When the Law on Personal Data Protection No. 91/2025/QH15 officially takes effect from January 1, 2026, the question that many leaders of growing enterprises are asking is: “Internal or outsourced DPIA – which choice is more suitable for our business?” Data Protection Impact Assessment (DPIA) is no longer a formal administrative procedure but has become a strategic risk management tool, mandatory for most organizations and enterprises under the new legal regulations. Depending on the scale, resources, and level of data processing, each enterprise needs to carefully consider between performing an internal DPIA itself or using outsourced services. The article below analyzes each option from a legal perspective to help enterprises make appropriate decisions.
LEGAL BASIS
- Law on Personal Data Protection No. 91/2025/QH15 dated June 26, 2025, of the National Assembly of the Socialist Republic of Vietnam (effective from January 1, 2026);
- Decree No. 356/2025/ND-CP detailing a number of articles and measures for the implementation of the Law on Personal Data Protection;
I. WHAT IS A DPIA AND WHY SHOULD GROWING ENTERPRISES CARE?
1.1. Concept of DPIA
DPIA (Data Protection Impact Assessment) is defined in Clause 12, Article 2 of the Law on Personal Data Protection No. 91/2025/QH15: “Data protection impact assessment is the analysis and assessment of risks that may occur during the processing of personal data to apply risk mitigation measures and protect personal data.” The results of this process are compiled into a Personal Data Processing Impact Assessment Dossier (commonly referred to as the DPIA dossier), which is an important legal document that enterprises must establish, store, and submit to the Department of Cybersecurity and High-Tech Crime Prevention and Control under the Ministry of Public Security.
1.2. Which enterprises must perform a DPIA?
According to the provisions of Decree No. 356/2025/ND-CP guiding the Law on Personal Data Protection, most organizations and enterprises with personal data processing activities must prepare a DPIA dossier. In particular, the Law on Personal Data Protection 2025 only exempts a small number of entities such as micro-enterprises, small enterprises, startups, and business households when meeting certain conditions – and even these entities are not exempt if they conduct personal data processing services or process sensitive personal data. Thus, growing enterprises, with a scale of medium or larger, almost all fall into the category of having to perform a DPIA.
The deadline for submitting the DPIA dossier is also clearly specified: according to Article 25 of the Law on Personal Data Protection 2025, the dossier must be sent to the specialized agency within 60 days from the date personal data processing begins. Violating this regulation poses significant legal risks and sanctioning penalties for enterprises.
II. PROCEDURES FOR ESTABLISHING AND SUBMITTING PERSONAL DATA PROCESSING IMPACT ASSESSMENT DOSSIERS
2.1. Dossier components
The components of the personal data processing report dossier are specifically regulated in Clause 2 and Clause 3, Article 19 of Decree No. 356/2025/ND-CP. The personal data processing impact assessment dossier includes the following documents:
| No. | Dossier Components | Form |
| 1 | Notification of submission of the Impact Assessment Dossier (Personal Data Processing / Cross-Border Personal Data Transfer) | Form No. 02a (Organizations)
Form No. 02b (Individuals) |
| 2 | Impact Assessment Report (Personal Data Processing / Cross-Border Personal Data Transfer) | Form No. 10
Form No. 9 (Cross-Border) |
| 3 | Decision on establishment, appointment, and assignment of the Personal Data Protection Department or Personnel | |
| 4 | Service contract with an organization/individual providing personal data protection services | |
| 5 | Documents proving the competence of the Data Protection Officer (DPO) (Confirmation from the organization regarding work experience; certificates/degrees of participation in training/refresher courses on personal data protection as regulated) | |
| 6 | Personal Data Protection Policy (including policies on retention, deletion, and destruction of personal data and relevant regulations) | |
| 7 | Consent form templates for personal data processing (employees, customers, etc.) | |
| 8 | Agreements/Contracts on personal data processing / transfer with relevant parties | |
| 9 | System diagrams and personal data processing dataflow diagrams | |
| 10 | Other accompanying appendices (other agreements with customers or relevant parties regarding the processing / cross-border transfer of personal data) |
2.2. Submission methods
Once the dossier is fully prepared, enterprises can choose one of three submission methods:
- Online: Access the National Portal on Personal Data Protection.
- In-person: At the Department of Cybersecurity and High-Tech Crime Prevention and Control, Ministry of Public Security.
- Postal service: The Department for Receiving and Returning Administrative Procedure Results regarding personal data protection at the Department of Cybersecurity and High-Tech Crime Prevention and Control, Ministry of Public Security.
2.3. Handling authority
The agency that receives and processes personal data processing impact assessment dossiers is the Department of Cybersecurity and High-Tech Crime Prevention and Control (A05), Ministry of Public Security.
2.4. Submission deadline
The deadline for submitting the dossier is within 60 days from the date the Personal Data Controller, Personal Data Controller and Processor, or Personal Data Processor conducts personal data processing.
