DPIA and cross-border data transfer impact assessment dossiers

Controllers and controller-processors must file within 60 days of the first day of processing personal data (Clause 1, Article 21 of Law 91/2025/QH15). Processors prepare and keep the dossier as agreed (Clause 3, Article 21), but Article 19 of Decree 356/2025/ND-CP should be checked before concluding they need not file. Dossiers are submitted to the A05 Department using the forms in the Appendix to Decree 356. The authority assesses the dossier and returns a pass or fail result within 15 days (Clause 5, Article 19 of Decree 356); for an incomplete or non-compliant dossier it requires completion within 30 days (Clause 6, Article 19), and failure to complete it properly may lead to administrative penalties.

Yes, they are two different dossiers. Where filing is required, the cross-border transfer dossier is due within 60 days of the first transfer under Article 20 of Law 91/2025/QH15. Clause 6, Article 20 does not require a transfer impact assessment for: transfers by competent state agencies; an organisation storing its own employees’ personal data on a cloud service (point b); a data subject transferring their own data; and other cases set by the Government. Clause 3, Article 17 of Decree 356 adds: journalism and media activities; data already made public as provided by law; genuine emergencies; cross-border HR management under labour rules and collective bargaining agreements (point d); and providing data to conclude a contract or complete formalities for cross-border shipping, logistics, money transfers, payments, hotels, visas or scholarships (point dd). Each case has its own conditions, so each activity should be checked individually. For cross-border dossiers the authority likewise returns a result within 15 days (Clause 5, Article 18 of Decree 356) and requires completion of an incomplete or non-compliant dossier within 30 days (Clause 6, Article 18).

Eligible small enterprises and start-ups may choose not to prepare or update the DPIA dossier (Articles 21 and 22 of Law 91/2025/QH15) for 5 years from 1 January 2026; household businesses and micro-enterprises follow Clause 2, Article 41 of Decree 356/2025/ND-CP. The exemption does not apply to businesses providing personal data processing services, directly processing sensitive personal data, or reaching 100,000 data subjects. Note that it does not exempt the cross-border transfer dossier under Article 20 of the Law; small businesses transferring data abroad must still prepare and file it where required.

Article 22 of Law 91/2025/QH15 and Article 20 of Decree 356 require updates every 6 months when there are qualifying changes, or within 10 days in specifically listed cases. LexData helps classify changes, track deadlines and prepare updates within the contracted scope.

Processing and cross-border transfer impact assessment dossiers filed under Decree 13/2023/ND-CP and received by the specialised authority before 1 January 2026 remain valid and do not have to be prepared again under Law 91/2025/QH15; later updates follow the new Law (Clause 2, Article 39). For processing that began earlier but has not yet been filed, how the 60-day period is counted should be assessed case by case.