From 1 January 2026, the Law on Personal Data Protection (Law No. 91/2025/QH15) and Decree No. 356/2025/ND-CP are in force. They replace the legal framework under Decree No. 13/2023/ND-CP. Many businesses already have a privacy policy, consent forms and an impact assessment dossier, but do not know how far these still meet the new requirements. This article sets out a 20-point personal data compliance check, divided into 6 pillars: consent, impact assessment dossiers, cross-border data transfers, HR data, third parties and incident response. Each point comes with a self-check question, the evidence you should have and a scoring matrix, to help the Board of Directors decide what to fix first.
- From 1 January 2026, a personal data compliance check must be measured against the Law on Personal Data Protection (Law No. 91/2025/QH15) and Decree No. 356/2025/ND-CP (which replaces Decree No. 13/2023/ND-CP).
- The Legal Health Check has 20 checkpoints in 6 pillars: consent, impact assessment dossiers, cross-border data transfers, HR data, third parties and incident response.
- The processing impact assessment dossier (Form No. 10) and the cross-border transfer dossier (Form No. 09) must be prepared within 60 days from the date processing or the transfer starts.
- Law No. 91/2025/QH15 sets maximum fines of VND 3 billion, 5% of the previous year’s revenue (cross-border transfers) or 10 times the revenue obtained (buying or selling data). The fine for each act is set in the regulations on penalties.
- Each point is scored 0/2/5 based on real evidence, not on impressions. A 0 on the dossier and incident items should be dealt with first, whatever the total score.
1. How is a personal data Legal Health Check different from an ordinary checklist?
A self-assessment checklist answers the question “what is missing?”. A Legal Health Check goes one step further. Each checkpoint is tied to specific evidence (documents, forms, system logs, dossiers already prepared) and is scored so that remediation can be prioritised.
If you are just starting, read first “Personal data protection checklist for businesses: what is your business missing?” and “10 common personal data protection risks”. This article is for the next step.
The legal framework from 1 January 2026
- Law on Personal Data Protection (Law No. 91/2025/QH15): passed by the National Assembly on 26 June 2025, in force from 1 January 2026.
- Decree No. 356/2025/ND-CP dated 31 December 2025, detailing certain articles of and measures to implement the Law. In force from 1 January 2026; it replaces Decree No. 13/2023/ND-CP (Article 42).
- Article 8 of Law No. 91/2025/QH15 sets the maximum fines for organisations: for buying or selling personal data, up to 10 times the revenue obtained from the violation; for violating the rules on cross-border personal data transfers, up to 5% of the revenue of the immediately preceding year; for other acts, up to VND 3 billion. If there is no such revenue, or the calculated amount is lower, the maximum of VND 3 billion applies. The maximum for individuals is half that for organisations.
- The specialised personal data protection authority is the Department of Cybersecurity and High-Tech Crime Prevention (A05), Ministry of Public Security.
Analysis: Many internal documents prepared under Decree No. 13/2023/ND-CP are still in use unchanged. The first step in a personal data compliance check is to find which documents still refer to the old regulations. The fines above are maximum amounts. The fine for each specific act is set by the regulations on penalties, so do not use the maximum figure to estimate the risk of every violation.
2. Pillar 1: Consent and data subjects’ rights (points 1–3)
Consent must be clear and verifiable
Under Decree No. 356/2025/ND-CP, the data subject’s consent must be clear and verifiable. Consent must not be assumed by default or presented in a misleading way.
| Checkpoint | Self-check question | Evidence you should have |
|---|---|---|
| 1. Active consent mechanism | Do your forms, website or app use pre-ticked boxes, or treat continued use as consent? | Screenshots of the interface; a data processing notice separate from the general terms of use |
| 2. Separate processing purposes | Can a customer consent to the service purpose but refuse marketing or sharing with partners? | A list of processing purposes; a separate choice for each optional purpose |
| 3. Withdrawal of consent and data subject requests | Is there a channel for requests to withdraw consent, access, correct or delete data, and a person responsible for handling them? Can you record the time and the version of the text the customer consented to? | A request handling procedure; a request log; a consent audit trail |
Record consent by version. Each time you change the policy or the notice, give it a new version number and record which version each customer consented to. For data subject requests, set internal deadlines shorter than the legal deadlines, so there is time to verify and coordinate between departments.
3. Pillar 2: Impact assessment dossiers and data protection personnel (points 4–7)
The personal data processing impact assessment dossier
- Article 19 of Decree No. 356/2025/ND-CP: the personal data processing impact assessment dossier consists of the report on Form No. 10, sent with Form No. 02a/02b, within 60 days from the date personal data processing starts.
