SOC 2 and PDPD: complying with both
US buyers want SOC 2, Vietnamese law requires PDPD: the overlaps, the gaps, and how to run both without doubling the work.
Who faces both frameworks?
Example: an HR tech SaaS in Ho Chi Minh City stores Vietnamese personnel data and has signed US customers. They want SOC 2 Type II within 12 months, while Vietnam's Personal Data Protection Law 91/2025 applies from the first data point collected.
This is common for companies with Vietnamese users and US customers or investors, including outsourcing vendors processing Vietnamese employee PII.
What each framework covers
- Nature Voluntary, not a law
- Purpose US B2B market access
- Output Audit report issued by a CPA firm
- Basis 5 Trust Service Criteria (Security, Availability, Confidentiality, Processing Integrity, Privacy)
- Renewal Typically annual (Type II)
- Enforcement Market pressure, no enforcement authority
- Nature Legal, mandatory
- Effective Since July 2023
- Scope Personal data of Vietnamese citizens
- Enforcer Ministry of Public Security (A05)
- Violations Fines, administrative penalties
- Key requirements Mandatory registration for sensitive data, consent mechanism, cross-border transfer controls
Overlaps and gaps
| Requirement | SOC 2 | PDPD / Law 91 |
|---|---|---|
| Access controls on personal data | Yes | Yes |
| Data breach notification | Yes (notify customers) | Yes (notify Ministry of Public Security within 72h) |
| Internal security policies | Yes | Yes |
| Data minimization | Partially | Yes |
| User consent mechanism | No | Yes |
| Registration of sensitive data processing | No | Yes (mandatory) |
| Cross-border data transfer controls | No | Yes (specific PDPD rules) |
| Vendor / third-party contracts | Yes | Yes |
How to run both programs in parallel
Build one shared control inventory
List every control you have and tag the frameworks it satisfies. One good access control policy meets both SOC 2 CC6 and PDPD.
Map controls in parallel during gap assessment
Use a two-column map (SOC 2 TSC and PDPD) and classify each gap as missing for one framework or both.
PDPD-specific actions SOC 2 does not cover
- Appoint a Data Protection Officer (DPO), internal or contracted
- Register with the Ministry of Public Security if processing sensitive data (health, financial, biometric, ethnic origin)
- Build a consent management flow specific to Vietnamese user data, including a consent withdrawal mechanism
- Assess and document any cross-border data transfers if using cloud providers outside Vietnam
Use a compliance platform to avoid duplicate evidence work
Collect evidence once. Multi-framework mapping links one artifact to many requirements, saving prep time when the SOC 2 Type II observation period starts.
Frequently asked questions
Do PDPD and SOC 2 overlap?
Partially: access controls on personal data, breach notification, and internal security policies. But PDPD is binding Vietnamese law, while SOC 2 is a voluntary framework for B2B service organizations.
Does SOC 2 help with PDPD compliance?
Partially. SOC 2 builds a data security control foundation that PDPD also requires. But SOC 2 does not cover PDPD-specific obligations such as filing impact assessment dossiers with the Ministry of Public Security, or consent requirements under Law 91/2025.
Can a company do SOC 2 and PDPD compliance at the same time?
Yes. Build one shared control framework and map each control to SOC 2 TSC and PDPD in parallel, instead of two separate programs.
Turn compliance knowledge into work that gets done
Get step-by-step AI guidance, automated evidence collection, and live control status in one workspace.
In the call, we map your framework, system scope, and how pTrackly fits your current workflow.
Does not replace an independent auditor or certification body.