Many businesses think that renting servers on AWS, Google Cloud or Azure, or using foreign SaaS software, is just an IT operations matter. Under the Law on Personal Data Protection (Law No. 91/2025/QH15) and Decree No. 356/2025/ND-CP, storing personal data on systems located outside Vietnam, or using a foreign platform to process data collected in Vietnam, is a cross-border personal data transfer. In that case, apart from certain exempt cases, the business must prepare an impact assessment dossier, often called a “CTIA”, with a report on Form No. 09, and send it to the competent authority within 60 days. This article explains when a dossier is required, what it contains, the deadlines for filing and updating, the penalty risks, and how a business can start its review.
- Storing personal data on servers located outside Vietnam, or using a foreign platform to process data collected in Vietnam, is a cross-border personal data transfer (Article 20, Law No. 91/2025/QH15).
- The transferring party must prepare an impact assessment dossier and send 1 original to the competent authority within 60 days from the date the transfer starts, except in exempt cases.
- Under Article 18 of Decree No. 356/2025/ND-CP, the dossier consists of: the report on Form No. 09, a copy of the contract binding the parties’ responsibilities, and the personal data protection policies and procedures.
- The dossier must be updated every 6 months when there are changes (such as a new purpose), and within 10 days for certain changes such as a reorganisation of the business (Article 20, Decree 356).
- The maximum fine for breaching the rules on cross-border data transfers is 5% of the organisation’s revenue in the preceding year; if it has no revenue or that amount is lower, the maximum is VND 3 billion (Article 8, Law 91).
1. Is “just renting cloud, using SaaS” a transfer of data abroad?
When reviewing compliance for technology, e-commerce and foreign-invested (FDI) businesses, FC Legal often hears CTOs ask: “We only rent AWS or Google Cloud infrastructure. We don’t hand data to any foreign partner. Why do we need a procedure for transferring data abroad?”
The law does not look at whether the business “actively hands over” data. It looks at where the personal data is stored and processed.
Scope of cross-border personal data transfers
Clause 1, Article 20 of the Law on Personal Data Protection (Law No. 91/2025/QH15, in force from 1 January 2026) and Clause 1, Article 17 of Decree No. 356/2025/ND-CP set out the cases of cross-border personal data transfer, including:
- transferring personal data stored in Vietnam to a storage system located outside Vietnam;
- an agency, organisation or individual in Vietnam transferring personal data to an organisation or individual abroad;
- using a platform outside Vietnam to process personal data collected in Vietnam.
Analysis: The following situations usually fall within this scope:
- customer databases hosted in the Singapore, Tokyo or United States regions of AWS, Azure or Google Cloud;
- foreign SaaS holding identifying information: CRM (Salesforce, HubSpot), customer service (Zendesk), collaboration (Jira, Slack, Google Workspace, Microsoft 365);
- FDI companies synchronising HR and payroll data to their parent group’s systems.
“CTIA” (Cross-border Transfer Impact Assessment) is a common name, not a legal term. The official name is the cross-border personal data transfer impact assessment dossier, with a report on Form No. 09 issued with Decree No. 356/2025/ND-CP. In this article we call it the “Form No. 09 dossier”.
2. When is a Form No. 09 dossier not required?
Not every data flow abroad requires a dossier. Businesses should read this part carefully before reaching a conclusion. It can save unnecessary work, but it is also easy to apply wrongly.
Cases where no dossier is required
Clause 6, Article 20 of Law No. 91/2025/QH15 lists the cases where no cross-border personal data transfer impact assessment dossier is required. They include: transfers of personal data by competent state authorities; an agency or organisation storing personal data of its own employees on cloud computing services; data subjects transferring their own data; and other cases provided by the Government.
Clause 3, Article 17 of Decree No. 356/2025/ND-CP adds further cases, for example transferring employee data for HR management under labour law, or providing data to perform services such as transport, payment, hotel booking or visa applications, each subject to specific conditions.
Analysis: The cloud exception applies only to the organisation’s own employees’ data. If Google Workspace or Microsoft 365 also holds data of customers, candidates or individual partners, that data is not automatically exempt.
Micro businesses, small businesses and start-ups may be exempt from, or may choose whether to carry out, the impact assessment under Article 41 of Decree 356. This does not apply if they directly provide personal data processing services, process sensitive data, or process data of a large number of data subjects.
Record in writing why the business decided that a data flow does not require a dossier (the legal provision, the type of data, the systems involved). In an inspection, this reasoning helps the business show that it made an assessment and did not simply overlook the issue.
3. What does the Form No. 09 dossier contain?
Contents of the dossier (Clauses 2 and 3, Article 18, Decree No. 356/2025/ND-CP)
The cross-border personal data transfer impact assessment dossier consists of:
- the cross-border personal data transfer impact assessment report on Form No. 09;
- a copy of the contract or document showing the binding obligations and responsibilities of the organisations and individuals involved in the transfer;
- the personal data protection policies and procedures.
