What is a DPO? Must a business appoint a DPO in Vietnam?
A DPO in Vietnam (personal data protection unit/officer) is a dedicated role responsible for monitoring compliance with data protection law, advising management, developing internal rules and acting as the point of contact with the specialised personal data protection authority (the A05 Department, Ministry of Public Security).
Personal Data Protection Law No. 91/2025/QH15 & Decree 356/2025/ND-CP
Official legal texts
Key takeaways for businesses
- Agencies and organisations must designate a qualified personal data protection unit/officer or hire a personal data protection service (Clause 2, Article 33 of Law 91/2025); small businesses and startups may choose not to comply with this obligation for 05 years from 01/01/2026, and household businesses and micro-enterprises are not required to comply (Clauses 2 and 3, Article 38 of Law 91/2025; Article 41 of Decree 356), except in 3 cases: businesses providing personal data processing services, directly processing sensitive data, and processing the data of 100,000 or more data subjects.
- An organisation may assign its own staff or a data protection unit, or use a personal data protection service provider that meets the legal requirements.
- There is no separate procedure for notifying the DPO's contact details to the authority; the contact details are recorded in the impact assessment dossier submitted to the specialised authority. Where an outside individual or organisation is hired as the data protection service, information about them must be made public to data subjects and related parties (Clause 3, Articles 15 and 16 of Decree 356/2025/ND-CP).
What is a DPO in Vietnam? Must a business appoint one?
What a DPO is and whether one is mandatory is a common question for management when preparing resources for data protection compliance. Under Clause 2, Article 33 of Law 91/2025/QH15 and its implementing decree, an organisation needs to assign a data protection unit or officer (data protection officer - DPO) as required. Professional independence and access to management are governance practices worth considering, unless the organisational model or a contract specifically provides for them.
Is a DPO mandatory? Which businesses must appoint a DPO in Vietnam in 2026?
Typical businesses that usually cannot opt out of the DPO obligation (providing personal data processing services, directly processing sensitive data or processing the data of 100,000 or more data subjects):
- Financial institutions, banks, payment intermediaries, fintech and insurance.
- Hospitals, clinics and digital health (MedTech) apps processing health records.
- Telecommunications companies, internet service providers (ISPs) and social media platforms.
- E-commerce platforms, ride-hailing apps and logistics businesses processing user data at scale.
- Educational institutions, schools and EdTech platforms processing data at scale.
When choosing who will be responsible for data, businesses can consider an outsourced DPO service for ongoing monitoring support. If they are building an in-house team, personal data protection officer (DPO) training helps develop role-specific knowledge and skills; designating the officer still needs to be checked against the applicable legal conditions.
Comparison of in-house DPO vs outsourced DPO (DPO-as-a-Service)
| Criterion | In-house DPO | Outsourced DPO |
|---|---|---|
| Staffing cost | High (base salary, insurance, continuous training) | Flexible, cost-optimised by service package |
| Industry knowledge | Very deep knowledge of the business internally | Practical cross-industry experience, quick to track legal updates |
| Professional independence | Needs a mechanism to manage conflicts of interest | Can increase objectivity under the governance arrangement |
| Continuity & liaison with authorities | Depends on staff turnover | SLA and support as the liaison point within the authorised scope |
Frequently asked questions
Do small and medium-sized enterprises (SMEs) have to hire a DPO?
The obligation to assign a data protection unit or officer applies under Law 91/2025. Small businesses and startups may choose not to comply with this obligation (together with the DPIA obligations in Articles 21 and 22) for 05 years from 01/01/2026 under Clause 2, Article 38 of Law 91/2025 and Article 41 of Decree 356; household businesses and micro-enterprises are not required to comply (Clause 3, Article 38), except in three cases; medium-sized businesses do not qualify for this relief.
Can an IT employee also act as the DPO?
Yes, if the conditions are met and the organisation assigns the role. The organisation should assess conflicts of interest, professional competence and reporting lines; this is an important governance practice, and the degree of independence required of every DPO should not be treated as absolute.
The Vietnamese original of this entry has been reviewed for legal accuracy against the Personal Data Protection Law No. 91/2025/QH15 and current implementing legislation. This English edition is an unofficial translation for reference; the official legal texts are in Vietnamese.
Meet the LexData teamGo further with LexData
Outsourced DPO Services
Work with our lawyers on the filings and documents, end to end.
Learn about the service