DPIA UNDER VIETNAMESE LAW AND GDPR STANDARDS: WHICH LEVEL SHOULD BUSINESSES APPLY?

Data Protection Impact Assessment (DPIA) is becoming one of the most urgent legal obligations for businesses operating in Vietnam. Since the Personal Data Protection Law 2025 (Law No. 91/2025/QH15) officially took effect on January 1, 2026, the most frequently asked question is: between DPIA requirements under Vietnamese law and European Union’s GDPR standards, to what extent should businesses apply them to both comply with domestic laws and meet international standards? This article provides a comparative analysis of DPIA regulations between Vietnamese law (including No. 356/2025/ND-CP and the Personal Data Protection Law 2025) and the GDPR, thereby offering practical recommendations to help businesses determine the appropriate level of application.

LEGAL BASES

• Personal Data Protection Law 2025 (Law No. 91/2025/QH15).
• Decree No. 356/2025/ND-CP guiding the Law on Personal Data Protection. 
• General Data Protection Regulation of the European Union (GDPR, EU 2016/679).

I. WHAT IS DPIA AND WHY SHOULD BUSINESSES CARE?

A DPIA is a process that organizations and businesses undertake to identify and mitigate privacy risks when processing personal data, especially for activities that carry a high risk of affecting the data subjects’ legitimate rights and interests. Simply put, this is a self-prepared “security commitment” in which the business must explain: the types of data it holds, the purpose of processing, the potential risks if the data is leaked, and the protective measures implemented.

In the context of the digital economy and international integration, a DPIA is not only a legal obligation but also a strategic risk management tool. Any business processing the personal data of customers, employees, or partners—ranging from contact information to financial and biometric data—needs a clear DPIA process to protect itself against increasingly strict sanctions.

II. LEGAL FRAMEWORK ON DATA PROTECTION UNDER VIETNAMESE LAW AND GDPR

2.1. DPIA under Vietnamese law

The Personal Data Protection Law 2025 has repositioned the DPIA from an administrative procedure to a dynamic and highly legally binding risk management process. Below are the core regulations:

a) Scope of application

A DPIA dossier is mandatory for all organizations engaged in personal data processing activities. Only a few exceptions are exempted, specifically small enterprises, startups, business households, and micro-enterprises, provided they meet certain conditions specified by the Law. Notably, these businesses enjoy a transition period of up to 5 years to comply.

b) Deadline for preparation and submission

According to Article 25 of the Personal Data Protection Law 2025, businesses must prepare a DPIA dossier and submit the original version to the Department of Cybersecurity and High-Tech Crime Prevention (A05) under the Ministry of Public Security within 60 days from the date data processing begins. This is a strict deadline with no standard extension mechanism.

c) Periodic update obligations

Clause 1, Article 22 of the Personal Data Protection Law 2025 stipulates: The personal data processing impact assessment dossier must be updated every 6 months when changes occur. Additionally, businesses must update the dossier immediately (within 10 days) upon the occurrence of major events such as mergers and acquisitions (M&A), dissolution, or a change in data protection service providers.

d) Sanctions for violations

Violations of personal data protection regulations, including DPIA obligations, can result in administrative fines of up to 3 billion VND or 5% of the total revenue of the immediate preceding financial year in Vietnam for serious or repeated violations. Furthermore, businesses may face a suspension of data processing activities for 1 to 3 months, revocation of business licenses, and public disclosure of the violating company’s name on mass media.

2.2. DPIA under GDPR – Risk-based approach

The GDPR regulates DPIA under Article 35 using a risk-based approach. Accordingly, businesses are only required to conduct a DPIA when data processing activities are likely to result in a high risk to the rights and freedoms of individuals. Typical cases include: large-scale processing of sensitive data, systematic monitoring of public areas, or systematic evaluation/scoring of individuals.

Article 35 of the GDPR emphasizes a core philosophy: data risks must be managed upfront rather than penalizing violations after they occur. This serves as an accountability mechanism that forces businesses to take responsibility. The GDPR does not require submitting a DPIA to government authorities in all cases; instead, businesses primarily maintain it internally to present upon request by supervisory authorities.

