Legal Alert | March 2026 | Decree No. 356/2025/ND-CP providing detailed guidance for implementation of Personal Data Protection Law

Transfer based on consent or in cases of restructuring, reorganization, or transfers from data controllers to processors/third parties

To have an agreement with the receiving party clearly specifying purpose, data subjects, data types, processing duration, deletion, legal basis, and responsibilities of parties

Transfer of sensitive personal data

• To apply physical security measures
• To encrypt, anonymize, or apply other security measures during the transfer 

Transfer involving fees

• To obtain accurate and clear consent for each transfer
• To have an agreement before the data is transferred

Internal transfer within the same organization

To establish control process for sharing and using data and prevent unauthorized disclosure

Data marketplace transactions

Data must be de-identified before the transaction

Internal DPO 

• College degree or higher
• At least two years of experience relating to: legal affairs, information technology, cybersecurity, data security, risk management, compliance control, human resources management, organizational personnel
• Trained in personal data protection

• Conducting periodic compliance assessments
• Developing and implementing policies, procedures, and technical measures
• Implementing data subjects’ rights
• Responding to violations and preparing impact assessment dossiers
• Participating in training 

Internal DPD 

Same as internal DPO

Individuals providing personal data protection services

• College degree or higher
• At least three years of experience in one of the following areas: legal affairs, personal data processing, cybersecurity, data security, risk management, compliance control
• In-depth training in data protection
• Same as internal DPO

• Performing the scope of services as agreed
• Not taking advantage of the provision of services to engage in any unlawful acts
• Deleting, destroying personal data after the contract has been fulfilled and in accordance with the laws

Organizations providing personal data protection services

• Operating in the fields of technology, legal services, or consulting in technology or legal matters
• Having at least three personnel who meet the competency standards required for individuals providing personal data protection services
• Previously having provided products or services related to information security, cybersecurity, information technology, standards assessment, personal data protection consulting
• Must prepare capability documentation demonstrating competence in personal data protection

Assessment mechanism

Ex-post review mechanism

Dossier components

• DPIA and CTIA reports
• Contract on personal data processing 

Impact assessment report

• Form No. 06, Decree 13; Forms No. D24-DLCN-01 or D24-DLCN-02 or D24-DLCN-03, D25-DLCN-04, Decision 4660/QD-BCA-A05
• No requirement to delineate roles or provide a data-flow diagram.

• Forms No. 09 and No. 10, Decree 356
• Clear delineation between activities performed in the role of data controller and activities performed in the role of data processor or third party, identify corresponding categories of data subjects and quantities
• Include a detailed data processing flow diagram for each role; plan for ensuring data security

Dossier processing duration

Not applicable

• 15 days: for A05 to evaluate and determine whether the dossier meets or does not meet the requirements
• 30 days: for the enterprise to supplement and complete the dossier if it is incomplete or non-compliant. If the enterprise fails to do so, administrative sanctions may be imposed.

Update

Update when changes arise, but no specific cases or deadlines for updates are provided

• Periodic update every six months when: (i) new purposes for transferring or processing data arise; or (ii) there are changes to the data controller, data controller cum processor, data processor, or third party.
• Immediate update within 10 days when: the entity is reorganized, ceasing its operation, dissolved, or declared bankrupt; there are changes to the personal data protection service provider; or changes to business lines and services involving personal data processing which were registered in DPIA, CTIA dossiers. 

Basis

• Suspicion of violations of personal data protection laws
• Instructions from competent state authorities
• Implementation of state management duties

Subject

Organizations, individuals who:

• Process personal data
• Provide data processing services
• Conduct DPIA, CTIA
• Involved in cases or incidents relating to violations of personal data protection regulations

Content

• Personal data protection compliance
• DPIA and CTIA activities
• Provision of personal data processing services 

Data marketplace transactions

• A05 will notify the inspection subject 15 working days in advance
• Conduct an immediate inspection without prior notice

Scope of exemption

Appointment of DPO, DPD

• Appointment of DPO, DPD, engagement of external individuals/organizations providing personal data protection services
• Obligation to prepare, update, and submit DPIA, CTIA reports

Entities eligible for exemption

• Micro, small, and medium-sized enterprises
• Start-ups

• Household businesses, micro and small enterprises
• Start-ups

Duration of exemption

• Small enterprises, start-ups:
  Five years from 1 January 2026
• Household businesses,
  micro-enterprises: fully exempt

Cases not eligible for exemption

Household businesses, enterprises that:

• Provide personal data processing services,
• Directly process sensitive personal data
• From the time of reaching a cumulative processing volume of 100,000 data subjects or more

1

• Assess gaps in operations, procedures, policies, templates, management and technical measures, human resources governance, data subject and partner management, and administrative procedural compliance in accordance with PDPL, Decree 356, consumer protection regulations, and other relevant laws
• Develop an implementation roadmap with appropriate tasks, timelines, resources, and budget. 

2

Enhance and standardize the enterprise’s personal data protection framework in line with the PDPL, Decree 356, consumer protection regulations, and other relevant laws, including:

• Policy on personal data processing and consent templates for each data subject group
• Policies, guidelines, and procedures for personal data protection for employees, including:

(i)         General regulations on personal data processing

(ii)        Procedure for managing data subject consent forms

(iii)      Procedure for handling data subject rights requests

(iv)      Procedure for assessing and managing risks of business partners and service providers

(v)       Policy on retention, deletion, and destruction of personal data

(vi)      Governance regulations for personnel or departments in charge of personal data protection

(vii)     Policy for periodic compliance assessment on personal data protection

(viii)   Incident response policy for personal data breaches

• Standard contractual clauses for personal data transfer and processing
• Cross-border data transfer agreements

3

• Conduct a comprehensive assessment of systems, applications, databases, and business processes to identify all relevant data sources
• Develop a complete personal data flow diagram

4

Prepare, update, and submit DPIA, CTIA

Prepare, track, update, and submit DPIA, CTIA using Forms No. 09 and No. 10 of Decree 356

5

Appoint or hire personal data protection personnel

• Assess whether internal DPO/DPD or external data protection service providers meet professional competency standards
• Reflect the structure, responsibilities, and operating mechanisms of these roles in the appointment decision, internal governance policies, and service contracts (if applicable)

6

Awareness training

• Develop awareness training programs for employees
• Conduct periodic training sessions

7

Periodic assessment

Conduct periodic personal data protection compliance assessment to recommend measures to enhance compliance effectiveness, and prevent and mitigate risks in personal data processing activities