Many enterprises today have invested in building a relatively structured internal system of Standard Operating Procedures (SOPs) regarding personal data protection, including privacy policies, data collection guidelines, and data processing consent forms. However, a question arises: Is an SOP sufficient to comply with personal data protection laws? Reality shows that no matter how meticulous internal procedures are, enterprises still face the risk of violating the law if they neglect the obligation to prepare a Data Protection Impact Assessment (DPIA) dossier. This article analyzes the legal framework and explains why a DPIA is a mandatory, independent obligation from SOPs that enterprises cannot afford to overlook.
LEGAL FRAMEWORK
- Law on Personal Data Protection 2025 (Law No. 91/2025/QH15), effective from January 1, 2026;
- Decree No. 356/2025/ND-CP guiding the Law on Personal Data Protection.
I. WHAT IS AN SOP AND ITS ROLE IN PERSONAL DATA PROTECTION
1.1. Definition and Effects of SOPs
- Definition: An SOP (Standard Operating Procedure) is a set of step-by-step instructions compiled to guide and maintain the quality of work within organizations and enterprises. SOPs help ensure that operations are carried out consistently and efficiently, minimizing errors and improving performance.
- Effects of SOPs in Workplace Operations:
- Quality Assurance: SOPs help maintain stable and consistent work quality.
- Efficiency Boost: They help employees perform tasks more quickly and accurately.
- Error Minimization: Detailed guidelines help prevent common mistakes.
- Onboarding New Staff: SOPs serve as useful materials for training and guiding new employees.
Accordingly, an SOP in the field of personal data protection is a collection of internal processes, policies, and guidelines developed by the enterprise itself to control the collection, storage, use, and sharing of personal data.
1.2. Limitations of SOPs in Complying with Personal Data Protection Laws
A crucial point that many enterprises overlook is that an SOP only describes how the enterprise intends to process personal data, whereas a DPIA requires the enterprise to prove that it has assessed and controlled the risks arising from those processing activities. These are two entirely different obligations in terms of legal nature.
If an SOP is the “blueprint” showing the enterprise’s intent, then a DPIA is the “survey report” proving that the enterprise has actually identified, analyzed, and established countermeasures for any risks that could harm data subjects. Possessing an SOP without a DPIA means the enterprise is missing half of its compliance journey under personal data protection laws.
II. WHAT IS A DPIA AND WHY IS IT MANDATORY FOR ENTERPRISES?
2.1. Definition of DPIA under Vietnamese Law
According to Clause 12, Article 2 of the Law on Personal Data Protection 2025 (Law No. 91/2025/QH15), a personal data processing impact assessment is the analysis and evaluation of potential risks that may occur during the personal data processing workflow to apply risk-mitigation measures and protect personal data. In other words, a DPIA is a systematic assessment process focused on identifying and handling actual risks that data processing activities may pose to the legitimate rights and interests of individuals.
Unlike an SOP – which is internal and describes operational workflows – a DPIA is a legally structured dossier that must be prepared according to a statutory template (Form No. 10 issued under Decree No. 356/2025/ND-CP). It must be submitted to the specialized personal data protection authority: the Department of Cybersecurity and High-Tech Crime Prevention and Control (A05) under the Ministry of Public Security.
2.2. Entities Mandatory Subject to DPIA Formulations
Under the provisions of the Law on Personal Data Protection 2025, all organizations processing personal data are obligated to formulate a DPIA dossier, except for a few exemptions, specifically small enterprises, startups, business households, and micro-enterprises that meet certain statutory conditions. The scope of application is very broad, covering domestic enterprises as well as foreign agencies, organizations, and individuals directly participating in or related to personal data processing activities in Vietnam.
By regulation, the DPIA dossier must be submitted to A05 within 60 days from the start of personal data processing (calculated from the moment the enterprise collects its first data item). This is a statutory deadline, independent of whether the enterprise already has a personal data protection SOP or not.
As can be seen, the content of a DPIA is completely distinct from an SOP: while an SOP describes operational processes, a DPIA demands an in-depth risk analysis and a commitment via a legal dossier submitted to the state authority. No SOP, no matter how detailed, can replace a DPIA.
