submitted within 60 days.
Personal Data Protection Law No. 91/2025/QH15 & Decree 356/2025/ND-CP
Official legal texts
Key takeaways for businesses
- The DPIA dossier must be prepared in writing and 01 original sent to the A05 Department (Ministry of Public Security) within 60 days from the first day of processing personal data (Clause 1, Article 21 of Law 91/2025).
- The DPIA is a general obligation of controllers and controller-processors (Clause 1, Article 21 of Law 91/2025), regardless of the type of data; a processor prepares one as agreed (Clause 3, Article 21). The dossier is prepared using Form No. 10 and submitted with Form 02a/02b (Article 19 of Decree 356). Small businesses and startups may choose not to comply for 05 years from 01/01/2026, and household businesses and micro-enterprises are not required to comply (Clauses 2 and 3, Article 38 of Law 91/2025; Article 41 of Decree 356), except those providing personal data processing services, directly processing sensitive data or processing the data of 100,000 or more data subjects.
- The DPIA dossier must always be available for inspection by the specialised authority (Clause 4, Article 19 of Decree 356) and be maintained at the business's head office (Point a, Clause 1, Article 55 of Decree 330/2026).
What is a DPIA in Vietnam? When must a DPIA report be prepared?
What a DPIA is and when it must be prepared is a central question for any personal data protection compliance file. Under Article 21 of Law 91/2025/QH15 and Decree 356/2025/ND-CP, the DPIA (personal data processing impact assessment) is one of the most important legal dossiers, and it must always be available for inspection by the specialised personal data protection authority (Clause 4, Article 19 of Decree 356/2025/ND-CP).
When must a DPIA in Vietnam be prepared? Mandatory cases under the law
The DPIA is a mandatory obligation for every organisation acting as a controller or controller-processor from the first day it carries out processing activities, except competent state agencies (Clause 6, Article 21) and those that may choose not to comply, or are not required to comply, under Clauses 2 and 3, Article 38 of Law 91/2025/QH15. A processor prepares and keeps a dossier as agreed with the controller (Clause 3, Article 21).
Core structure of a DPIA dossier:
The dossier comprises the impact assessment report on Form No. 10, a copy of the data processing contract/agreement, and the related policies, procedures and forms (Clause 2, Article 19 of Decree 356/2025/ND-CP). The report must contain (Clause 3, Article 19):
- Information and contact details of the parties and of the personal data protection unit/officer or service provider.
- A description and justification of the purposes of processing, the types of data, the processing activities in detail and a data flow diagram.
- A description and justification of how consent is obtained, and the policy on retaining, deleting and destroying data.
- The results of the compliance assessment; an assessment of the impact, risks and possible consequences, and the measures to mitigate or eliminate the risks.
- The data security plan, the protective measures, the system design diagram and the data protection standards applied.
When the results of a review need to be turned into a concrete dossier, businesses can consider the personal data processing impact assessment (DPIA) dossier service. The support covers identifying the obligations, preparing the dossier and coordinating submission where applicable.
Frequently asked questions
Will a business be penalised for not submitting a DPIA dossier?
It may face an administrative penalty under Article 55 of Decree 330/2026/ND-CP if it fails to prepare, keep or submit the DPIA dossier as required. Additional measures depend on the violation and the applicable provision; they are not an automatic consequence in every case.
Can a DPIA dossier prepared once be used forever?
No. The dossier must be updated and supplemented when the content already submitted changes (Clause 5, Article 21 and Article 22 of Law 91/2025): every 06 months from the first submission where a new processing purpose arises or the parties involved in processing change; within 10 days of a reorganisation, cessation of operations, dissolution or bankruptcy, a change of personal data protection service provider, or a change in the related business lines. Updates use Form No. 03a/03b and are submitted online, in person or by post to the A05 Department (Article 20 of Decree 356).
The Vietnamese original of this entry has been reviewed for legal accuracy against the Personal Data Protection Law No. 91/2025/QH15 and current implementing legislation. This English edition is an unofficial translation for reference; the official legal texts are in Vietnamese.
Meet the LexData teamGo further with LexData
Personal Data Processing Impact Assessment (DPIA) Dossier Preparation
Work with our lawyers on the filings and documents, end to end.
Learn about the service