Preparing a DPIA (Data Protection Impact Assessment) dossier for submission to regulatory authorities is one of the mandatory legal obligations that enterprises must fulfill since the Personal Data Protection Law No. 91/2025/QH15 took effect on January 1, 2026. However, reality shows that many organizations are still confused and make serious mistakes during the drafting and submission process, leading to dossiers being returned, failing to meet regulatory requirements, or posing potential legal risks. The following article analyzes the 7 most common mistakes when preparing DPIA dossiers for submission to regulatory authorities and provides remedies based on current legal regulations.
LEGAL BASIS
– Personal Data Protection Law No. 91/2025/QH15 dated June 26, 2025, of the National Assembly of the Socialist Republic of Vietnam (effective from January 1, 2026);
– Decree No. 356/2025/ND-CP detailing a number of articles and measures for the implementation of the Personal Data Protection Law.
I. OVERVIEW OF DPIA DOSSIERS AND SUBMISSION OBLIGATIONS TO REGULATORY AUTHORITIES
1.1. What is a DPIA dossier and who must prepare it?
Data Protection Impact Assessment (abbreviated as DPIA) is an assessment process aimed at identifying, analyzing, and mitigating risks arising from personal data processing activities. According to Clause 12, Article 2 of the Law on Personal Data Protection 2025 (Law No. 91/2025/QH15), a personal data processing impact assessment is the analysis and evaluation of risks that may occur during personal data processing in order to apply risk mitigation measures and protect personal data. In other words, a DPIA is a systematic assessment process focused on identifying and addressing actual risks that data processing activities may pose to the legitimate rights and interests of individuals.
According to the provisions of the Law on Personal Data Protection 2025, all organizations processing personal data are obligated to prepare a Personal Data Processing Impact Assessment (DPIA) dossier, except for a few exemptions, specifically small enterprises, startups, business households, and micro-enterprises when meeting certain conditions specified by the Law.
1.2. Deadline for submitting DPIA dossiers
According to Article 25 of the Law on Personal Data Protection 2025, DPIA dossiers must be submitted to the specialized personal data protection authority (Department of Cybersecurity and High-Tech Crime Prevention – Department A05, Ministry of Public Security) within 60 days from the commencement of personal data processing. In addition, the dossier must be updated periodically every 06 months and must be updated immediately upon significant changes in purpose, scope, data types, or data processors.
II. 7 COMMON MISTAKES WHEN PREPARING DPIA DOSSIERS FOR SUBMISSION TO REGULATORY AUTHORITIES
2.1. Mistake 1: Not clearly defining retention periods and deletion mechanisms
An extremely serious omission that frequently appears in dossiers is the absence of policies regarding retention periods and data deletion mechanisms. Many companies still maintain the habit of collecting user information and storing it indefinitely on servers in the hope of reusing it for future business campaigns. This practice directly violates the principles of purpose limitation and storage minimization, which are strictly regulated in current decrees on personal data protection. A personal data processing impact assessment dossier must explicitly specify the time duration information is allowed to exist on the system after the customer stops using the service. Accompanying this, the organization must describe in detail the technical workflow to securely delete or anonymize data beyond recovery to absolutely protect user rights.
2.2. Mistake 2: Using outdated templates under Decree 13/2023/ND-CP
From January 1, 2026, Decree 356/2025/ND-CP has completely replaced Decree 13/2023/ND-CP and standardized a new system of templates. Specifically, domestic DPIA dossiers use Form No. 10 issued under Decree 356/2025/ND-CP, completely replacing Form No. 04 and Form No. 05 of the old Decree. Many businesses continue to use the old forms due to a lack of timely updates, resulting in their DPIA dossiers being rejected. For dossiers submitted under Decree 13/2023/ND-CP before January 1, 2026, businesses need to review, update, and supplement them in accordance with the new requirements, particularly sections related to risk assessment and protection measures for sensitive data.
2.3. Mistake 3: Omitting mandatory information in the DPIA dossier
A DPIA dossier lacking mandatory content will not meet regulatory requirements. According to Article 19 of Decree 356/2025/ND-CP, the Data Controller’s DPIA dossier must include at least the following contents:
- Information and contact details of the controller;
- Full name and contact details of the organization assigned to perform data protection officer (DPO) duties;
- The purpose and legal basis for processing;
- Types of personal data being processed;
- Processing duration and expected timeline for data erasure or destruction;
- Data protection measures currently applied; and
- Evaluation of unintended consequences and damages, along with risk mitigation measures.