The report should cover the main points, such as: information and contact details of the transferring party and the recipient; details of the personal data protection department and staff; a description and explanation of the purpose of the transfer and the types of data; how the data subjects’ consent is obtained; the data protection plan; a system diagram; and the results of the compliance self-assessment and risk assessment.
Analysis: When using cloud and SaaS, the three parts of the dossier usually correspond to the following documents:
| Dossier part | Actual documents when using cloud/SaaS | Common mistakes |
|---|---|---|
| Report on Form No. 09 | Description of each provider, storage region, types of data, purpose, data flow diagram, encryption measures, access rights, risk assessment | Vague descriptions that do not state the country of storage; missing SaaS tools that departments bought themselves |
| Copy of the contract binding responsibilities | The provider’s service contract, terms of use and data processing addendum (DPA); intra-group agreement with the parent company | DPA not accepted or not saved; contract does not set out the parties’ roles |
| Personal data protection policies and procedures | Data protection policy, access management, incident response, data retention and deletion procedures | A policy exists but does not match how the systems actually operate |
How the data subjects’ consent is obtained is a point described in the report, not a separate part of the dossier. The business still needs to keep evidence of consent (or another legal basis for processing) to show when asked. Consent must be clear and verifiable and must not be assumed by default.
Businesses usually cannot renegotiate contracts with large cloud providers. Save the DPA and terms of service that apply to your account, record the date you accepted them, and refer to them in the Form No. 09 report. For transfers to a parent company, have a written intra-group data transfer agreement.
FC Legal can review the cloud and SaaS services you use and identify which flows need a Form No. 09 dossier.
4. Deadlines for filing, completing and updating the dossier
Deadlines for filing and completing the dossier
- Clause 2, Article 20 of Law No. 91/2025/QH15 and Clause 4, Article 18 of Decree No. 356/2025/ND-CP: send 1 original of the dossier to the competent personal data protection authority within 60 days from the date the cross-border personal data transfer starts, with a cover document on Form No. 01a or 01b. It can be filed online, in person or by post.
- The competent authority is the Department of Cybersecurity and High-Tech Crime Prevention (A05), Ministry of Public Security.
- Clause 6, Article 18 of Decree 356: if the dossier is incomplete, the competent authority will ask for it to be completed. The deadline for completion is 30 days.
Updating the dossier (Article 20, Decree No. 356/2025/ND-CP)
- Update every 6 months when there are changes, for example a new purpose for transferring personal data or a change of data controller.
- Update within 10 days for certain changes, such as reorganisation or dissolution; a change of the organisation or individual providing personal data protection services; or a change of business lines related to personal data processing.
- The update is made on Form No. 03a or 03b and sent online, in person or by post.
Lifecycle of the Form No. 09 dossier:
- Data transfer starts (a system goes live, a new SaaS contract is signed).
- Prepare the dossier and send the original with Form No. 01a/01b within 60 days.
- Complete it within 30 days if asked.
- Review changes and update every 6 months.
- Update within 10 days in case of reorganisation or another change listed by law.
Analysis: The 60-day period runs from the date the transfer starts, not from the date the business realises it has the obligation. Systems that were already running should be brought into compliance early.
With cloud and SaaS, changes happen often: adding a provider, moving to another region, or turning on analytics or AI features that use data for a new purpose. Each change should be checked against Article 20. According to published information on Resolution No. 22/2026/NQ-CP (applying from 29 April 2026 to the end of 1 March 2027), the Ministry of Public Security may pass dossiers to provincial police for handling based on location, scale and sector.
Build the Form No. 09 review into the IT procurement process. Any proposal to buy SaaS or change the cloud architecture that involves personal data should be checked by the legal team or the data protection staff before it is deployed.
5. Legal risks of not preparing or not updating the dossier
Maximum fines (Article 8, Law No. 91/2025/QH15)
- Breaches of the rules on cross-border personal data transfers: the maximum fine is 5% of the organisation’s revenue in the preceding year; if it has no revenue or the revenue-based amount is lower, the maximum fine is VND 3 billion.
- Other personal data protection violations: up to VND 3 billion.
- The maximum fine for an individual is half of that for an organisation.
Power to order a transfer to stop
Clause 2, Article 17 of Decree No. 356/2025/ND-CP allows the competent authority to require a cross-border personal data transfer to stop if it finds that the data is used in unlawful activities, or that there is a violation that could harm national defence or national security.
Analysis: The 5% of revenue figure is the ceiling set by the Law, not the amount applied to every violation. The specific fine for each act (such as not preparing or not filing the dossier on time) is set by the decree on administrative penalties in cybersecurity and personal data protection. Check the instrument in force at the time of the violation.
