Effective January 1, 2026, the Law on Personal Data Protection No. 91/2025/QH15 and Decree No. 356/2025/NĐ-CP officially came into force, imposing numerous mandatory compliance obligations on organizations and enterprises engaged in personal data processing activities in Vietnam. One of the most frequently asked questions among businesses is: when is a personal data processing report required under the new regulations? To which authority must it be submitted, within what timeframe, and what documents are required? This article provides a detailed analysis of the reporting obligations under Decree 356/2025/NĐ-CP and the Personal Data Protection Law 2025, helping businesses understand and proactively comply while avoiding legal risks.
LEGAL BASIS
- Law on Personal Data Protection No. 91/2025/QH15 dated June 26, 2025;
- Decree No. 356/2025/NĐ-CP dated December 31, 2025, detailing certain provisions and implementation measures of the Law on Personal Data Protection.
I. ENTITIES REQUIRED TO SUBMIT A PERSONAL DATA PROCESSING REPORT
Under Article 21 of the Personal Data Protection Law 2025, as elaborated in Clause 1, Article 19 of Decree 356/2025/NĐ-CP, three main categories of entities are obligated to prepare, retain, and submit a personal data processing impact assessment dossier.
1.1. Personal Data Controller
An agency, organization, or individual that determines the purposes and means of personal data processing. This typically includes businesses that collect and use customer or user information for commercial, administrative, marketing, or similar purposes.
1.2. Personal Data Controller-Processor
An agency, organization, or individual that both determines the purposes and means of, and directly carries out, personal data processing activities. This entity simultaneously plays a decision-making and executive role, bearing comprehensive responsibility for personal data processing reporting obligations.
1.3. Personal Data Processor
An agency, organization, or individual that processes personal data on behalf of a Controller or Controller-Processor pursuant to a contract. In such cases, the Processor also has an obligation to prepare and submit documentation consistent with the scope of the contracted engagement.
Pursuant to Clause 1, Article 19 of Decree 356/2025/NĐ-CP, the entities listed above must prepare and retain a personal data processing impact assessment dossier from the moment personal data processing commences. This is an obligation that arises immediately upon the commencement of operations, not only upon request from a state authority.
II. WHEN IS A PERSONAL DATA PROCESSING REPORT REQUIRED?
Decree 356/2025/NĐ-CP stipulates two primary triggering events for the reporting obligation to a competent state authority.
2.1. Initial Report upon commencement of data processing
This is the most critical triggering event. Under Clause 4, Article 19 of Decree 356/2025/NĐ-CP, the personal data processing impact assessment dossier must be submitted to the competent personal data protection authority within 60 days from the date on which personal data processing commences.
The commencement date is counted from when the business first collects personal data. The dossier must be submitted together with Form No. 02a (for organizations) or Form No. 02b (for individuals) issued under Decree 356/2025/NĐ-CP.
Similarly, for cross-border personal data transfers, Clause 4, Article 18 of Decree 356/2025/NĐ-CP requires the cross-border transfer impact assessment dossier to be submitted within 60 days from the date of the first transfer, accompanied by Form No. 01a or 01b as applicable.
2.2. Update Report upon changes
Beyond the initial report, the law also prescribes circumstances requiring updates to the dossier and supplementary personal data processing reports. Article 20 of Decree 356/2025/NĐ-CP distinguishes two categories of updates:
First, periodic updates every 6 months from the date of the initial submission, upon occurrence of any of the following:
- A new purpose for personal data processing or a new purpose for cross-border data transfer arises;
- A new Personal Data Controller, Controller-Processor, Processor, or Third Party arises or changes.
Second, immediate updates within 10 days upon occurrence of the following material changes:
- The agency, organization, or entity is reorganized, ceases operations, is dissolved, or declared bankrupt in accordance with law;
- There is a change in information regarding the organization or individual providing personal data protection services;
- A new business line or service related to personal data processing registered in the dossier arises or changes.
2.3. Breach notification within 72 hours
A special triggering event for a personal data processing report is a security incident. Under the Personal Data Protection Law 2025 and Decree 356/2025/NĐ-CP, where personal data is lost, unlawfully accessed, collected, used, disclosed, or destroyed, the Controller, Processor, or Controller-Processor must notify the competent authority within 72 hours from the time the breach is discovered.
Specifically for location data and biometric data, Decree 356/2025/NĐ-CP imposes an additional requirement to notify the data subject directly within 72 hours, or to issue a public notice and notify the subject as soon as practicable. Breach records must be retained for a minimum of five years after remediation.
