From 1 January 2026, the Law on Personal Data Protection (Law No. 91/2025/QH15) and Decree No. 356/2025/ND-CP are in force. This raises a practical question for many businesses: do they have to have a “data protection officer” (DPO)? Many think only banks and large technology companies need one, or that it is enough to give the role to the IT or HR manager on top of their current job. In fact, the law sets a general obligation for organisations, with an exemption for micro, small and start-up enterprises that comes with important exceptions. This article explains when a business must designate personnel or a unit for personal data protection, who qualifies for the role, when an exemption applies, how in-house and outsourced models compare, and where to start.
- Clause 2, Article 33 of Law No. 91/2025/QH15: an organisation must designate a unit or personnel competent to protect personal data, or hire an organisation or individual that provides personal data protection services.
- In-house personal data protection personnel (Article 13, Decree No. 356/2025/ND-CP): college degree or higher, at least 2 years’ experience in a related field, and training in personal data protection.
- Outsourced service providers must meet a higher standard: an individual needs at least 3 years’ experience (Article 15); an organisation needs at least 3 staff who meet that standard (Article 16).
- Household businesses (hộ kinh doanh) and micro enterprises are exempt. Small enterprises and start-ups may choose for 5 years from 1 January 2026, unless they provide personal data processing services, process sensitive data, or process data of a large number of data subjects.
- A designation on paper does not remove the risk. A breaching organisation can be fined up to VND 3 billion for many violations; the maximum for an individual is half the amount for an organisation.
1. What is a DPO and what does Vietnamese law call this role?
“DPO” (data protection officer) is the international term. Vietnamese law uses the terms “unit or personnel in charge of personal data protection” (bộ phận, nhân sự bảo vệ dữ liệu cá nhân) or “organisation or individual providing personal data protection services”. In this article, “DPO” is used for all of these options.
Under Clause 2, Article 33 of the Law on Personal Data Protection (Law No. 91/2025/QH15, in force from 1 January 2026), an organisation must designate a unit or personnel competent to protect personal data, or hire an organisation or individual that provides personal data protection services.
Article 13 of Decree No. 356/2025/ND-CP requires a written document designating the personnel or unit for personal data protection, and a confidentiality agreement with the designated personnel.
Analysis: Under Article 14 of Decree No. 356/2025/ND-CP, the tasks of this unit or personnel include: building compliance policies and procedures, handling the rights of data subjects, regularly assessing the state of compliance, taking part in preparing the impact assessment dossiers, and running regular training. This is continuous operational work, not a title on paper.
2. Does your business have to have a DPO?
A common misunderstanding is that “only businesses that process sensitive data need a DPO”. The better reading is the opposite: the obligation is a general rule for organisations, and processing sensitive data is one of the factors that removes a business’s right to an exemption.
So your business needs to answer two questions:
- Is the business in a group that is exempt or may choose (household business, micro, small or start-up enterprise)?
- If yes, does the business fall into an exception that removes the exemption?
Medium-sized and large enterprises are not in an exempt group, so the obligation applies to them from 1 January 2026.
3. Are micro, small and start-up enterprises exempt?
Article 38 of the Law on Personal Data Protection (Law No. 91/2025/QH15) and Article 41 of Decree No. 356/2025/ND-CP provide that:
- Household businesses and micro enterprises do not have to comply with the rules on the personal data processing impact assessment, the cross-border personal data transfer impact assessment, or designating personal data protection personnel or a unit.
- Small enterprises and start-ups may choose whether or not to comply with these rules for 5 years from 1 January 2026.
The exemption and the right to choose do not apply if the business: provides personal data processing services; directly processes sensitive personal data; or processes the personal data of a large number of data subjects. Decree No. 356 sets this threshold at 100,000 data subjects or more (cumulative).
| Situation | Must the business designate personnel/a unit or hire a service provider? |
|---|---|
| Medium-sized or large enterprise | Yes, from 1 January 2026 |
| Small enterprise or start-up, not in an exception | May choose for 5 years from 1 January 2026 |
| Household business or micro enterprise, not in an exception | Not required |
| Any of the groups above that provides personal data processing services, directly processes sensitive data, or processes data of 100,000 or more data subjects | Yes. No exemption or choice |
Analysis: The exception for “directly processing sensitive personal data” is easy to miss. Common types of data in a business that may be sensitive include: health information, biometric data (fingerprints, faces used for time and attendance), location data, and financial and account information. A small clinic, or a workshop that uses a facial recognition time clock, should check carefully before concluding that it is exempt; the exact list must be checked against Decree No. 356/2025/ND-CP. The 100,000 threshold is not only about customers: data of employees, job applicants and app users must also be counted.