III. INTERNAL OR OUTSOURCED DPIA – WHAT DOES THE LAW PRESCRIBE?
3.1. Regulations on the form of implementing DPO/DPD
Current law does not force enterprises to choose between internal or outsourced DPIA. According to Clause 2, Article 33 of the Law on Personal Data Protection 2025 and Articles 13 and 14 of Decree No. 356/2025/ND-CP, organizations have responsibilities for appointing a specialized department or personnel in charge of personal data protection (DPO – Data Protection Officer / DPD – Data Protection Department). In particular, Decree No. 356/2025/ND-CP clarifies that enterprises can combine both forms: simultaneously appointing an internal DPO/establishing an internal DPD and outsourcing to external organizations or individuals providing personal data protection services.
3.2. Requirements for internal data protection personnel
According to Decree No. 356/2025/ND-CP, internal personal data protection personnel (DPO) must meet the following criteria:
- Graduated from university or higher;
- Have at least 02 years of experience related to legal affairs, information technology, cybersecurity, data security, risk management, compliance control, or human resource management;
- Have been trained and fostered in legal knowledge and professional skills regarding personal data protection.
3.3. Requirements for outsourced service providers
For the outsourced model, Decree No. 356/2025/ND-CP stipulates that individuals providing services must have:
- A university degree or higher;
- At least 03 years of experience in the fields of legal affairs, personal data processing, cybersecurity, risk management, or compliance control;
- Intensive training in personal data protection. For service-providing organizations, all participating personnel must meet similar conditions.
Regarding the legal liability of the outsourced party: Pursuant to Clause 4, Article 15 of Decree No. 356/2025/ND-CP, individuals providing services must:
- Perform services within the scope of the contract or agreement;
- Not abuse the service provision to commit violations;
- Delete or destroy personal data processed during the service provision after completing the contract.
IV. PERSPECTIVE FROM GROWING ENTERPRISES: WHICH MODEL SHOULD BE CHOSEN?
Based on the provisions of the Law on Personal Data Protection No. 91/2025/QH15 and Decree No. 356/2025/ND-CP, the table below summarizes the points of comparison among the three DPIA implementation models for growing enterprises to easily contrast and choose:
| Criteria | Internal DPIA | Outsourcing |
| Legal Basis | Articles 13, 14 of Decree 356/2025/ND-CP | Articles 13, 14 of Decree 356/2025/ND-CP |
| Personnel Requirements | Minimum 02 years of experience, trained in data protection | Minimum 03 years of experience, intensively trained |
| Cost | Higher (recruitment, training, long-term salary) | More flexible (cost based on service/contract) |
| Deployment Speed | Slower if an in-house team is not yet available | Fast – meets the 60-day deadline under Article 25 of Law 91/2025 |
| Information Control | High – all internal data is kept in-house and not shared externally | Requires signing a confidentiality agreement; the outsourced party must delete data after contract completion |
| Legal Liability | The enterprise bears full responsibility | The outsourced party is liable according to the contract; the enterprise remains the Data Controller |
| Suitability | Enterprises with sufficiently capable legal/IT teams, processing large-scale sensitive data | Growing enterprises that lack specialized personnel and need urgent compliance |
The Hybrid Model – A Flexible Solution for the Growth Phase
In addition to the two models above, expanding enterprises can opt for a hybrid model – having internal personnel in charge of data protection while outsourcing for intensive consulting/services – which is recognized and permitted under Decree No. 356/2025/ND-CP. This is a flexible option: internal personnel deeply understand business operations, while the external consulting firm ensures the legal accuracy of the DPIA dossier.
Importantly, regardless of the chosen model, ultimate legal liability still rests with the enterprise as the Data Controller or Data Processor. Therefore, outsourcing contracts need to clearly define the scope of services, the responsibility to periodically update the DPIA (every 06 months as regulated), and the mechanism for handling changes in data processing activities.
FREQUENTLY ASKED QUESTIONS ABOUT DPIA
Question 1: Do newly established enterprises have to perform a DPIA?
Yes, if the enterprise begins personal data processing activities. However, small enterprises, startups, and micro-enterprises are exempted for the first 05 years, unless they process sensitive personal data, engage in data processing services, or transfer data abroad.
Question 2: Do B2B enterprises acting as data processors need to establish a separate DPIA dossier?
Yes. Decree No. 356/2025/ND-CP clearly stipulates that Data Processors (marketing agencies, software providers, cloud services…) are mandatory to establish their own separate DPIA dossiers, independent of whether the hiring party has prepared a dossier or not.
CONCLUSION
The question “Internal or outsourced DPIA?” does not have an absolute answer. What matters is that each growing enterprise needs to clearly understand its legal obligations under the Law on Personal Data Protection No. 91/2025/QH15, Decree No. 356/2025/ND-CP, and Decree No. 13/2023/ND-CP, thereby evaluating internal capacity to make an appropriate choice. Whether executing the DPIA internally or utilizing outsourced services, the ultimate goal is to build a sustainable, transparent, and legally compliant personal data protection system – not only to avoid sanctions but also to create a trustworthy foundation for the long-term growth of the enterprise.