2.3. Key differences between DPIA under Vietnamese law and GDPR

The comparison between the two legal frameworks highlights the following notable differences:

III. WHAT LEVEL OF DPIA SHOULD BUSINESSES APPLY?

3.1. Minimum compliance level under Vietnamese law

For businesses operating solely within the territory of Vietnam with no customers or partners who are EU citizens, the minimum level of compliance required is full adherence to the regulations of the Personal Data Protection Law 2025 and its guiding Decrees. This includes: preparing a DPIA dossier within 60 days from the start of data processing, updating it every 6 months, and appointing a Data Protection Officer (DPO) if conditions are met. The DPIA dossier must clearly state: types of personal data being processed, purposes of processing, risk assessment, and technical/organizational measures currently applied.

3.2. Application level under GDPR standards

Vietnamese businesses should consider applying GDPR standards when they fall into one of the following cases:

1. Having customers who are EU citizens or residents;
2. Operating websites/applications that collect data from EU users (including via cookies);
3. Having foreign partners or investors who require GDPR compliance;
4. Having plans to expand into international markets.

When applying GDPR standards, businesses conduct DPIAs based on the risk-based approach: focusing on high-risk processing activities (sensitive data, credit scoring, biometric identification, large-scale behavioral monitoring) instead of applying it uniformly to all processing operations. Although this approach requires higher investment in human resources and expertise, it helps businesses manage risks more effectively and facilitates smoother contract signings with international partners.

3.3. Practical recommendations for Vietnamese businesses

Based on current regulations and international practices, Vietnamese businesses should implement DPIAs according to the following roadmap:

• Step 1 – Data Mapping: Review and create a complete inventory of all types of personal data being processed, classifying them by sensitivity level under the Personal Data Protection Law 2025 (basic data vs. sensitive data such as health, biometrics, finance, and political opinions).
• Step 2 – Risk Threshold Assessment: Identify which processing activities carry high risks (processing sensitive data, large-scale processing, automated systems) to prioritize in-depth DPIAs following the GDPR risk-based approach.
• Step 3 – Prepare and Submit DPIA Dossier on Time: Draft the dossier according to the 10 forms standardized by Decree 356/2025/ND-CP and submit it to the specialized authority (A05) within 60 days.
• Step 4 – Establish an Update Process: Build an internal mechanism for review every 06 months and a protocol to immediately update the dossier when major changes occur (M&A, change in processing purposes, or change in service providers).
• Step 5 – Appoint a DPO and Provide Training: Appoint a qualified Data Protection Officer (DPO) who meets competency requirements, or outsource to legal experts if the business lacks qualified internal personnel.

IV. FREQUENTLY ASKED QUESTIONS ABOUT DPIA

Are small businesses mandatory required to perform a DPIA?

Under the Personal Data Protection Law 2025, small enterprises, startups, business households, and micro-enterprises are exempted from DPIA obligations provided they meet certain criteria, and they have a transition period of up to 5 years to fully comply. However, small businesses should seek legal consultation to accurately determine their exemption eligibility.

If a DPIA has been completed under Vietnamese law, is it necessary to conduct another one under GDPR?

If a business processes the data of EU citizens, it must, in principle, comply with both legal systems. However, a DPIA dossier built to GDPR standards (detailed, risk-based) typically already satisfies the content requirements of Vietnamese law. The business would only need to fulfill the additional procedural requirement of submitting the dossier to A05 as regulated.

CONCLUSION

A DPIA is no longer optional but has become a mandatory legal obligation for most businesses processing personal data in Vietnam under the Personal Data Protection Law 2025. Compared to GDPR standards, Vietnamese law features a broader scope of application (requiring a DPIA for all data processing organizations instead of only high-risk processing as in the GDPR) but offers a simpler consultation process with supervisory authorities.

For Vietnamese businesses, the optimal strategy is full compliance with the Personal Data Protection Law 2025 as the mandatory baseline, while proactively adopting best practices from the GDPR (especially the risk-based approach and the concept of Privacy by Design) to enhance competitiveness and ready themselves for the international market. This serves as both a strict legal requirement and a strategic investment that helps businesses build trust, protect customer data, and avoid significant financial sanctions.