- Article 20: the dossier must be updated when there are changes, as provided in the Decree.
- Article 13: personal data protection personnel must have a college degree or higher, at least 2 years of experience in a relevant field (legal, IT, cybersecurity, data security, risk management, compliance, HR management, personnel organisation) and training in personal data protection.
- Article 41: micro businesses and household businesses are exempt from certain obligations (preparing the impact assessment, appointing personal data protection personnel or a department). Small businesses and start-ups may choose, or are exempt, for 5 years from 1 January 2026. This does not apply where they directly provide personal data processing services, process sensitive data, or process the data of a large number of data subjects.
| Checkpoint | Self-check question | Evidence you should have |
|---|---|---|
| 4. Dossier on the new form | Has the impact assessment dossier been prepared on Form No. 10 of Decree 356, or is it still on the old form? | The impact assessment report; the cover letter on the prescribed form |
| 5. The 60-day deadline | When did the processing start, and was the dossier prepared and sent within 60 days? | System go-live dates; proof that the dossier was sent |
| 6. Updates after changes | When you replace a CRM/ERP system, add a processing purpose or change processor, is there a procedure to review the dossier again? | Rules on updating the dossier; a list of recorded changes |
| 7. Data protection personnel or department | Is the business exempt? If not, has it appointed personnel who meet the conditions? | The appointment decision; CV and training certificates |
Analysis: The common mistake is not “having no dossier”. It is a dossier prepared once and then left unchanged. The impact assessment dossier describes the actual processing. When systems, purposes or partners change but the dossier does not, the business will find it hard to explain itself during an inspection. Also, the exemption in Article 41 has exceptions. A small business that processes sensitive data (for example facial recognition attendance) should check carefully before concluding that it is exempt.
Link the review of the impact assessment dossier to the approval process for technology projects. Do not put a new system into operation until Legal or the data protection personnel have given their view on updating the dossier.
4. Pillar 3: Cross-border personal data transfers (points 8–10)
The cross-border transfer impact assessment dossier
- Article 18 of Decree No. 356/2025/ND-CP: the dossier consists of the report on Form No. 09. One original is sent (online, in person or by post) to the specialised personal data protection authority with Form No. 01a/01b, within 60 days from the date the transfer starts.
- The Decree lists some cases where no dossier is required (Article 17).
| Checkpoint | Self-check question | Evidence you should have |
|---|---|---|
| 8. Data flow map | Where are customer and HR data stored, accessed or sent, including through cloud services, SaaS software or a parent company abroad? | A data flow diagram; a list of vendors and processing locations |
| 9. Cases that require a dossier | Has each transfer flow been assessed as requiring a dossier or as exempt? Is there a Form No. 09 dossier? | A data flow classification table; the report on Form No. 09 |
| 10. Binding the recipient | Does the contract with the recipient abroad cover the purpose, security, cooperation in case of incidents and support for data subjects’ rights? | A data protection contract or annex with the recipient |
Analysis: Many businesses do not think they “transfer data abroad” because they do not send files to anyone. But using infrastructure or software run by a foreign provider, or reporting HR data to the parent group, needs to be assessed case by case. Because the maximum fine for this group of violations is based on revenue (Article 8 of Law No. 91/2025/QH15), FDI companies and businesses using many international services should give this pillar priority.
Start from the Accounting department’s list of monthly payments for software and services. This is often the fastest way to find foreign services that process data without Legal knowing.
FC Legal can review the actual evidence for each point with you and set the order of priorities for remediation.
5. Pillar 4: HR and employee data (points 11–14)
Sensitive data and privacy
- Article 4 of Decree No. 356/2025/ND-CP sets out the list of sensitive personal data, including biometric data, health data and location data.
- Article 38 of the Civil Code 2015: private life, personal secrets and family secrets are inviolable and protected by law.
| Checkpoint | Self-check question | Evidence you should have |
|---|---|---|
| 11. Employee consent | Does the employment contract contain only one general sentence such as “agrees that the company may process all information”? Are the processing purposes listed specifically? | A separate notice or consent document for HR data processing, or a separate annex |
| 12. Job applicant data | How long are the files of unsuccessful applicants kept, who can access them, and are applicants informed? | A notice on the recruitment page; rules on retention periods and deletion |
| 13. Biometric and health data | Are fingerprint or facial recognition attendance and health checks recognised as sensitive data, and is there an alternative if an employee does not consent? | A separate notice on sensitive data; security measures; an alternative attendance method |
| 14. Monitoring and retention | Are there published rules for cameras and computer monitoring software? How are the files of former employees handled? | Monitoring rules; a data retention schedule |
Analysis: HR data is often seen as an internal matter, yet the HR department holds a large share of the sensitive data. More detail is in the articles “Employees’ personal data” and “Facial recognition attendance and personal data protection”.
