LexData ConsultingVIBook a consultation

Data protection

Vietnam PDPL compliance consulting for businesses

LexData's compliance consulting helps businesses review how they collect, store, use and share personal data under Vietnam's Personal Data Protection Law (PDPL). Starting from a data flow map and a compliance gap assessment, we propose a remediation roadmap prioritised by risk, resources and the requirements that apply to you under Law 91/2025/QH15 and Decree 356/2025/ND-CP.

TimelineTypically 2–6 weeks for the consulting and initial roadmap phase, depending on the size of the organisation, the number of IT systems and the complexity of personal data flows.
Book a consultation

Overview

Why do businesses need personal data compliance consulting?

We review exposure under Decree 330/2026/ND-CP, in force since 19 August 2026, linking each finding to the relevant violation and remedy: consent (Article 43), data subject rights (Articles 44–46), processing without consent (Article 47), and impact assessment dossiers and cross-border transfers (Articles 55–56). Deliberately falsifying figures or giving misleading information in a processing impact assessment dossier is fined VND 50–100 million (Clause 2, Article 55). The maximum fines under Article 7 are VND 3 billion for other violations, 5% of the previous year’s revenue for cross-border transfer violations and 10 times the proceeds for buying or selling personal data; an individual committing the same act faces half the amount that applies to an organisation. This helps you prioritise remediation.

Personal data protection consulting helps you establish where data is processed, who is responsible and which obligations come first. The assessment is based on your actual operations, including customer data, employee data and sharing with vendors.

LexData combines document review with working sessions with your legal, IT and operations teams. The report sets out compliance status, the evidence reviewed and remediation actions so you can plan implementation; results depend on the agreed scope and the information provided.

What’s included

What does the engagement cover?

  • Survey, inventory and classify basic and sensitive personal data flows across your technology systems and business processes.
  • Map current processing against mandatory obligations under Law 91/2025/QH15, Decree 356/2025/ND-CP and the penalty framework of Decree 330/2026/ND-CP.
  • Assess compliance status, the legal basis for processing (consent or statutory exceptions), role-specific responsibilities of vendors and cross-border transfer risk, including data localisation requirements under the Cybersecurity Law No. 116/2025/QH15 and Articles 19–20 of Decree 333/2026/ND-CP where they apply to you.
  • Build a Record of Processing Activities (RoPA), a data flow map and a phased, risk-prioritised compliance roadmap.

Who it’s for

Which businesses should review compliance early?

  • Businesses without a structured personal data governance system that need end-to-end compliance support.
  • Organisations that have internal rules but have not yet assessed compliance against Law 91/2025 and Decree 356/2025.
  • Technology, fintech, e-commerce, healthcare, real estate and retail businesses processing large volumes of customer and employee data.
  • Businesses facing data compliance due diligence from international partners, investors or supply chain customers.

Deliverables

What you receive

  • Compliance Gap Analysis Report on personal data protection.
  • Detailed Data Flow Map and Record of Processing Activities (RoPA) matching your processing scope.
  • Risk-tiered Action Plan and Compliance Roadmap.
  • Legal recommendations with standardised privacy notice and consent templates.
  • A briefing to the Board, management and relevant departments to hand over the roadmap.

How we work

LexData's four-step consulting process

  1. 01

    Survey and inventory data flows

    Collect information, interview departments and inventory data touchpoints across software, websites, apps and databases.

  2. 02

    Assess compliance and identify risks

    Compare operations with Law 91/2025/QH15 and Decree 356/2025/ND-CP, identify legal gaps and rate risks (critical, high, medium, low).

  3. 03

    Build a tailored compliance roadmap

    Plan step-by-step remediation that makes the best use of resources: consent mechanisms, vendor DPAs, DPIA dossiers and cross-border transfer arrangements.

  4. 04

    Hand over and guide implementation

    Deliver the document set, present the report to management and guide IT, legal and operations teams through technical and organisational measures.

What to prepare

A list of systems, data categories, processing purposes, vendor contracts and existing policies.

Scope and pricing factors

Fees depend on the number of legal entities, systems, data flows and the depth of technical review. Software implementation and specialised dossiers are scoped separately.

FAQ

About vietnam PDPL compliance consulting for businesses

What does a LexData compliance consulting engagement involve?

Four steps: (1) survey and map data flows; (2) assess compliance and identify risks under Law 91/2025/QH15 and Decree 356; (3) build a remediation roadmap and standardise legal documents; (4) deliver the report, brief management and support implementation.

Are small businesses and start-ups exempt from personal data protection obligations?

Eligible small enterprises and start-ups may choose not to perform Articles 21, 22 and Clause 2 of Article 33 of the Law for 5 years from 1 January 2026. Medium-sized enterprises do not qualify. Household businesses and micro-enterprises have their own regime under Clause 2, Article 41 of Decree 356/2025/ND-CP. None of these exemptions apply to businesses providing personal data processing services, directly processing sensitive personal data, or having processed data of 100,000 or more data subjects in total. Confirm your category and activities before relying on an exemption; all other data protection obligations continue to apply.

Can LexData support implementation after the consulting engagement?

Yes. After the review you can engage us for DPIA dossiers, outsourced DPO services, training or incident response. Scope, timeline and fees are agreed based on your needs.

Legal references

Content last updated: .

Specific obligations and filings depend on your circumstances and the rules in force at the time. Official legal texts are in Vietnamese; English wording on this page is an unofficial explanation.

Further reading

Learn more before you start

Related services

Services often used together

DPIA · Dossiers

DPIA and cross-border data transfer impact assessment dossiers

Prepare, file and maintain DPIA and cross-border transfer dossiers as required by law.

View details DPO-as-a-Service

Outsourced Data Protection Officer (DPO) services in Vietnam

Compliance monitoring, record keeping and coordination of data subject requests under an agreed scope.

View details Training & Awareness

Data Protection Officer (DPO) training for businesses in Vietnam

DPO courses that build the legal knowledge and practical skills to run personal data protection in your business.

View details

Get started

Not sure where to start?

LexData can quickly review your situation and propose a scope that fits your size, sector and legal risk.

Talk to LexData

Get started

Ready to talk to LexData?

Book a free 30-minute consultation. We'll outline your priority risks and next steps for your size and sector — no obligation.

  • Reply within 1 business day
  • Confidential discussion

Or contact us directly

CONTACT

Request a consultation

Tell us what you need and the LexData team will get back to you shortly.

0/1,000

The information you provide is processed only to receive and respond to this request, in line with LexData’s Personal Data Protection Policy.