- List the types of data you collect, mark the groups that may be sensitive data and estimate the total number of data subjects.
- Record your conclusion (“exempt” or “not exempt”) with the legal basis, so you can explain it when needed.
- Small enterprises that currently have the right to choose should monitor their position: passing the threshold or starting to process sensitive data removes that right.
4. Who qualifies as personal data protection personnel?
Article 13 of Decree No. 356/2025/ND-CP: personnel designated by the organisation must have a college degree or higher; at least 2 years’ work experience related to legal affairs, information technology, cybersecurity, data security, risk management, compliance, human resources management or personnel administration; and training in the law and professional skills of personal data protection.
Articles 15 and 16 of the Decree set a higher standard for individuals and organisations that provide personal data protection services (see the table).
| Criterion | In-house personnel (Article 13) | Individual service provider (Article 15) | Organisation service provider (Article 16) |
|---|---|---|---|
| Qualifications | College degree or higher | College degree or higher | Operates in a related field |
| Experience | At least 2 years | At least 3 years | At least 3 staff meeting the Article 15 standard |
| Training | Trained in personal data protection | In-depth training in personal data protection | Through qualified staff; has a capability profile |
Analysis: Giving the role to the IT or HR manager as an extra job is lawful if that person meets all three requirements of Article 13, in particular the training requirement. The practical risk is that the designated person misses one requirement, or meets them on paper but has no time or authority to carry out the tasks in Article 14. IT staff are usually strong on the technical side but know less about the rights of data subjects; HR and legal staff are the reverse. For this reason, a unit of several people who complement each other is often a better fit.
- The designation document should state the scope of tasks, the powers and the reporting line to the management board.
- Keep evidence that the requirements are met: degrees, employment history, training certificates.
- Sign a confidentiality agreement and set aside real working time for this role.
5. What risks does the head of the business face?
Article 8 of the Law on Personal Data Protection (Law No. 91/2025/QH15): organisations and individuals that breach personal data protection law may, depending on the nature and seriousness of the breach, face disciplinary action, an administrative penalty or criminal prosecution; if they cause damage, they must pay compensation. The maximum fine for an organisation is: up to 10 times the revenue earned from buying or selling personal data; up to 5% of the previous year’s revenue for violations on cross-border personal data transfer; and up to VND 3 billion for other violations. (In the first two cases, if there is no such revenue, or it is lower, the maximum is VND 3 billion.) The maximum fine for an individual is half the amount for an organisation.
Analysis: These are the maximum amounts set by the Law. The specific fine for each violation is set by the instrument on administrative penalties. The Law does not set a separate penalty for the “head of the business” just because the business has no DPO. Even so, there are three reasons why the management board should not treat this as a matter for the IT department alone:
- The party with the obligation under Clause 2, Article 33 is the organisation. Deciding the designation, providing resources and supervising are management decisions.
- An individual who directly commits a violation (including a manager) can be penalised up to half the maximum for an organisation, and serious acts may lead to criminal liability under the Penal Code.
- When an incident happens, the business must notify the competent authority within a short time (72 hours under the current rules). Without a clearly assigned contact person, this is very hard to achieve.
- The management board approves the personal data protection policy and receives regular reports from the designated personnel or unit.
- Decide in advance who has authority to make decisions if data is leaked or lost.
6. In-house DPO or outsourced?
The law allows both options, and a business can also combine them: an in-house contact person working with an external service provider. The choice should be based on the volume of data, how sensitive it is, the resources available and the cost. Your business should compare real quotations and real recruitment costs rather than rely on general estimates.
| Criterion | In-house personnel/unit | Outsourced organisation or individual |
|---|---|---|
| Legal requirements | Article 13, Decree No. 356: college degree, 2 years’ experience, trained | Articles 15 and 16, Decree No. 356: higher standard (3 years; an organisation needs at least 3 qualified staff) |
| Knowledge of the business | Close to day-to-day operations, quick to respond | Needs time to learn the business; depends on how well the parties work together |
| Continuity | Risk when the person leaves; a replacement must be designated | Depends on the scope of the service contract |
| Cost | Salary, training, fixed management costs | Service fee by scope; compare specific quotations |
- Ask the service provider to prove that it meets Article 15 or Article 16 of Decree No. 356 (degrees, experience, capability profile).
