Personal data protection in SaaS: software vendors, apps and cloud platforms

1. Who must comply with data protection in SaaS in Vietnam?

Data protection in SaaS applies to every business that provides software or apps where users' personal data sits on infrastructure the business runs:

• B2B SaaS: CRM, HR and payroll, accounting, contact centres, clinic and school management.
• B2C apps: learning, health, personal finance, booking and community apps with user accounts.
• API platforms: email, SMS and OTP delivery, identity verification, file storage, AI model APIs.
• Software outsourcing: whenever the vendor runs or supports systems holding real customer data.

The PDPL applies to foreign organisations that directly take part in or are involved in processing personal data of Vietnamese citizens (Point c, Clause 2, Article 1 of Law 91/2025/QH15). A SaaS vendor headquartered in Singapore and selling to Vietnamese companies is in scope.

What sets data protection in SaaS apart is concentration: one tenant-isolation bug can expose many customers at once.

2. Is a SaaS vendor a data processor or a controller?

Both, depending on the data flow. Clauses 7, 8 and 9, Article 2 of the PDPL define the controller (decides the purposes and means), the data processor (processes on the controller's request under a contract) and the controller-processor (decides and also processes directly).

As a data processor, the vendor may receive data only once a contract is in place, must process it only under that contract, apply full protection measures, answer to the controller for damage, and prevent unlawful collection from its systems (Points a to dd, Clause 2, Article 37 of Law 91/2025/QH15). For data it controls, it carries both sets of duties (Clause 3, Article 37). In practice, the privacy policy on the vendor's website covers only its own data; customer data is governed by the contract. See controller vs processor.

3. What must a data processing agreement cover for data protection in SaaS?

Click-through terms of service are rarely enough. A transfer from controller to processor needs an agreement covering the seven items in Clause 1, Article 7 of Decree 356/2025/ND-CP: purpose; data subjects and data types; processing period and deletion; legal basis; protection duties; responsibility for data subject rights; and cooperation when a breach is found.

Because SaaS runs in the cloud, the contract should also meet Clause 2, Article 12 of Decree 356, including the data flow, each party's role, security requirements and notice of changes affecting personal data.

The data processing agreement is also a mandatory part of the DPIA and cross-border dossiers (Point b, Clause 2, Articles 19 and 18 of Decree 356). An agreement that omits protection duties, data subject rights or breach cooperation is fined VND 20–30 million (Clause 1, Article 52 of Decree 330/2026/ND-CP). See the handbook entry on the data processing agreement.

4. Is a SaaS vendor doing business in personal data processing services?

This is the most important question in data protection in SaaS: it decides licensing, staffing and the small-business option.

The PDPL leaves the definition of personal data processing services to the Government (Clause 3, Article 33). Article 21 of Decree 356 lists nine types. Closest to SaaS are: providing and operating systems or automated software that process personal data on behalf of a controller (Clause 1); collecting and processing personal data online through websites and apps (Clause 3); analysing personal data to predict user behaviour (Clause 6); and automated processing based on big data or AI (Clause 8).

In LexData's reading, the test is whether the business operates a processing system on behalf of customers as a commercial activity. A vendor hosting customer data on infrastructure it manages usually does; software the customer installs and runs itself, with no vendor access to the data, usually does not. Hybrid models have no official guidance yet, so record your reasoning and consult the A05 Department when unsure.

Conditions (Article 22 of Decree 356): an organisation established under Vietnamese law; a head of personal data processing who is a Vietnamese citizen residing in Vietnam; at least three qualified staff; suitable infrastructure; and an approved DPIA dossier, plus a cross-border dossier if data leaves Vietnam. The Ministry of Public Security issues the certificate (Article 24). Certified vendors must keep a risk management framework, run an annual compliance and trust assessment, and, as processors, require the controller to obtain data subjects' consent before the service starts (Clauses 2, 3 and 7, Article 23).

Fines (Article 59 of Decree 330/2026): VND 50–80 million for operating without a certificate (Point a, Clause 3); VND 80–100 million for continuing after it is revoked (Clause 4).

Practical note: as LexData has observed, the Ministry of Public Security had not yet started accepting certificate applications in practice as of 25 September 2026. Prepare the conditions, keep evidence and follow announcements; see personal data processing services for details.

