PDPD · Preparation Kit

Vietnam Data Protection Law 2025 Readiness

Preparation materials for Law 91/2025 and Decree 356/2025, from data inventory, consent mechanism, to impact assessment dossiers filed with the Ministry of Public Security. For Vietnamese businesses and foreign companies with Vietnamese users.

Get pTrackly support →

1. Data Inventory & Classification

□ List all personal data collection points
□ Classify: basic vs sensitive data (health, financial, biometric, children's...)
□ Map data flows: collection → processing → storage → sharing
□ Identify third parties receiving data

2. Consent Mechanism

□ Audit current consent form: is it bundled? Can it be withdrawn?
□ Build granular consent: separate per purpose
□ Consent withdrawal: provide easy-to-use mechanism
□ Log consent records with timestamps
□ Update Privacy Policy per PDPD requirements

3. DPIA (Data Privacy Impact Assessment)

□ When mandatory: sensitive data + large-scale processing
□ DPIA template: describe processing, necessity, proportionality, risks
□ Risk mitigation measures
□ Retain DPIA, must provide when authorities request

4. Data Subject Request (DSR) Workflow

□ Intake channel: email or form to receive requests
□ Identity verification: confirm requester's identity
□ Response timeline: process within reasonable time
□ Common requests: access, erasure, rectification, objection

5. MPS Registration (if handling sensitive data)

□ Determine if handling sensitive data (health, financial, biometric...)
□ Prepare processing and cross-border transfer impact assessment dossiers for the Ministry of Public Security
□ Include: data types, purposes, protection measures, organization info
□ Update registration when significant changes occur

6. Connecting with the frameworks pTrackly supports

□ ISO 27001: Annex A controls → meets ~60-70% of PDPD technical obligations
□ GDPR: if already GDPR-compliant, Law 91/2025 mainly adds impact assessment dossiers filed with MPS
□ SOC 2 Privacy TSC: consent, data subject rights → overlap with PDPD
□ HIPAA / PCI-DSS: technical safeguards satisfy PDPD technical protection requirements

pTrackly does not support PDPD as a standalone framework. It helps you run ISO 27001 and GDPR, whose controls overlap substantially with Vietnam's personal data protection obligations.

Get Free Demo

pTrackly compliance platform

Turn compliance knowledge into work that gets done

Get step-by-step AI guidance, automated evidence collection, and live control status in one workspace.

See pTrackly Demo See how it works

In the call, we map your framework, system scope, and how pTrackly fits your current workflow.

Does not replace an independent auditor or certification body.