TIN & PARTNERS · DATA PROTECTION & PRIVACY
Personal data protection in Vietnam: compliance starts before an incident.
Personal data protection is not limited to technology companies or major security breaches. Recruitment records, employee files, customer databases, marketing activities and information shared with service providers all raise questions about how personal data is collected, used, retained and disclosed. A business can face compliance issues even when no data has been leaked. Collecting unnecessary information, using it beyond the stated purpose or sharing it without appropriate safeguards can create exposure through ordinary business activities.
Privacy compliance is an ongoing operational responsibility, not a single documentation exercise. As businesses introduce new systems, outsource functions and share information across borders, their data practices may move beyond what existing policies and arrangements cover. Waiting until a complaint, transaction review or security incident arises can leave limited time to identify gaps and respond. A privacy policy alone cannot replace the procedures, records and allocation of responsibility needed to put it into practice.
At Tin & Partners, we advise businesses on personal data protection, privacy compliance and data governance in Vietnam. We help clients understand their data practices, identify legal gaps and establish arrangements that work across HR, customer relationships, service providers and overseas group operations. Our involvement can begin before a new system or activity is introduced, or address existing practices that need review. The objective is to turn legal requirements into usable documents, clear responsibilities and practical implementation steps.
PERSONAL DATA IN YOUR BUSINESS
Day-to-day data use and changes that require closer attention.
Daily operations & data handling
Where personal data forms part of ordinary operations.
- Recruitment, employee and payroll records Review how recruitment and employment data are collected and used.
- Customer accounts and contact databases Map customer information, access rights and ordinary data use.
- Marketing communications and online forms Review collection notices, form content and communication practices.
- Visitor records, CCTV and attendance systems Review the information recorded, notices and access arrangements.
- Data retention, access and deletion practices Clarify retention periods, permissions and deletion procedures.
Data sharing, systems & emerging issues
When data use, access or responsibilities change.
- New platforms, applications or cloud systems Review data flows and responsibilities when introducing new systems.
- Outsourced processing and service providers Review provider roles, processing terms and information-sharing arrangements.
- Overseas hosting and access by group companies Map cross-border storage, group access and the related documentation.
- Sensitive data and new processing purposes Assess the data involved and proposed changes in how it is used.
- Individual requests, complaints or data incidents Review the issue, available records and appropriate response steps.
OUR APPROACH
Understand the data and make compliance work in practice.
We begin with how your business actually handles personal data: what is collected, why it is needed, where it is stored, who receives it and how long it is retained. We assess the relevant processing roles and requirements, then identify priorities across policies, contracts, assessments and internal procedures. Our advice considers existing systems and working practices rather than assuming that standard documents will resolve every issue. We work with management, HR, legal and technical teams to establish responsibilities and support implementation. Our role is legal advisory and documentation; cybersecurity testing, system configuration and forensic investigation remain with the relevant technical specialists.
Our Work May Include
- Data Mapping & Compliance Review: Review data categories, processing purposes, systems, recipients and retention practices, identify the organisation’s legal responsibilities and prepare a prioritised assessment of compliance gaps.
- Privacy Notices, Policies & Consent: Draft or revise employee, applicant, customer and website notices, internal privacy policies and consent materials, assessing when consent is required and how it should be obtained and recorded.
- Employee & Customer Data Advice: Assess recruitment, workforce management, customer communications and marketing practices, including the treatment of sensitive information and whether existing collection and retention arrangements remain appropriate.
- Data Processing & Sharing Agreements: Draft, review and negotiate privacy provisions with service providers, group companies and other recipients, addressing permitted use, responsibilities, cooperation, incident reporting and arrangements when the relationship ends.
- Data Protection Impact Assessments: Determine whether a personal data processing impact assessment dossier is required, and prepare or update the agreed assessment and submission documents using verified operational and technical information.
- International Data Transfers: Review overseas hosting, remote access and international sharing arrangements, assess applicable transfer requirements and exemptions, and prepare impact assessments and submissions for overseas transfers of personal data where required.
- Data Subject Rights & Incident Response: Establish procedures for individual requests, review reported incidents and advise on legal response duties, notifications and communications, working with the responsible business and technical teams.
- Internal Governance & Ongoing Compliance: Advise on privacy responsibilities, retention and deletion rules, staff guidance and review procedures, helping keep the legal framework aligned with changes in systems, vendors and business activities.
A focused privacy review or ongoing compliance support.
We can assist with a particular policy, contract, assessment or data issue, or support a broader privacy compliance programme. The scope reflects your activities, existing arrangements and the legal work actually required.