5. Can a SaaS start-up use the five-year DPIA and DPO option?

The small-business option is the most misread rule in data protection in SaaS. Clause 2, Article 38 of Law 91/2025/QH15 lets small enterprises and start-ups choose not to apply Article 21 (DPIA), Article 22 (dossier updates) and Clause 2, Article 33 (data protection staff) for five years from 1 January 2026, except those that:

1. Do business in personal data processing services. A SaaS vendor within Article 21 of Decree 356 is excluded at once, even with a handful of customers.
2. Directly process sensitive data. Clause 1, Article 4 of Decree 356 lists bank card details (Point k) and data tracking behaviour and use of online services (Point l) as sensitive. A B2C app with behavioural tracking may already be caught by Point l.
3. Process data of a large number of data subjects: 100,000 or more, counted cumulatively (Clause 1, Article 41 of Decree 356). For B2B SaaS, the customers' end users count too, so the threshold comes quickly.

The option covers only those three provisions; everything else remains mandatory. See what is a DPIA and what is a DPO.

6. Cloud hosting and data stored abroad

Cloud-specific rules. Article 30 of the PDPL requires suitable authentication, identification and access control for personal data in the cloud (Clause 3). Article 12 of Decree 356 requires encryption at rest and in transit (Clause 4), and requires cloud service providers to bind their subcontractors to data protection duties and to run an annual compliance assessment (Clause 3). The Decree does not define a cloud service provider; since SaaS is usually classed as a cloud service model, LexData recommends vendors apply Clause 3 to themselves. Failing to encrypt or to enforce strict access control is fined VND 50–70 million; failing to bind subcontractors, VND 20–50 million (Clauses 2 and 1, Article 69 of Decree 330).

Regions abroad. Point a, Clause 1, Article 17 of Decree 356 treats storing data collected in Vietnam with a cloud provider abroad as a cross-border transfer, for controllers and processors alike. Check the cloud hosting region, backups, sub-processors (email, SMS, AI APIs) and engineers abroad with production access. The dossier goes to the A05 Department within 60 days (Clause 2, Article 20 of the PDPL) and must describe onward transfers to third parties (Point g, Clause 3, Article 18 of Decree 356). See cross-border data transfer.

No exemption for customer data. Clause 6, Article 20 of the PDPL exempts only state agencies, an organisation storing its own employees' data in the cloud, and data subjects moving their own data; Clause 3, Article 17 of Decree 356 adds cases such as journalism and emergencies. Customer data hosted abroad fits none.

Fines (Article 56 of Decree 330): VND 30–50 million for not preparing or filing the dossier (Clause 1); VND 50–100 million for no binding contract with the recipient or no security measures (Clause 2); 1–5% of revenue in the Vietnamese market in the previous financial year where the breach leads to leaks affecting 10,000 or more data subjects (Clause 3).

7. Data localisation: does data protection in SaaS include storing data in Vietnam?

From 1 July 2026, the Law on Cybersecurity No. 116/2025/QH15 is in force and the 2018 Law on Cybersecurity No. 24/2018/QH14 has lapsed (Article 44). Clause 3, Article 25 of the new law requires domestic and foreign enterprises providing telecoms, internet or value-added services in cyberspace in Vietnam, which process personal information and data created by users in Vietnam, to store that data in Vietnam; foreign enterprises in scope must open a branch or representative office. Decree 333/2026/ND-CP sets the details:

• Data to store: personal information of users in Vietnam; account names, usage times, credit card details, email, the latest log-in IP address and the phone number linked to the account (Clause 1, Article 19). Domestic enterprises store this data in Vietnam (Clause 2).
• Foreign enterprises in the listed sectors, which include online data storage and sharing and online applications, must localise and open a branch only if their service is used to break cybersecurity law, they fail to fix it after being asked, and the Minister of Public Security issues a decision. They then have 12 months to comply (Clauses 3 and 6, Article 19).
• Retention: data for at least 24 months; system logs for at least 12 months (Clauses 1 and 3, Article 20).

The law does not define "value-added services in cyberspace", so B2B tools used only inside a customer's business must be assessed product by product; a B2C app with user accounts in Vietnam is a clearer case. A copy in Vietnam does not remove the cross-border dossier if data is also processed abroad. The full rules, including how a Vietnamese subsidiary is treated, are in data localization in Vietnam.

