The question of which enterprises are legally required to prepare a DPIA is one of the most prominent legal concerns for many organizations and businesses in Vietnam since the Law on Personal Data Protection No. 91/2025/QH15 came into effect on January 1, 2026. Many businesses wonder: “My company is small size, do we need to prepare a DPIA? What about business households?”. Notably, Article 38 of the Law and Article 41 of Decree No. 356/2025/ND-CP clearly classify each group of entities with varying levels of obligations—ranging from total exemption to unconditional compliance. The following article provides a detailed analysis of this regulation, helping businesses accurately determine whether they are mandated to prepare a DPIA.
Legal basis
- Law on Personal Data Protection No. 91/2025/QH15 dated June 26, 2025, passed by the National Assembly of the Socialist Republic of Vietnam (effective from January 1, 2026);
- Decree No. 356/2025/ND-CP detailing a number of articles and measures for the enforcement of the Law on Personal Data Protection;
I. WHAT IS A DPIA?
A DPIA (Data Protection Impact Assessment) is defined in Clause 12, Article 2 of the Law on Personal Data Protection No. 91/2025/QH15 as follows: “Data Protection Impact Assessment is the analysis and assessment of potential risks that may occur during the process of personal data processing in order to apply risk mitigation measures and protect personal data.” The outcomes of this process are compiled into a Personal Data Processing Impact Assessment Dossier (commonly referred to as the DPIA dossier). This is a critical legal document that enterprises must prepare, store, and submit to the Department of Cybersecurity and High-Tech Crime Prevention and Control under the Ministry of Public Security.
II. ENTERPRISES MANDATED TO PREPARE A DPIA
Currently, Vietnamese law does not contain a single direct statutory clause stating that all enterprises across the board must prepare a Data Protection Impact Assessment (DPIA). Instead, Article 38 of the Law on Personal Data Protection 2025 and Article 41 of Decree No. 356/2025/ND-CP establish specific criteria to determine which businesses are mandated to comply, which are exempted, and which have the option to choose.
According to Clauses 2 and 3, Article 38 of the Law on Personal Data Protection:
“2. Small enterprises and startups shall have the right to choose whether or not to implement the regulations in Article 21, Article 22, and Clause 2, Article 33 of this Law within a period of 05 years from the date this Law takes effect, except for small enterprises and startups engaged in personal data processing services, directly processing sensitive personal data, or processing personal data of a large number of data subjects.
- Business households and micro-enterprises are not required to implement the regulations in Article 21, Article 22, and Clause 2, Article 33 of this Law, except for business households and micro-enterprises engaged in personal data processing services, directly processing sensitive personal data, or processing personal data of a large number of data subjects.”
In this context, Article 21, Article 22, and Clause 2, Article 33 of the Law on Personal Data Protection cover the following activities:
- Data Protection Impact Assessment (Article 21).
- Updating the Personal Data Processing Impact Assessment Dossier and Cross-Border Personal Data Transfer Impact Assessment Dossier (Article 22).
- Designating a department and personnel qualified for personal data protection or hiring an organization or individual providing personal data protection services (Clause 2, Article 33).
Furthermore, Clause 1, Article 41 of Decree No. 356/2025/ND-CP clarifies the “large number” threshold with a specific figure: “…processing personal data from the moment the scale reaches 100,000 data subjects or more, based on the cumulative total volume of processed personal data.”
Summary of the rules:
- Small enterprises and startups have the right to choose whether or not to conduct a data protection impact assessment during the period from January 1, 2026, through December 31, 2030.
- Business households and micro-enterprises are completely exempted from conducting data protection impact assessments.
Cases where a Data Protection Impact Assessment is MANDATORY:
- Medium and large enterprises are not entitled to any preferential treatment or grace periods under Article 38. This group must fully apply the provisions of Article 21 (obligation to prepare a DPIA), Article 22 (updating the DPIA dossier), and Clause 2, Article 33 of the Law starting directly from January 1, 2026.
- Business households; micro, small, and startup enterprises that are engaged in personal data processing services, directly process sensitive personal data, or process personal data of a large number of data subjects (100,000 or more).
III. PROCEDURES FOR PREPARING AND SUBMITTING A PERSONAL DATA PROCESSING IMPACT ASSESSMENT DOSSIER
3.1. Dossier Components
The components of the personal data processing report dossier are specifically stipulated in Clauses 2 and 3, Article 19 of Decree No. 356/2025/ND-CP. A DPIA dossier includes the following documents:
| No. | Dossier Components | Form |
| 1 | Notification of submission of the Impact Assessment Dossier (Personal Data Processing / Cross-Border Personal Data Transfer) | Form No. 02a (Organizations)
Form No. 02b (Individuals) |
| 2 | Impact Assessment Report (Personal Data Processing / Cross-Border Personal Data Transfer) | Form No. 10
Form No. 9 (Cross-Border) |
| 3 | Decision on establishment, appointment, and assignment of the Personal Data Protection Department or Personnel | |
| 4 | Service contract with an organization/individual providing personal data protection services | |
| 5 | Documents proving the competence of the Data Protection Officer (DPO) (Confirmation from the organization regarding work experience; certificates/degrees of participation in training/refresher courses on personal data protection as regulated) | |
| 6 | Personal Data Protection Policy (including policies on retention, deletion, and destruction of personal data and relevant regulations) | |
| 7 | Consent form templates for personal data processing (employees, customers, etc.) | |
| 8 | Agreements/Contracts on personal data processing / transfer with relevant parties | |
| 9 | System diagrams and personal data processing dataflow diagrams | |
| 10 | Other accompanying appendices (other agreements with customers or relevant parties regarding the processing / cross-border transfer of personal data) |
3.2. Submission Methods
Once the dossier is fully prepared, enterprises can choose one of the following three submission methods:
- Online: Access the National Portal on Personal Data Protection.
- In-Person: At the Department of Cybersecurity and High-Tech Crime Prevention and Control, Ministry of Public Security.
- By Post: The Department for Receiving and Returning Results of Administrative Procedures on Personal Data Protection at the Department of Cybersecurity and High-Tech Crime Prevention and Control, Ministry of Public Security.
3.3. Reviewing Authority
The agency responsible for receiving and processing the personal data processing impact assessment dossier is the Department of Cybersecurity and High-Tech Crime Prevention and Control (A05), under the Ministry of Public Security.
3.4. Submission Deadline
The dossier must be submitted within 60 days from the date the Personal Data Controller, Personal Data Controller-cum-Processor, or Personal Data Processor commences the processing of personal data.
CONCLUSION
Understanding the classification system under Article 38 of Law No. 91/2025/QH15 and Article 41 of Decree No. 356/2025/ND-CP is the first and most critical step for enterprises to comply with their legal obligations and avoid severe penalties in this new era of personal data protection.