Prepare a retention schedule for each group of HR records (applicants, current staff, former staff). Separate what the law requires you to keep from what the business decides itself. For the part the business decides, there should be a clear reason and a clear deletion date.
6. Pillar 5: Partners, vendors and data processors (points 15–17)
| Checkpoint | Self-check question | Evidence you should have |
|---|---|---|
| 15. Roles of the parties | In each contract, which party decides the purposes and means of processing (data controller), and which only processes on instructions (data processor)? | Contracts stating the roles clearly; a list of partners with access to data |
| 16. Data protection clauses | Do contracts with payroll, logistics, call centre and marketing providers have specific clauses on personal data processing, or only a general confidentiality clause? | A data processing agreement or annex (DPA) |
| 17. Due diligence and audit rights | Does the business assess a vendor’s security capability before handing over data, and does it have the right to request reports and to audit? | A due diligence questionnaire; an audit clause; the vendor’s information security certificates (if any) |
Analysis: When data leaks from a vendor’s system, the business that handed over the data usually still has to explain itself to the authorities and to customers. A contract cannot remove liability under the law, but it does allocate between the parties the duties to cooperate, to notify incidents and to indemnify.
Review first the contracts with vendors that access large volumes of data or sensitive data (payroll, insurance, call centres, CRM platforms). Then standardise a template data processing annex for new contracts.
7. Pillar 6: Incident response and 72-hour notification (points 18–20)
Deadlines for breach notification
- Law No. 91/2025/QH15 requires notification of violations of personal data protection rules to the specialised authority within 72 hours.
- Decree No. 356/2025/ND-CP sets a deadline of no more than 72 hours for certain notification duties, including notification when sensitive data is disclosed or lost (Clause 3, Article 8) and notification to the affected data subjects (Clause 2, Article 29).
| Checkpoint | Self-check question | Evidence you should have |
|---|---|---|
| 18. Incident response procedure | Is there a written rule on who detects, who decides and who contacts the authorities when data leaks? | An incident response procedure; a list of contact persons and numbers |
| 19. Notifying the specialised authority | Does the procedure track the 72-hour deadline and allow an initial notice before the internal investigation is complete? | A prepared notification template; an incident log |
| 20. Notifying data subjects | Is there a template notice for affected customers or employees, stating the scope of the data, the measures taken and advice on self-protection? | A template notice to data subjects; a channel for sending it |
Minimum incident handling framework:
- Detect the incident and record the time.
- Contain it and limit the damage.
- Assess the type and scope of the affected data.
- Notify the specialised authority within 72 hours.
- Notify the affected data subjects.
- Remediate and learn lessons.
Run regular simulated incidents with IT, Legal, Communications and the Board of Directors, to measure how long it actually takes for incident information to reach the person with authority to decide on notification.
8. Legal Health Check self-scoring matrix
Score each point on this scale: 5 points, done and backed by evidence; 2 points, started but not complete, or evidence not complete; 0 points, not done. The maximum total is 100 points. The “Priority” column is FC Legal’s practical assessment for ordering remediation. It is not a classification under the law.
| Pillar | Checkpoint | Priority | Score (0/2/5) |
|---|---|---|---|
| Consent | 1. Active consent mechanism | High | … |
| Consent | 2. Separate processing purposes | Medium | … |
| Consent | 3. Withdrawal of consent, data subject requests, audit trail | High | … |
| Impact assessment dossier | 4. Dossier on Form No. 10 | Very high | … |
| Impact assessment dossier | 5. The 60-day deadline | Very high | … |
| Impact assessment dossier | 6. Updates after changes | Medium | … |
| Impact assessment dossier | 7. Data protection personnel or department | High | … |
| Cross-border | 8. Data flow map | Very high | … |
| Cross-border | 9. Form No. 09 dossier | Very high | … |
| Cross-border | 10. Binding the recipient | High | … |
| HR | 11. Employee consent | Medium | … |
| HR | 12. Job applicant data | Medium | … |
| HR | 13. Biometric and health data | High | … |
| HR | 14. Monitoring and retention | Medium | … |
| Third parties | 15. Roles of the parties | Medium | … |
| Third parties | 16. Data protection clauses | High | … |
| Third parties | 17. Due diligence and audit rights | Medium | … |
| Incidents | 18. Incident response procedure | Very high | … |
| Incidents | 19. Notifying the specialised authority within 72 hours | Very high | … |
| Incidents | 20. Notifying data subjects | High | … |
| Total | 20 checkpoints | …/100 |
| Total score | What it means | What to do |
|---|---|---|
| Below 50 | Many foundations are missing; hard to explain yourself during an inspection | Make a remediation plan now, starting with the “Very high” priority points scored 0 |
| 50–79 | Policies exist but are not aligned with actual operations | Add evidence; review third-party contracts and data flows abroad |
| 80–100 | The foundations are fairly complete | Keep reviewing regularly and whenever systems, the business model or the regulations change |
A high total score does not mean you are safe
A 0 on the impact assessment dossier, cross-border transfers or incident notification can matter more than several 5s on other points. The matrix is an internal tool for setting priorities. It does not replace a legal opinion on a specific case.
