- Full title: Decision announcing the list of newly issued and abolished administrative procedures in the field of personal data protection under the state management of the Ministry of Public Security
- Issued by: the Minister of Public Security, 9 February 2026
- In force from: the date of signing
- Replaces: Decision 4660/QD-BCA-A05 of 4 July 2023
- Vietnamese text: Thu Vien Phap Luat · LuatVietnam
Note: this page is a summary. The Decision comes with detailed forms and step-by-step procedures, which are not reproduced here.
Article 1. Six new administrative procedures
All six are handled at central level by the Department of Cybersecurity and High-Tech Crime Prevention (A05), Ministry of Public Security:
- Filing the cross-border personal data transfer impact assessment dossier;
- Filing the personal data processing impact assessment (DPIA) dossier;
- Filing an update to a personal data impact assessment dossier;
- Issuing a certificate of eligibility to provide personal data processing services;
- Re-issuing that certificate;
- Replacing that certificate.
Article 2. Five procedures abolished
The Decision abolishes the five procedures announced in Decision 4660/QD-BCA-A05 of 4 July 2023 (codes 3.000236 to 3.000240). These were the Decree 13/2023/ND-CP procedures for breach notification and for filing or changing impact assessment and overseas transfer dossiers.
What it means for businesses
- One set of filing channels: DPIA dossiers, cross-border transfer dossiers and updates are filed through the Ministry of Public Security’s online public services portal, in person or by post to the A05 Department, using the forms in the Appendix to Decree 356/2025/ND-CP (Forms 01a/01b, 02a/02b and 03a/03b).
- Processing time: under the published procedures, the A05 Department assesses a dossier and replies within 15 days of receiving it. An incomplete dossier must be completed within 30 days as instructed (Clauses 5 and 6 of Articles 18 and 19 of Decree 356/2025/ND-CP).
- Legal basis: the procedures implement the obligations in Law No. 91/2025/QH15 and Decree 356/2025/ND-CP (impact assessments and updates). They fully replace the procedures under Decree 13/2023/ND-CP.
- Personal data processing services: a business that provides personal data processing services will need a certificate of eligibility from the specialised authority. The procedures to issue, re-issue and replace it are now officially listed.
See what is a DPIA and cross-border data transfer.
