Data protection
LexData provides data protection services in Vietnam for foreign-invested enterprises and local businesses: compliance reviews, impact assessment dossiers filed with the A05 Department, an outsourced DPO and DPO training. If your group already runs a GDPR programme, much of it is a useful starting point, but Vietnam adds its own filings and deadlines. Start from your situation below; each service page sets out the scope, deliverables and timeline.
Our advice is based on Personal Data Protection Law No. 91/2025/QH15, Decree 356/2025/ND-CP and the penalty framework in Decree 330/2026/ND-CP, in force since 19 August 2026. Each service lists the relevant provisions in its legal references.
Find your starting point
These situations most often bring foreign-invested companies to us. If you face several at once, a compliance review is usually the best way to put them in order.
Start with Vietnam PDPL compliance consulting to map data flows and set a risk-based roadmap. Unlike a GDPR DPIA, which is usually an internal document, Vietnam's processing impact assessment dossier must be filed with the A05 Department within 60 days of the first day of processing where it applies (Clause 1, Article 21 of Law No. 91/2025/QH15).
Group HR, CRM or cloud platforms hosted abroad can all involve cross-border data transfers. EU standard contractual clauses do not replace the Vietnamese transfer dossier, due within 60 days of the first transfer unless a Clause 6 exception applies (Clause 2, Article 20). See our DPIA and cross-border transfer dossier service.
Health, biometric, location and bank account data are sensitive personal data under Article 4 of Decree 356/2025/ND-CP, which requires restricted access, defined procedures and security measures (Clause 2). Pair a compliance review with a processing impact assessment (DPIA) dossier.
Contact LexData straight away; an outsourced DPO coordinates the incident and liaises with the A05 Department. Notifiable violations must be reported to the A05 Department within 72 hours of discovery (Clause 1, Article 23 of Law 91/2025/QH15); see the 72-hour breach notification rule in Vietnam.
Privacy due diligence, part of our M&A advisory in Vietnam, reviews the target's legal basis for processing, filed dossiers and incident history before you sign. After a reorganisation, filed impact assessment dossiers must be updated within 10 days (point a, Clause 2, Article 20 of Decree 356/2025/ND-CP).
Clause 2, Article 33 of the Law requires a qualified data protection unit or officer, or an engaged service provider. Choose an outsourced DPO to cover the role now, or DPO training to build in-house capability. See also what a DPO does under Vietnamese law.
Our services
Each service has its own scope, deliverables and timeline. Use one on its own or combine several as your programme in Vietnam matures.
Review your processing activities, map personal data flows and build a compliance roadmap that fits your business.
Timeline2–6 weeks
View detailsCompliance monitoring, record keeping and coordination of data subject requests under an agreed scope.
Timeline1–2 weeks to activate
View detailsPrepare, file and maintain DPIA and cross-border transfer dossiers as required by law.
Timeline3–8 weeks
View detailsDPO courses that build the legal knowledge and practical skills to run personal data protection in your business.
TimelineHalf-day to 3 days
View detailsHow we work
Each service page describes its own steps. In general, working with LexData follows four stages.
We identify your role (controller, processor or both), the obligations likely to apply and the right service. For a data breach, this becomes emergency intake.
Scope, timeline, contacts, deliverables and fees are agreed in writing before work starts.
We review documents and work with your legal, IT, HR and operations teams against Law 91/2025/QH15, Decree 356/2025/ND-CP and Decree 330/2026/ND-CP.
You receive the agreed reports or dossiers. As processing changes, we can update dossiers, run the DPO role or deliver further training.
Before the first call, prepare a list of systems, data categories, processing purposes, vendor and intra-group contracts, and existing policies, including group GDPR documents. Statutory deadlines (60 days to file dossiers, 72 hours to notify violations) do not restart when you engage a provider.
Legal documents
The laws, decrees and decisions we advise on in this practice, with English summaries and their current status.
FAQ
Yes. Law No. 91/2025/QH15 applies to foreign organisations in Vietnam and to foreign organisations directly involved in, or connected with, processing the personal data of Vietnamese citizens (Clause 2, Article 1). A GDPR programme is a useful base, but it does not cover Vietnam-specific requirements such as the dossiers filed with the A05 Department. A compliance review shows what you can reuse.
Either is allowed, and you can combine them (Clause 2, Article 33 of Law 91/2025/QH15; Clause 4, Article 16 of Decree 356/2025/ND-CP). In-house staff must meet Clause 2, Article 13 of Decree 356: a college degree or higher, at least 2 years of relevant experience and data protection training. An outsourced DPO covers the role while DPO training builds capacity. Your business remains responsible for its own compliance.
Only partly. Clause 2, Article 38 of Law 91/2025/QH15 lets eligible small enterprises and start-ups choose whether to apply Articles 21 and 22 and Clause 2 of Article 33 (impact assessment dossiers, their updates and appointing data protection staff) for 5 years from 1 January 2026. The option is unavailable to businesses providing personal data processing services, directly processing sensitive data or processing data of a large number of data subjects, and it does not cover the cross-border transfer dossier.
Each engagement is quoted on its own, based on the number of legal entities, systems and data flows, the depth of review and the deliverables. Scope and fees are agreed in writing before work starts.
Not sure where to start?
Tell LexData where you stand.
Share your needs and current situation, and LexData will help you identify the right service, scope of work and information to prepare.
Talk to us about your needsGet started
Book a free 30-minute consultation. We'll outline your priority risks and next steps for your size and sector — no obligation.
Or contact us directly
Sent!
We'll get back to you within 1 business day.
