In general, if a data controller wishes to share, disclose or otherwise transfer an individual’s personal information to a third party (including group companies and its vendors/data processors), the data controller must inform the data subjects and obtain prior explicit consent from the data subjects, unless otherwise regulated by law. 

Cross-border transfer requirements under PDPL

Decree 356 regulates the following cases as cross-border transfers of personal data:

• Personal data storage activities that involve the transfer of personal data collected and stored in Vietnam to server systems located outside the territory of the Socialist Republic of Vietnam or to cloud computing services provided by foreign service providers;
• Activities involving the transfer of personal data by agencies, organizations, or individuals in Vietnam to recipients that are organizations or individuals located overseas;
• Activities involving the processing of personal data collected in Vietnam and transferred to platforms outside the territory of the Socialist Republic of Vietnam for further processing.

Organizations conducting the transfer of data across border from Vietnam to overseas (“data transferor”) are required to prepare and submit a TIA to the authority (MPS), unless an exemption can be applied. 

As regards exemptions, cases that are not required to comply with regulations on conducting the TIA include:

• cross-border transfer of personal data by competent state authorities;
• agencies or organizations storing the personal data of their employees on cloud computing services;
• personal data subjects transferring their own personal data across borders; (iv) journalism and media activities in accordance with the law;
• cross-border transfers of personal data that have been publicly disclosed in accordance with the law;
• in emergency situations where it is truly necessary to provide personal data across borders in order to protect the life, health, or property safety of individuals; or to perform tasks and obligations as prescribed by law;
• cross-border personal data transfers for the purpose of cross-border personnel management in accordance with labor rules, internal regulations, and collective labor agreements as prescribed by law; and
• provision of personal data across borders for the purpose of entering into contracts or carrying out procedures related to cross-border transportation, logistics, remittance, payment, hotel bookings, visa applications, or scholarship applications. 

A TIA (and also DPIA) submitted in accordance with the PDPD, which was received by the authority before the effective date of the PDPL (1 January 2026), shall continue to be valid and shall not be required to be re-prepared in accordance with the PDPL/Decree 356. That said, if any updates must be made to the above-mentioned dossiers after the effective date of the PDPL, these must comply with the provisions of the PDPL. 

Moreover, small and start up enterprises may enjoy a five-year exemption for TIA (and DPIA and DPO) requirements if meeting conditions required by law. Business household and micro-enterprises may be exempted from TIA (and DPIA and DPO) requirements if meeting conditions required by law. 

The TIA must be prepared in accordance with the statutory forms and templates, and be made available at all times for inspection and evaluation by the A05/MPS. In addition, the transferor must also send one original copy of the TIA to the A05 within 60 days from the date of the personal data transfer. Within 15 days from the submission date, the A05 will appraise the TIA and request the transferor to revise the dossier if it finds that the TIA is incomplete or insufficiently meet the legal requirements. The transferor will then have 30 days to update and submit the updated TIA dossier to the A05. Failure to meet such timeframe could result in the transferor facing administrative sanctions in line with the law. The TIA must be reviewed and updated on a periodic basis every six months, or promptly within ten days following the occurrence of material changes specified under the law.

Cross-border transfer requirement under Data Law

The Data Law also requires a data transferor to prepare and file to the regulator (also MPS) a cross-border data transfer and processing impact assessment (TIA), which are different and separate from the TIA requirements under the PDPL. In particular, the TIA requirements under the Data Law apply to cross-border transfers of data classified as “important data” and “core data”. 

Most of the data classified as “important data” or “core data” under the Data Law consists of data collected and/or managed by state agencies that has not been made public. However, the list also includes non-governmental data, including data involving a “significant amount of personal data”. In particular, non-governmental data classified as important data and core data includes the following: 

• Non-governmental data classified as “important data”:
  • basic citizen data of 100,000 or more Vietnamese citizens;
  • sensitive citizen data of 10,000 or more Vietnamese citizens; and
  • data on bank accounts, payment history, and debt obligations of 10,000 or more Vietnamese enterprises or organizations.
• Non-governmental data classified as “core data”:
  • basic citizen data of 1,000,000 or more Vietnamese citizens;
  • sensitive citizen data of 100,000 or more Vietnamese citizens; and
  • data on bank accounts, payment history, and debt obligations of 100,000 or more Vietnamese enterprises or organizations.

However, a TIA under the Data Law could be exempted if both of the following conditions are met:

• the data being transferred is “important data” or “core data” under the category of “significant personal data” under the Data Law framework (as discussed above); and
• the data transferor has already complied with the TIA requirements prescribed under the PDPL. 

However, note that this exemption applies only to cross‑border transfers of core or important data that fall under the category of “significant personal data”. If the cross‑border transfer involves other categories of core or important data, a TIA under the Data Law would still be required. 

Additional data localization requirements

In addition to the above TIA requirements, data localization could also be imposed on certain businesses providing services in Vietnam. The data localization requirements are regulated in various legal documents, notably including:

Requirements under Decree 147 on Internet

• Domestic information websites (e.g., aggregated news/information websites) and domestic social networks must store service users’ data in servers identified by IP addresses in Vietnam.

Requirements under Cybersecurity Law

• Domestic and foreign companies providing services on telecommunications networks, the Internet, or value-added services in cyberspace in Vietnam who engage in the collecting, exploiting/using, analyzing and/or processing of data (including personal information, data about service users' relationships and data generated by service users) must store such data in Vietnam for a specified period to be stipulated by the Government. Foreign enterprises providing telecoms and online services to customers in Vietnam may be required to locally store certain customer-related data in Vietnam for a certain period prescribed by law if the authority alerts them that their services / online platforms have been used to commit violations of Vietnam’s laws but such online service providers fail to remedy the situation upon the request of the authority. The government is updating the data localization requirements under the Cybersecurity Law. It is anticipated that the updated requirements will be submitted to the Prime Minister for consideration in April 2026. 

Data transfer agreement

A data transferor and its data recipient must have an agreement in place that includes the following mandatory content elements: 

• The purpose, method, and scope of data export, and the purpose and method of data processing by the data recipient;
• The location and duration of data storage, and data processing measures upon expiration of the storage period or completion of the agreed objectives;
• Binding requirements on the data recipient regarding the provision of transferred data to third parties;
• Data protection measures to be applied by the data recipient;
• Remedial measures, compensation for damages, liability for breach of contract, and dispute resolution measures in relation to violations of data protection obligations; and
• Responsibilities of the parties in data processing.