ISO 27001 vs PDPD
Vietnam's Personal Data Protection Law 91/2025 (which replaced Decree 13/2023) and ISO 27001 are the two most important compliance requirements Vietnamese businesses face. Significant overlap between both frameworks allows effort optimization when implementing together.
Fundamental comparison
| Aspect | ISO 27001 | Luật Bảo vệ dữ liệu cá nhân (Luật 91/2025) |
|---|---|---|
| Nature | Voluntary international standard (can certify) | Mandatory Vietnamese law |
| Goal | Protect confidentiality, integrity, availability of information | Protect privacy and personal data of individuals |
| Scope | All information types (not just personal data) | Only personal data of Vietnamese nationals |
| Authority | Independent certification body (CB) | Department A05, Vietnam Ministry of Public Security |
| Consent & Data Rights | Not directly required (but Privacy policy is in Annex A) | Mandatory: consent, DSR workflow, DPIA |
| Sensitive data registration | No requirement | Impact assessment dossiers filed with MPS within 60 days |
| Output | ISO 27001 certificate (commercial value) | Legal compliance (avoid legal risk) |
Control overlap: ISO 27001 Annex A → PDPD
Annex A controls that also satisfy PDPD obligations:
What ISO 27001 does NOT cover (additional work for PDPD):
- Consent mechanism and consent withdrawal
- Data Subject Request (DSR) workflow
- DPIA documentation for sensitive data
- Impact assessment dossiers filed with the Ministry of Public Security (Decree 356)
- Cross-border data transfer agreement per PDPD
Strategy: ISO 27001 + PDPD in parallel
Implementing ISO 27001 is the ideal time to build PDPD compliance; the added cost is far lower than doing it separately.
When scoping ISO 27001, simultaneously map personal data per PDPD. One gap analysis, two outputs.
Information Security Policy, Incident Response Policy, Supplier Management Policy → adjust to cover PDPD obligations, don't rewrite.
Add a consent flow, DSR workflow, DPIA template, and impact assessment dossiers for the Ministry of Public Security under Decree 356.
When external auditors assess ISO 27001, your evidence collection process simultaneously creates PDPD documentation.
Frequently asked questions
Does ISO 27001 satisfy PDPD requirements?
No. ISO 27001 builds approximately 60-70% of the technical foundation needed for PDPD, but does not replace it. You still need to add: consent mechanisms, DSR workflows, DPIA documentation, impact assessment dossiers filed with the Ministry of Public Security, and cross-border data transfer agreements.
What does ISO 27001 not cover for PDPD compliance?
5 areas ISO 27001 doesn't cover: (1) Consent mechanism and consent withdrawal; (2) Data Subject Request (DSR) workflow; (3) DPIA documentation for sensitive data; (4) Impact assessment dossiers filed with the Ministry of Public Security within 60 days; (5) Cross-border data transfer agreements per PDPD. These must be added even if you already have ISO 27001.
How long to implement ISO 27001 and PDPD in parallel?
Parallel implementation typically takes 6-12 months depending on organization size, compared to 12-18 months if done separately. Savings come from shared gap analysis, policies, and evidence collection. A compliance platform like pTrackly can shorten the ISO 27001 side through unified control mapping; pTrackly does not directly support Vietnamese legal obligations.
Turn compliance knowledge into work that gets done
Get step-by-step AI guidance, automated evidence collection, and live control status in one workspace.
In the call, we map your framework, system scope, and how pTrackly fits your current workflow.
Does not replace an independent auditor or certification body.