9. Where should a business start its Legal Health Check?
- Appoint one lead person (Legal or the data protection personnel).
- Inventory the data and data flows in each department.
- Score the 20 points yourself, with evidence for each point.
- Identify the points scored 0 in the “Very high” priority group.
- Make a remediation plan with a person in charge and a deadline.
- Review again periodically or when something changes.
Analysis: Do the scoring together with IT, HR, Marketing/Sales and Accounting. Each department knows part of the data flows. When one person scores alone, the result is usually higher than reality.
You do not need to fix all 20 points at once. Pick the 3 to 5 highest-priority points, finish them in a short cycle, then score again. When you need an independent assessment, have a lawyer review the evidence instead of relying only on yes/no answers.
10. Frequently asked questions
Is Decree No. 13/2023/ND-CP still in force?
No. From 1 January 2026, Decree No. 356/2025/ND-CP is in force and replaces Decree No. 13/2023/ND-CP, at the same time as the Law on Personal Data Protection (Law No. 91/2025/QH15) takes effect. Businesses should review the policies, forms and impact assessment dossiers prepared under the old rules and update them to the new framework.
Does a small business have to cover all 20 checkpoints?
Not every point is mandatory for every business. Under Article 41 of Decree No. 356/2025/ND-CP, micro businesses, small businesses and start-ups may be exempt from certain obligations, such as preparing the impact assessment and appointing data protection personnel, unless they process sensitive data, process the data of a large number of data subjects or provide data processing services. The points on consent and incident response still need to be considered.
What is the deadline for preparing the impact assessment dossier?
Under Decree No. 356/2025/ND-CP, both the personal data processing impact assessment dossier (Form No. 10) and the cross-border personal data transfer impact assessment dossier (Form No. 09) have a 60-day deadline, counted from the date processing or the transfer starts.
Does the 5% of revenue fine apply to every violation?
No. Under Article 8 of Law No. 91/2025/QH15, the maximum of 5% of the immediately preceding year’s revenue applies to violations of the rules on cross-border personal data transfers. Buying or selling data has a maximum of 10 times the revenue obtained. Other violations have a maximum of VND 3 billion. The fine for each act is set in the regulations on penalties.
How often should a Legal Health Check be done?
The law does not set a frequency for this self-scoring. In practice, do it at least once a year, and again when the business introduces a new system, changes a data processing vendor, expands its operations abroad, or when new legislation is issued.
11. Legal basis and references
- Law on Personal Data Protection (Law No. 91/2025/QH15), passed on 26 June 2025, in force from 1 January 2026.
- Decree No. 356/2025/ND-CP dated 31 December 2025 detailing certain articles of and measures to implement the Law on Personal Data Protection (replacing Decree No. 13/2023/ND-CP).
- Civil Code 2015, Article 38 on the right to private life, personal secrets and family secrets.
- Law on Cybersecurity 2018 (No. 24/2018/QH14).
- References: luatvietnam.vn, thuvienphapluat.vn, EY Vietnam (summaries of Law No. 91/2025/QH15 and Decree No. 356/2025/ND-CP).
Review your personal data compliance with an FC Legal lawyer
Find out what data your business processes, where it is held, which risks to deal with first and which dossiers you must prepare.
- Data map and compliance gap assessment
- Drafting the impact assessment dossiers (DPIA) and the cross-border data transfer dossier
- Standardising policies, vendor contracts and the incident response procedure
Please do not send confidential documents or personal data through the form.
This article is for reference. It reflects the regulations in force at the time of publication. For a legal opinion on a specific case, please contact an FC Legal lawyer.
Prepared by the FC Legal legal team and reviewed by FC Legal’s managing lawyer. Updated 4 October 2026.