Besides fines, the business may have to fix its dossier in a hurry during an inspection, and may face problems in fundraising or M&A, where investors often ask for evidence of data protection compliance.
6. Where should the business start?
The technical and legal teams should work together on the 5 steps below. A self-check question: can your business say right now in which country its customer data sits, on whose systems, and whether a dossier has been filed for each of those flows? If the answer is “not sure”, this is where to start.
5 steps to review cloud and SaaS data flows:
- List every cloud service, SaaS tool and foreign server that departments use and that holds personal data.
- Identify the country of storage, the types of data and the data subjects (customers, employees, candidates).
- Check the exempt cases under Law 91 and Article 17 of Decree 356.
- Collect contracts, DPAs and policies; prepare the report on Form No. 09.
- File the dossier with Form No. 01a/01b and set an update schedule under Article 20.
When building the list, do not ask only the IT team. Marketing, recruitment and accounting tools are often signed up for by departments themselves and are not on the official list of systems. If the business must also prepare a personal data processing impact assessment (DPIA) dossier (Form No. 10, Article 19, Decree 356), prepare both at the same time so the information in the two dossiers is consistent.
Start with a current-state assessment session: list the systems, identify which flows need a dossier and which are exempt, and give priority to flows that have been running for more than 60 days. This gives the business a clear roadmap instead of a generic dossier for its whole infrastructure.
7. Frequently asked questions
Is “CTIA” the official name of the procedure?
No. “CTIA” is a common name. The name used in legal instruments is the cross-border personal data transfer impact assessment dossier; the report is prepared on Form No. 09 issued with Decree No. 356/2025/ND-CP. When dealing with the authorities, businesses should use the official name.
If we only use Google Workspace or Microsoft 365 for internal email, do we need a dossier?
Law No. 91/2025/QH15 exempts an organisation from preparing a dossier when it stores personal data of its own employees on cloud computing services. However, if the system also holds data of customers, candidates or individual partners, that data needs a separate assessment.
What is the deadline for filing the Form No. 09 dossier?
Within 60 days from the date the cross-border personal data transfer starts, the business sends 1 original of the dossier to the competent personal data protection authority (Department A05, Ministry of Public Security) with a cover document on Form No. 01a or 01b, online, in person or by post.
Do we need to update the dossier if we change cloud provider or add a new SaaS tool?
Check Article 20 of Decree 356: the dossier is updated every 6 months when there are changes such as a new purpose or a change of data controller, and within 10 days for certain changes such as a reorganisation of the business. A new data transfer flow usually needs to be assessed and added to the dossier.
What is the fine for not preparing a dossier?
Law No. 91/2025/QH15 sets the maximum fine for breaching the rules on cross-border data transfers at 5% of the organisation’s revenue in the preceding year, or up to VND 3 billion if it has no revenue or the revenue-based amount is lower. The specific fine for each act is set by the decree on penalties.
Is a dossier filed under Decree 13/2023 still valid?
Decree No. 13/2023/ND-CP was replaced by Decree No. 356/2025/ND-CP from 1 January 2026. Businesses should review their old dossiers against the new forms and requirements, especially the system diagram and risk assessment, and update them under Article 20 if there have been changes.
8. Legal basis and references
- Law on Personal Data Protection, Law No. 91/2025/QH15, passed by the National Assembly on 26 June 2025, in force from 1 January 2026 (Articles 8 and 20).
- Decree No. 356/2025/ND-CP dated 31 December 2025 detailing certain articles of and measures to implement the Law on Personal Data Protection, in force from 1 January 2026, replacing Decree No. 13/2023/ND-CP (Articles 17, 18, 19, 20 and 41; Forms No. 01a/01b, 03a/03b, 09 and 10).
- Resolution No. 22/2026/NQ-CP dated 29 April 2026 on cutting and simplifying administrative procedures under the Ministry of Public Security relating to personal data (as reported in Vietnam Lawyers Magazine, Tạp chí Luật sư Việt Nam).
- EY Vietnam, legal alerts on the Law on Personal Data Protection (July 2025) and on Decree No. 356/2025/ND-CP.
- Legal texts consulted on thuvienphapluat.vn and luatvietnam.vn.
Review your personal data compliance with an FC Legal lawyer
Find out what data your business processes, where it is, which risks to deal with first, and which documents you need to prepare.
- Data map and compliance gap assessment
- Impact assessment (DPIA) and cross-border transfer dossiers
- Policies, vendor contracts and incident response procedures
Please do not send confidential documents or personal data through the form.
This article is for reference and reflects the rules in force at the time of publication. For a legal opinion on a specific case, please contact an FC Legal lawyer.
Prepared by the FC Legal legal team and reviewed by FC Legal’s Managing Lawyer. Updated 4 October 2026.