III. WHAT DOCUMENTS ARE INCLUDED IN THE DOSSIER?
3.1. Dossier components
The components of the personal data processing report dossier are specified in Clauses 2 and 3 of Article 19 of Decree 356/2025/NĐ-CP. The impact assessment dossier includes the following documents:
| No. | Dossier Components | Form |
| 1 | Notification of submission of the Impact Assessment Dossier (Personal Data Processing / Cross-Border Personal Data Transfer) | Form No. 02a (Organizations)
Form No. 02b (Individuals) |
| 2 | Impact Assessment Report (Personal Data Processing / Cross-Border Personal Data Transfer) | Form No. 10
Form No. 9 (Cross-Border) |
| 3 | Decision on establishment, appointment, and assignment of the Personal Data Protection Department or Personnel | |
| 4 | Service contract with an organization/individual providing personal data protection services | |
| 5 | Documents proving the competence of the Data Protection Officer (DPO) (Confirmation from the organization regarding work experience; certificates/degrees of participation in training/refresher courses on personal data protection as regulated) | |
| 6 | Personal Data Protection Policy (including policies on retention, deletion, and destruction of personal data and relevant regulations) | |
| 7 | Consent form templates for personal data processing (employees, customers, etc.) | |
| 8 | Agreements/Contracts on personal data processing / transfer with relevant parties | |
| 9 | System diagrams and personal data processing dataflow diagrams | |
| 10 | Other accompanying appendices (other agreements with customers or relevant parties regarding the processing / cross-border transfer of personal data) |
3.2. Submission authority and method
The personal data processing report dossier is submitted to the Department of Cybersecurity and High-Tech Crime Prevention (Department A05), Ministry of Public Security.
Once the dossier is complete, businesses may choose from the following submission methods:
- Online submission via the National Portal on Personal Data Protection;
- In-person submission at Department A05;
- Submission by postal service.
IV. POST-SUBMISSION PROCESSING BY THE COMPETENT AUTHORITY
After receiving the personal data processing report dossier, the competent personal data protection authority is obligated to review and respond within the timeframes specified in Clauses 5 and 6 of Article 19 of Decree 356/2025/NĐ-CP:
- Within 15 days: the authority evaluates the dossier and issues a confirmation as to whether it meets requirements.
- Where the dossier is incomplete or non-compliant: the authority requires the parties to complete the dossier within 30 days. Failure to comply within this period may result in the authority applying administrative penalty provisions in the field of personal data protection.
Pursuant to Clause 4, Article 19 of Decree 356/2025/NĐ-CP, the personal data processing impact assessment dossier must be kept available at all times for inspection and review by the competent authority. This means businesses are not only obligated to submit the dossier once, but must continuously maintain and update it throughout the entire period of data processing.
V. KEY PRACTICAL NOTES
Businesses should be aware of the following practical considerations when fulfilling personal data processing reporting obligations under the new regulations.
On prescribed forms: From January 1, 2026, businesses are required to use the forms issued under Decree 356/2025/NĐ-CP. Forms under Decree 13/2023/NĐ-CP have expired and no longer have legal validity. Using old forms is one of the most common errors that leads to dossier rejection.
On personal data protection personnel (DPO): Decree 356/2025/NĐ-CP prescribes specific conditions and standards for personal data protection personnel within organizations. Failure to designate a DPO, or designating personnel who do not satisfy the conditions under Article 13 of Decree 356/2025/NĐ-CP, may result in the dossier being assessed as non-compliant.
On dossiers submitted before January 1, 2026: Businesses that previously submitted impact assessment dossiers under Decree 13/2023/NĐ-CP must review and update them to conform with the forms and procedures under Decree 356/2025/NĐ-CP.
On administrative penalties: Businesses that fail to comply, or comply incorrectly, with personal data processing reporting obligations will face administrative penalties. For serious violations involving cross-border data transfers or large-scale data breaches, penalties may reach VND 3 billion or 5% of the total revenue of the preceding fiscal year.
COMMON QUESTIONS
Do small businesses need to comply with personal data processing reporting requirements?
Yes. The reporting obligation applies to all Controllers, Controller-Processors, and Processors regardless of size. However, Decree 356/2025/NĐ-CP provides an exemption for entities that do not process sensitive data and cumulatively process data relating to fewer than 100,000 data subjects.
How many times must the personal data processing impact assessment dossier be prepared?
Under Decree 356/2025/NĐ-CP, the dossier is prepared once and maintained on a continuous basis throughout the operational period. However, it must be updated every 6 months, or within 10 days upon any change in business lines, data processing partners, or organizational information.
CONCLUSION
Properly and fully fulfilling the personal data processing reporting obligations under Decree 356/2025/NĐ-CP and the Personal Data Protection Law 2025 is a mandatory requirement for all businesses engaged in personal data processing in Vietnam. To comply, businesses must correctly identify when the reporting obligation is triggered — namely within 60 days from the date of commencement of processing or cross-border data transfer — select the correct forms, ensure the dossier is complete, and continuously maintain and update it throughout the course of operations. Additionally, in the event of a breach, businesses must promptly notify the competent authority within 72 hours. Proactive compliance not only helps businesses avoid penalty risks, but also demonstrates a commitment to protecting the privacy of customers and users.