- The contract should state the scope of work, response times, confidentiality obligations, and the deletion or return of data when the contract ends.
- Even when you outsource, keep an in-house contact person to coordinate.
- When you change the personnel or the service provider, check whether you must update the impact assessment dossiers under Decree No. 356.
7. Where should your business start?
A six-step roadmap- Take stock of the personal data you process and the number of data subjects.
- Decide whether you are exempt or have the right to choose.
- Choose a model: in-house, outsourced or combined.
- Issue the designation document and the confidentiality agreement.
- Build procedures for handling data subject requests and incidents.
- Train staff, review regularly and keep the dossiers up to date.
Quick self-check questions:
- Does the business have a written document designating the person or unit in charge of personal data protection?
- Can the designated person prove training in personal data protection?
- Does the business use fingerprint or facial recognition time clocks, or collect health information?
- Is the total number of customers, users and employees whose data is in your systems close to or above 100,000?
- If data leaked tonight, who would decide what to do and notify the authorities?
How FC Legal can help: FC Legal Law Company Limited can work with your business to review how you currently process personal data, assess whether an exemption applies, advise on the staffing model, and draft the designation document, the confidentiality agreement, and the procedures for handling data subject requests and responding to incidents. We can also run in-house training. This work can be included in our in-house legal (pháp chế) package. The scope and fee are set after we discuss your specific situation.
Talk to an FC Legal lawyer to review your types of data, the scale of processing, and the staffing model that fits the rules.
8. Frequently asked questions
Can the director also act as the personal data protection personnel?
The law does not specifically prohibit it, but the designated person must meet all the requirements of Article 13 of Decree No. 356/2025/ND-CP and have enough time to carry out the tasks. In practice, it is hard for an executive to make business decisions and supervise compliance objectively at the same time.
Is it lawful to outsource personal data protection services?
Yes. Clause 2, Article 33 of Law No. 91/2025/QH15 allows an organisation to hire an organisation or individual that provides personal data protection services instead of designating someone in-house. The provider must meet the requirements of Article 15 (individuals) or Article 16 (organisations) of Decree No. 356/2025/ND-CP.
Is a specific certificate needed to act as personal data protection personnel?
Article 13 of Decree No. 356/2025/ND-CP requires the personnel to have been trained in the law and professional skills of personal data protection. The business should keep documents proving this training in the designated person’s file.
Are household businesses and small enterprises exempt from designating personal data protection personnel?
Under Article 38 of Law No. 91/2025/QH15, household businesses and micro enterprises do not have to designate anyone; small enterprises and start-ups may choose for 5 years from 1 January 2026. Exceptions: providing personal data processing services, directly processing sensitive data, or processing the data of 100,000 or more data subjects (Article 41, Decree No. 356/2025/ND-CP).
9. Legal basis and references
- Law on Personal Data Protection No. 91/2025/QH15 (passed by the National Assembly on 26 June 2025, in force from 1 January 2026): Article 8, Clause 2 of Article 33, Article 38.
- Decree No. 356/2025/ND-CP dated 31 December 2025 detailing certain articles of, and measures to implement, the Law on Personal Data Protection (in force from 1 January 2026, replacing Decree No. 13/2023/ND-CP): Articles 13, 14, 15, 16 and 41.
- EY Vietnam, legal alert on Decree No. 356/2025/ND-CP.
- Thư viện Pháp luật and LuatVietnam: summary articles on personal data protection personnel and the exemption for small enterprises.
Review your personal data protection compliance with an FC Legal lawyer
Find out what data your business processes, where it is, which risks to deal with first and which dossiers you must prepare.
- Data map and compliance gap assessment
- Impact assessment dossiers (DPIA) and cross-border transfer dossiers
- Standard policies, vendor contracts and incident response procedures
Please do not send confidential documents or personal data through the form.
This article is for reference. It reflects the rules in force at the time of publication. For legal advice on a specific case, please contact an FC Legal lawyer.
Prepared by the FC Legal legal team and reviewed by FC Legal’s Managing Lawyer. Updated 4 October 2026.
