In brief
A checklist for SaaS and ITO teams under Vietnam's Law 91/2025 and Decree 356/2025: data inventory, roles, 60-day impact filings, suppliers and incidents.
This Vietnam Personal Data Protection Law checklist covers what a SaaS or IT outsourcing team must have in place under Law No. 91/2025/QH15 and Decree 356/2025/ND-CP, both in force since January 1, 2026. Start with a data inventory and your role, then the impact assessments that must be filed within 60 days, suppliers, incidents and proof that controls operate.
Which law applies to personal data in Vietnam now?
Vietnam's Personal Data Protection Law No. 91/2025/QH15 was passed on June 26, 2025 and took effect on January 1, 2026, the date published on the Government Portal. Decree 356/2025/ND-CP, issued December 31, 2025, sets out the detailed rules, forms and deadlines. Together they replaced Decree 13/2023/ND-CP, which ceased to be effective on the same day. A summary of the main obligations is on the Vietnam data protection page. This checklist supports an operational review; it is not legal advice for a specific processing activity.
What does the checklist cover?
| Area | Question to answer | Evidence to keep |
|---|---|---|
| Inventory | What personal data is collected, created, received or shared, and in which systems? | Data inventory, data-flow diagram, system owner |
| Purpose | Why is each processing activity performed? | Record of processing, privacy notice, approval |
| Role | Does the company decide the purpose, or process on a customer's instructions? | Contract, data processing agreement, responsibility record |
| Impact assessments | Which activities need a processing impact assessment or a cross-border transfer assessment, and when were they filed? | Filed assessments, filing dates, 6-month update schedule |
| Data protection personnel | Who is appointed, and do they meet Decree 356 Art. 13, or is a qualified provider engaged? | Written appointment, qualification records or service contract |
| Individual rights | How are requests received, verified and answered? | Procedure, request log, responses |
| Suppliers and transfers | Who else receives the data, and where is it stored? | Vendor register, contracts, transfer assessment |
| Incidents | Who detects, assesses and notifies, and does the 72-hour rule apply? | Response plan, incident log, exercise record |
How do you inventory personal data by system and purpose?
Record data categories, the people they belong to, sources, storage systems, access, recipients, retention and deletion, and link each data element to a defined purpose instead of one broad purpose for the whole product. A SaaS company should separate account data, telemetry, user content, support records and marketing data. An outsourcing company should separate its own corporate data (staff, candidates, sales contacts) from customer data it processes under instructions, because the obligations differ.
How do you define roles and contract responsibilities?
Compare what actually happens with contracts, data processing agreements and supplier lists. Record who decides the purpose, the processing methods, retention, deletion and incident response. An ITO team that starts using customer data for its own purpose, for example to train an internal model, may change its role and obligations; send that change to legal review before it goes live.
Which filings have deadlines under Decree 356?
Decree 356 requires two impact assessments, filed with the Ministry of Public Security's specialized agency within 60 days: one when processing starts (Art. 19) and one when cross-border transfer starts (Art. 18). The transfer assessment applies when you use cloud or SaaS providers with servers outside Vietnam. Both are updated every 6 months from the first filing and within 10 days of a reportable change (Art. 20). Data protection personnel must hold at least a college degree, have 2 years of relevant experience and completed training, and be appointed in writing (Art. 13), or the company can engage a qualified service provider (Arts. 15–16).
How do you handle data subject requests?
Define intake, identity verification, an owner, internal deadlines, where to search and how decisions are recorded. Search backups, logs and suppliers, not only the primary database, and record any lawful exception you rely on. A request log with dates and outcomes is the evidence an assessor or a customer will ask for.
How do you govern suppliers and data transfers?
The vendor register should show each service, the data it receives, the purpose, the processing location, the protection terms, subprocessors and a review owner. Changing a supplier or a storage region can trigger a new or updated transfer assessment, so route those changes through a review step before the switch.
What applies to personal data incidents?
Connect technical incident response with privacy and legal review, and keep discovery time, scope, data categories, affected people, containment, notification decisions and corrective actions. Decree 356 sets a 72-hour notification for sensitive data incidents in finance, banking and credit information (Art. 8) and for location and biometric data (Art. 29). Run an exercise so the team knows who decides while the facts are still incomplete.
How do you show the controls actually operate?
Policies are only the starting point. Operating evidence includes access reviews, deletion tickets, supplier reviews, training records, incident exercises, retention jobs and change approvals. Give each evidence type an owner and a review date, so the 6-month assessment update is a refresh rather than a rebuild. If you also serve EU customers, the same inventory feeds GDPR; see how long GDPR compliance takes for that project.
Where does pTrackly fit?
pTrackly does not support Vietnam's Law 91/2025 or Decree 356 as a framework in the product; this checklist is educational. Teams running GDPR or ISO 27001 in pTrackly already keep a record of processing activities, DPIAs, an incident log with GDPR and HIPAA notification clocks, and a vendor register with DPA status, which covers much of the inventory and supplier work above. Preparing the Decree 356 forms, filing them and making legal decisions stays with the company and its counsel. See the ISO 27001 and Vietnam data protection comparison and the SaaS solution.
Frequently asked questions
When did Vietnam's Personal Data Protection Law take effect?
Law No. 91/2025/QH15 was passed on June 26, 2025 and took effect on January 1, 2026, together with Decree 356/2025/ND-CP. Decree 13/2023/ND-CP ceased to be effective the same day.
How long do companies have to file impact assessments?
Under Decree 356, the processing impact assessment (Art. 19) and the cross-border transfer impact assessment (Art. 18) must be filed with the Ministry of Public Security's specialized agency within 60 days of starting the processing or transfer, then updated every 6 months.
Does using AWS or Google Cloud count as a cross-border transfer?
If personal data is stored or processed on servers outside Vietnam, the transfer rules apply, which includes cloud and SaaS providers hosting data abroad. Map each provider's storage region before deciding.
What are the maximum fines under Law 91/2025?
Article 8 sets maximum fines of 10 times the proceeds for illegally trading personal data, 5% of prior-year revenue for cross-border transfer violations, and VND 3 billion for other violations by organizations.
Is GDPR compliance enough for Vietnam?
No. Inventory, purposes, rights handling and supplier contracts carry over, but Vietnam adds filings with the Ministry of Public Security on its own forms and deadlines, which GDPR does not have.
References
- Vietnam Personal Data Protection Law No. 91/2025/QH15 (Government Portal)
- Decree 356/2025/ND-CP (Ministry of Justice legal database)
Review the full legal text and current guidance at implementation time.