III. LEGAL RISKS WHEN ENTERPRISES HAVE AN SOP BUT NO DPIA
3.1. Enterprises Still Violate Statutory Obligations
Personal data protection laws in Vietnam clearly distinguish two groups of obligations:
(1) the responsibility to implement protective measures (expressed through SOPs and technical measures)
(2) the obligation to formulate, submit, and maintain an Impact Assessment Dossier (DPIA).
Both groups of obligations are mandatory and independent of each other.
Except for exemptions under Clauses 2 and 3, Article 38 of the Law on Personal Data Protection 2025, enterprises are required to formulate a DPIA and submit the dossier to A05 in accordance with the proper process. Therefore, without a DPIA, an enterprise cannot “prove” compliance before state authorities, regardless of how comprehensive its SOP is.
3.2. DPIA Dossiers Must Be Updated Periodically – SOPs Cannot Substitute
A key point that enterprises must note regarding DPIAs is the update obligation. According to the Law on Personal Data Protection No. 91/2025/QH15, a DPIA dossier must be updated periodically every 06 months whenever there are changes or additions regarding personal data processing activities. This is an ongoing requirement, not a one-time task.
An SOP, even if updated regularly, does not satisfy this requirement because it lacks the risk assessment structure of the statutory template and is not submitted to A05. Updating only the SOP without updating the DPIA dossier means the enterprise is still violating its periodic reporting obligations under personal data protection regulations.
3.3. Sanctions for Violations
The Law on Personal Data Protection 2025 clearly stipulates that agencies, organizations, and individuals violating personal data protection regulations will be handled depending on the severity of the violation, including disciplinary actions, administrative sanctions, or criminal prosecution.
Article 8 of the Law on Personal Data Protection 2025 specifically specifies administrative fine levels as follows:
| Violating Act | Administrative Fine Level |
| Buying or selling personal data | Up to 10 times the revenue generated from the violating act.
In cases where there is no revenue from the violation, or if the fine calculated based on revenue is lower than 3 billion VND, a maximum fine of 3 billion VND applies (the maximum administrative fine for other violations in the personal data protection sector). |
| Violating regulations on cross-border personal data transfer | Up to 5% of the total revenue of the organization’s immediately preceding fiscal year.
In cases where there is no revenue from the preceding year, or if the fine calculated based on revenue is lower than 3 billion VND, a maximum fine of 3 billion VND applies. |
| Administrative violations regarding other non-compliant acts | Up to 3 billion VND. |
Note: The above fine levels apply to organizations. If an individual commits the same violation, the maximum fine level equals 1/2 of the fine level applicable to organizations.
In particular, in the event of a personal data breach or data loss incident, the Ministry of Public Security has the authority to inspect and request the suspension of data processing activities. If the enterprise does not have a complete DPIA dossier, this will serve as an aggravating circumstance showing a lack of due diligence in complying with personal data protection laws, thereby increasing the severity of the penalties.
IV. FREQUENTLY ASKED QUESTIONS ABOUT SOPs AND DPIAs
Question 1: Does an enterprise already compliant with the GDPR need to complete a DPIA under Vietnamese law?
Yes. Enterprises that have issued data protection policies according to the GDPR or other international standards are not automatically deemed compliant with Vietnamese personal data protection laws. A DPIA under Decree No. 356/2025/ND-CP requires its own specific templates and must be submitted to A05 following Vietnam’s particular procedures.
Question 2: Is doing a DPIA once sufficient for the entire lifetime of an enterprise’s operations?
Not enough if there are changes in data processing activities. The Law on Personal Data Protection No. 91/2025/QH15 stipulates that the dossier must be updated periodically every 06 months when there are changes or additions. Enterprises need to maintain their DPIA dossier in an active, updated, and accurate state.
CONCLUSION
An SOP is a necessary foundation within an enterprise’s personal data protection compliance system, but it can by no means replace a Data Protection Impact Assessment (DPIA) dossier. Under the provisions of the Law on Personal Data Protection No. 91/2025/QH15 and Decree No. 356/2025/ND-CP, a DPIA is an independent legal obligation with its own mandatory templates, submission deadlines, and periodic update requirements.
Enterprises must clearly understand: having a good SOP is a necessary condition, but having a complete and timely DPIA is the sufficient condition to avoid violating personal data protection laws. With the Law on Personal Data Protection having taken effect on January 1, 2026, this is the critical time for enterprises to immediately review their obligations to formulate and submit DPIA dossiers to avoid unwarranted legal risks.
