In the context of deepening digital economic integration, many businesses and organizations in Vietnam have a growing need to transfer personal data abroad to support business operations, system management, or international cooperation. However, the cross-border transfer of personal data is currently subject to strict regulation under Vietnamese law, particularly Decree 13/2023/NĐ-CP on personal data protection and the Personal Data Protection Law 2025. Failure to follow the correct procedures may result in severe penalties. This article analyzes the concept, procedures, and key considerations when conducting cross-border personal data transfers in accordance with current regulations. Personal Data Transfer Abroad Impact Assessment Dossier
LEGAL BASIS
- Personal Data Protection Law No. 91/2025/QH15, dated June 26, 2025, issued by the National Assembly of the Socialist Republic of Vietnam (effective January 1, 2026);
- Decree No. 356/2025/NĐ-CP detailing a number of articles and measures for implementing the Personal Data Protection Law;
I. WHAT IS CROSS-BORDER PERSONAL DATA TRANSFER?
Under Clause 14, Article 2 of Decree 13/2023, “cross-border personal data transfer is the act of using cyberspace, electronic devices, equipment, or other means to transfer personal data of Vietnamese citizens to a location outside the territory of the Socialist Republic of Vietnam, or using a location outside the territory of the Socialist Republic of Vietnam to process personal data of Vietnamese citizens.”
Clause 1, Article 20 of the Personal Data Protection Law 2025 sets out the cases constituting cross-border personal data transfer, including:
- Transferring personal data stored in Vietnam to a data storage system located outside the territory of Vietnam;
- Agencies, organizations, or individuals in Vietnam transferring personal data to organizations or individuals abroad;
- Agencies, organizations, or individuals in Vietnam or abroad using platforms located outside the territory of Vietnam to process personal data collected in Vietnam.
II. CROSS-BORDER PERSONAL DATA TRANSFER PROCEDURES
2.1. Preparing a Cross-Border Personal Data Transfer Impact Assessment Dossier
This is the mandatory first step when conducting a cross-border personal data transfer. Pursuant to Clause 2, Article 18 of Decree 356/2025/NĐ-CP, the impact assessment dossier for cross-border personal data processing includes the following documents:
| No. | Dossier Components | Form |
| 1 | Notification of submission of the Impact Assessment Dossier (Cross-Border Personal Data Transfer) | Form No. 01a (Organizations)
Form No. 01b (Individuals) |
| 2 | Impact Assessment Report (Cross-Border Personal Data Transfer) | Form No. 9 (Cross-Border) |
| 3 | Decision on establishment, appointment, and assignment of the Personal Data Protection Department or Personnel | |
| 4 | Service contract with an organization/individual providing personal data protection services | |
| 5 | Documents proving the competence of the Data Protection Officer (DPO) (Confirmation from the organization regarding work experience; certificates/degrees of participation in training/refresher courses on personal data protection as regulated) | |
| 6 | Personal Data Protection Policy (including policies on retention, deletion, and destruction of personal data and relevant regulations) | |
| 7 | Consent form templates for personal data processing (employees, customers, etc.) | |
| 8 | Agreements/Contracts on personal data processing / transfer with relevant parties | |
| 9 | System diagrams and personal data processing dataflow diagrams | |
| 10 | Other accompanying appendices (other agreements with customers or relevant parties regarding the processing / cross-border transfer of personal data) |
Important note: Clause 3, Article 20 of the Personal Data Protection Law 2025 provides that the impact assessment for cross-border personal data transfer only needs to be conducted once for the entire duration of the organization’s operations, and is updated when changes occur pursuant to Article 22 of this Law.
2.2. Submitting the Dossier
After completing the dossier, the data-transferring party must submit one original copy to the Ministry of Public Security (Department of Cybersecurity and High-Tech Crime Prevention) within 60 days from the date of commencing the cross-border personal data transfer.
Methods of submission:
- Online: Via the National Portal on Personal Data Protection;
- In person: At the Department of Cybersecurity and High-Tech Crime Prevention, Ministry of Public Security;
- By post: To the administrative procedure reception and results return unit at the Department of Cybersecurity and High-Tech Crime Prevention, Ministry of Public Security.
2.3. Updating the Dossier
Clause 1, Article 22 of the Personal Data Protection Law 2025 provides that the cross-border personal data transfer impact assessment dossier must be updated every 6 months whenever changes occur.
In addition, organizations and individuals must update the dossier immediately (within 10 days) when major events occur such as acquisition, merger, dissolution, or a change of data protection service provider.
Note: Impact assessment dossiers for personal data processing and cross-border personal data transfers prepared under Decree 13/2023/NĐ-CP and submitted before January 1, 2026 remain valid and do not need to be redone under the new Law. However, any updates to these dossiers made after January 1, 2026 must comply with the Personal Data Protection Law 2025.
III. CASES EXEMPT FROM IMPACT ASSESSMENT REQUIREMENTS
Pursuant to Clause 6, Article 20 of the Personal Data Protection Law 2025, certain cases are exempt from the cross-border personal data transfer impact assessment requirements, including:
- Cross-border personal data transfers by competent state agencies;
- Organizations or agencies storing the personal data of their own employees on cloud computing services;
- Data subjects transferring their own personal data across borders;
- Other cases as prescribed by the Government.
Businesses should carefully review these exemptions before initiating procedures, to avoid unnecessary compliance steps or overlooking legal obligations.
IV. CASES REQUIRING SUSPENSION OF DATA TRANSFER
The Ministry of Public Security has the authority to require a data-transferring party to halt operations in the following cases:
- The transferred personal data is discovered to be used in activities that violate Vietnam’s national interests or security;
- The data-transferring party fails to comply with requirements to complete or update its dossier as prescribed;
- A personal data breach or loss incident involving Vietnamese citizens’ data occurs.
V. PENALTIES FOR VIOLATIONS RELATING TO CROSS-BORDER PERSONAL DATA TRANSFER
Under Article 8 of the Personal Data Protection Law 2025, the maximum administrative fine for an organization that violates cross-border personal data transfer regulations is 5% of its revenue from the preceding year. In cases where there is no revenue, or where the revenue-based fine is lower than the fixed penalty threshold, the maximum fine is VND 3 billion.
FREQUENTLY ASKED QUESTIONS ABOUT CROSS-BORDER PERSONAL DATA TRANSFER
Q: If a business stores customer data on servers located in Singapore, is it required to comply with cross-border data transfer procedures?
Yes. Under the regulations, using storage or processing systems located outside Vietnamese territory falls within the scope of cross-border personal data transfer and must comply with the prescribed procedures.
Q: If a business has already prepared an impact assessment dossier, does it need to redo it every year?
No. Under the Personal Data Protection Law 2025, the cross-border personal data transfer impact assessment only needs to be completed once, and is updated when there are changes to the content — it does not need to be redone on an annual basis.
Q: What is the deadline for submitting the impact assessment dossier?
The business must submit its dossier within 60 days from the first date on which it commences cross-border personal data transfer.
