Personal data protection compliance checklist for enterprises.

1. Enterprises should comply in twelve ordered steps

Step 0. Determine whether an exemption applies

Do this step first, because its result sets the scope of all the remaining work.

• Household businesses and micro enterprises are fully exempt from appointing a personal data protection unit or staff member and from preparing an impact assessment.
• Small enterprises and innovative start-ups may opt out of these obligations for 5 years from 1 January 2026.

Next, check the three conditions under which the exemption is lost: the enterprise's business is personal data processing; it processes sensitive personal data; or it processes the data of 100,000 or more data subjects.

In practice, many small e-commerce and mobile app businesses meet the second or third condition without realising it, especially since Decree No. 356 added behavioural and location data to the sensitive category.

Step 1. Data inventory

List all personal data the enterprise processes, classify it as basic or sensitive data under Decree No. 356/2025/ND-CP, and draw a data flow diagram.

The data flow diagram is a required part of the impact assessment, but its real value goes further: it is the only tool that shows which systems the data passes through, who can access it and where it is stored. Without it, the later steps are guesswork.

Include internal data, not just customer data. Timekeeping systems, HR software, CCTV and candidate files are all in scope.

Step 2. Determine the legal role

For each data flow, decide whether the enterprise acts as Personal Data Controller, Personal Data Processor, or both. One enterprise may play different roles in different flows.

At the same time, list every third party and supplier with access to the data: cloud providers, couriers, payment providers, marketing agencies, auditors and HR service companies.

Step 3. Determine the legal basis for each processing activity

For each processing activity, decide whether it relies on the data subject's consent or on one of the cases in which the law allows processing without consent.

Record this in writing, because in an inspection the enterprise must justify the basis for each activity, not just for the system as a whole.

Step 4. Rebuild the consent mechanism

This step takes the most effort, because the enterprise must change both its user interface and its database.

• Obtain consent separately for each purpose; do not bundle purposes.
• Remove all pre-ticked boxes.
• Make sure the consent record can be printed and reproduced in writing.
• Set up a system that keeps evidence of consent, showing both when consent was given and what was agreed. This is a new obligation under Decree No. 356.
• Build a way to withdraw consent, and record each withdrawal in the same system.

Step 5. Designate the personnel responsible for data protection

Check that the appointed person meets the standards: a college degree or higher; at least 2 years' experience in legal, IT, cyber security, data security, risk management or compliance; and training in personal data protection.

If no employee meets the standards, the enterprise may hire an outside organisation or individual with at least 3 years' experience, or combine internal staff with an outsourced service.

Step 6. Prepare and file the personal data processing impact assessment dossier

File the assessment with the Department of Cyber Security and High-Tech Crime Prevention of the Ministry of Public Security within 60 days of starting to process personal data. The Department responds within 15 days.

Keep the assessment available for inspection at all times, and notify any changes to what was filed.

Step 7. Prepare the cross-border transfer dossier where applicable

This assessment is separate from the one in Step 6. It must also be filed within 60 days of starting the transfer.

Before preparing it, check whether the data flow is exempt. Exempt flows include journalism, lawfully published data, emergencies, cross-border HR management within the same group, and documents for international transactions.

If no exemption applies, sign a data transfer agreement that covers all mandatory points (purpose, data types, processing period, each party's responsibilities and security measures), and encrypt or anonymise sensitive data in transit.

Step 8. Review and re-execute contracts with processors and suppliers

Add contract terms on: personal data protection; the permitted scope and purposes of processing; the processor's responsibilities; help with data subject requests; incident notification; and deleting or returning data when the contract ends.

An enterprise may not delegate or subcontract advertising services that use personal data to a third party, so marketing contracts need a separate review.

Step 9. Build a process for responding to the rights of data subjects

The process should cover how requests are received, how the requester's identity is verified, who handles the request, and internal deadlines shorter than the legal ones. The legal deadlines are 2 working days to respond to a withdrawal of consent, 10 days for a request to view or correct data, and 20 days for a deletion request.

Step 10. Build a data incident response process

The mandatory deadline is 72 hours from discovering the breach. Decide in advance who decides to notify, who signs the notice, and prepare a notice template with all mandatory content. Keep incident records for at least 5 years.

If a breach involves location or biometric data, the enterprise must also notify the affected data subjects directly within the same 72 hours.

Step 11. Review all human resources documents

The enterprise should: remove fields from its application form that do not serve recruitment; set up a process to delete unsuccessful candidates' data; obtain employees' consent before collecting data by technological means, including biometric timekeeping and monitoring of work devices; and set up a process to delete employee data when employment ends.

2. Enterprises need a minimum set of internal documents

3. Time limits enterprises must observe

4. Enterprises often make a few common mistakes

1. Still citing Decree No. 13/2023. That decree expired on 1 January 2026. Privacy policies and consent forms that cite it must be replaced.
2. Bundling several purposes in one tick box. Consent must be obtained separately for each purpose.
3. Pre-ticking the consent box. This is prohibited and sanctionable.
4. Not keeping evidence of consent. An enterprise may have a consent screen but not record when the user agreed and to what, so it cannot prove compliance in an inspection.
5. Forgetting internal data. Enterprises focus on customer data and overlook employee data, yet breaches involving employee data carry high fines under a separate set of sanctions.
6. Keeping unsuccessful candidates' files without a separate agreement with them.
7. Installing biometric timekeeping without consent. Biometric data is sensitive, and collecting data by technological means at work requires employees' consent.
8. Not reclassifying data after the sensitive category was widened. Online behavioural data and location data are now sensitive.
9. Assuming the small-enterprise exemption applies without checking the three exclusions.
10. No data protection terms in supplier contracts, especially with cloud and marketing providers.
11. Not deciding in advance who notifies an incident. 72 hours is very short, and most of it is often lost working out who has authority to decide.

5. Foreign invested enterprises need to watch some further points

• HR data sent to the parent company is usually exempt from the cross-border transfer assessment as intra-group HR management. However, the enterprise should define the scope of that flow clearly, because any customer data sent with it is not exempt.
• Systems located abroad. Using cloud services with servers outside Vietnam counts as transferring data abroad, even if the enterprise does not actively send data out.
• A group's global policy does not automatically satisfy Vietnamese requirements. The requirements for a printable format, evidence of when and to what consent was given, standards for the responsible staff, and the filing with the specialised authority are specific to Vietnam and need separate documents under Vietnamese law.
• Data localisation falls under cyber security law, currently the Law on Cyber Security No. 116/2025/QH15 (in force from 1 July 2026) and Decree No. 333/2026/ND-CP (in force from 19 August 2026). The obligation arises only on the competent authority's written request; it does not apply automatically.
• In an acquisition, include personal data compliance in the legal due diligence and cover it with a separate indemnity, because most enterprises do not yet fully meet this new obligation.

6. Where resources are limited, enterprises should prioritise in this order

For an enterprise that has not started and has limited resources, a sensible order is:

1. Inventory the data and draw the flow diagram. Without this, every other step lacks a basis.
2. Fix consent collection and evidence. This is the area inspected most often and where breaches are easiest to prove.
3. Prepare the incident response process. It costs little but removes the biggest risk, because 72 hours leaves no room for improvisation.
4. Review HR documents. Employee data breaches carry high fines and are clearly defined.
5. Prepare the impact assessment. This takes the most effort, but is much simpler if the first step was done thoroughly.