Omitting any of these items can result in the DPIA dossier being requested for supplements or returned by competent authorities.
2.4. Mistake 4: Superficial and unrealistic risk assessment
During the era of Decree 13/2023/ND-CP, many businesses viewed preparing DPIA dossiers primarily as a formal administrative procedure. The Law on Personal Data Protection 2025 has repositioned DPIA as a substantive risk management process, requiring businesses to specifically and honestly describe potential unintended consequences and damages, along with corresponding risk mitigation or elimination measures. General statements such as “security measures are applied” or “no significant risks” without specific content may cause the DPIA dossier to be evaluated as non-compliant. Businesses need to genuinely invest in identifying real risk scenarios such as data leaks, unauthorized access, or processing beyond the permitted purpose.
2.5. Mistake 5: Submitting DPIA dossiers late or not knowing the starting point of the deadline
Many businesses are unaware that the 60-day deadline for submitting DPIA dossiers is calculated from the time personal data processing begins, meaning from when the business collects the very first piece of data, not from when the business is incorporated or when a contract is signed with a customer. According to Article 25 of the Law on Personal Data Protection 2025, late submission of DPIA dossiers is a violation of the law that may be penalized. Delays in submitting DPIA dossiers not only create administrative fine risks but also affect the legal credibility of the business in the event of audits or inspections.
2.6. Mistake 6: Failing to update the DPIA dossier when changes occur
After the initial submission of the DPIA dossier, many businesses view this as a “one-off” task and do not perform updates. This is a serious mistake. According to Clause 2, Article 22 of the Law on Personal Data Protection 2025, DPIA dossiers must be updated periodically every 06 months from the date of the first submission, and must also be updated immediately upon major changes regarding: processing purposes; types of personal data processed; storage duration; changes in data processors; or changes in information regarding the data protection department/personnel (DPO). The updates to the DPIA dossier must be carried out using the corresponding forms specified in Decree 356/2025/ND-CP and submitted to the specialized authority following the proper procedure.
2.7. Mistake 7: Not ensuring that the DPIA dossier is always ready for regulatory inspection
In addition to the obligation to submit DPIA dossiers to the regulatory authority, businesses must ensure that their DPIA dossiers are always ready to serve inspection and examination activities by Department A05 – Ministry of Public Security. According to Article 19 of Decree 356/2025/ND-CP, dossiers must be available for presentation upon inspection requests at any time. A common mistake is that businesses only maintain DPIA dossiers as internal drafts that have not been officially approved or lack the signature and confirmation of an authorized representative. Furthermore, businesses should note that under Decree 356/2025/ND-CP, Department A05 has the authority to evaluate and return results for DPIA dossiers within 15 days – this requires dossiers to be complete and accurate from the start to avoid requests for finalization.
III. FREQUENTLY ASKED QUESTIONS ABOUT DPIA DOSSIERS
Do small businesses have to submit DPIA dossiers?
According to the Law on Personal Data Protection 2025 and Decree 356/2025/ND-CP, there is no regulation providing a total exemption from the obligation to prepare DPIA dossiers for small businesses. However, the Decree provides guidance on simplifying the impact assessment process for small-scale enterprises that process minimal sensitive data.
Do DPIA dossiers submitted under Decree 13/2023/ND-CP need to be redone?
Yes. According to transitional provisions, DPIA dossiers submitted under Decree 13/2023/ND-CP need to be reviewed, updated, and supplemented according to the new templates and requirements of Decree 356/2025/ND-CP, particularly sections related to risk assessment and protection measures for sensitive data.
What is the fine for violations related to DPIA dossiers?
According to Article 8 of the Law on Personal Data Protection 2025, monetary fines can be up to 3 billion VND for data protection violations. For cross-border data transfer violations, the fine can be up to 5% of the total revenue of the immediate preceding financial year.
In what form are DPIA dossiers submitted?
Enterprises can submit DPIA dossiers via two methods: online through the National Portal on Personal Data Protection once the system becomes operational, or directly/via postal services to Department A05 – Ministry of Public Security.
CONCLUSION
Preparing a DPIA dossier for submission to regulatory authorities is a mandatory and critical legal obligation under the Personal Data Protection Law No. 91/2025/QH15 and Decree 356/2025/ND-CP. Understanding and avoiding the 7 common mistakes mentioned above will help businesses build standard-compliant DPIA dossiers, mitigate legal risks, and demonstrate a serious commitment to personal data protection. Businesses should proactively review and update their DPIA dossiers periodically and consult legal experts when necessary to ensure continuous compliance with current legal regulations.