Fines (Article 33 of Decree 330): VND 30–50 million for not storing data, not complying with a decision to localise or open a branch, or not keeping system logs long enough. That range is for individuals; organisations pay double (Clause 1, Article 7), and the vendor can be ordered to stop providing telecoms or internet services in Vietnam.

8. Multi-tenant security, support access and the 72-hour rule

Internal access. A data processor must apply full protection measures and prevent unlawful collection from its systems (Points c and dd, Clause 2, Article 37 of the PDPL). For data protection in SaaS, that means tenant isolation, support access only against a ticket, time-limited and logged, and no production data in test environments.

Breach notice. Under Clause 1, Article 23 of the PDPL, the controller notifies the A05 Department within 72 hours when a breach may cause harm, while the data processor must notify the controller promptly. The law sets no fixed hours for the processor, so the contract should, giving the customer what it needs under Clause 1, Article 28 of Decree 356. A processor that fails to notify promptly is fined VND 10–20 million; a controller notifying after 72 hours, VND 40–60 million (Point a, Clause 1 and Clause 3, Article 54 of Decree 330). See the 72-hour breach rule.

Data subject requests and contract end. Customers have 20 days to erase data on request, or 30 days where the processor must act (Clause 4, Article 5 of Decree 356); a processor that misses the controller's deadline is fined VND 20–30 million (Clause 2, Article 44 of Decree 330). When the contract ends, deletion must be secure and prevent unlawful recovery (Clause 3, Article 14 of the PDPL), backups included.

9. AI features, analytics and advertising in SaaS products

AI. This is the newest risk in data protection in SaaS. Clause 4, Article 30 of the PDPL requires AI processing to be classified by risk level. Article 10 of Decree 356 allows personal data to be used to develop AI systems if data protection rules are met (Clause 1), and requires controllers to explain how the algorithm works and let data subjects opt out of automated processing (Clause 3). Training a shared model on customer data needs a specific contract clause; otherwise it is processing outside the contract. Failing to explain the algorithm or classify risk is fined VND 50–70 million (Clause 2, Article 67 of Decree 330).

Analytics and advertising. Data tracking behaviour and use of online services is sensitive (Point l, Clause 1, Article 4 of Decree 356). Large-scale behavioural analytics from multiple sources is big data processing under Article 9 of Decree 356, which requires multi-factor authentication and access monitoring. Using tracking data for behavioural advertising requires consent (Point a, Clause 8, Article 28 of the PDPL); doing so without consent is fined VND 50–70 million (Point c, Clause 2, Article 63 of Decree 330).

10. Five common risks in data protection in SaaS

• Terms of service but no data processing agreement. Customers trial the product with real data and upgrade without signing a DPA.
• Not realising the business is a processing service. Start-ups know the five-year option but never check Article 21 of Decree 356, so they lack both the certificate and the DPIA.
• Uncontrolled sub-processors. New email, error-tracking or AI tools are added, but the cross-border dossier is not updated every six months (Article 20 of Decree 356).
• Shared "super admin" accounts, with no logs and no time limits.
• Indefinite backups of customers who left; keeping data longer than needed is fined VND 20–40 million (Point c, Clause 1, Article 39 of Decree 330).

11. Data protection in SaaS: obligations and fines at a glance

Fines are for organisations; individuals pay half (Clause 1, Article 7 of Decree 330/2026/ND-CP), except under Article 33, which is a cybersecurity provision.

12. Data protection in SaaS for foreign vendors and foreign-invested companies

A foreign SaaS vendor selling to Vietnamese customers is within the PDPL (Point c, Clause 2, Article 1) and Decree 330, which covers foreign enterprises providing cross-border services (Point dd, Clause 2, Article 2). Three differences from the GDPR playbook many groups use:

• Dossiers go to the regulator. Both the DPIA and the cross-border transfer dossier are filed with the A05 Department; there is no adequacy mechanism that removes the dossier.
• A Vietnamese entity for processing services. The processing service certificate is issued only to organisations established under Vietnamese law (Clause 1, Article 22 of Decree 356).
• Localisation on decision. For foreign vendors, storing data and opening a branch arise only after a decision by the Minister of Public Security, but architecture should be ready to split out a Vietnam data region within 12 months.

LexData prepares DPIA and cross-border transfer dossiers and provides PDPL compliance consulting for software companies.