Compliance that is complete, accurate and practical – so your data builds trust rather than legal risk.

Customer, employee and partner data is a core asset for every business. Since 1 January 2026, protecting personal data has also become a legal obligation backed by strict sanctions in Vietnam. CBI supports businesses from the initial gap assessment through to long-term compliance.

Why act now?

The Law on Personal Data Protection No. 91/2025/QH15 and its implementing Decree No. 356/2025/ND-CP took effect on 1 January 2026, introducing unprecedented penalties:

• Up to 5% of prior-year revenue: for breaches of cross-border data transfer rules.
• Up to 10 times the proceeds: for buying or selling personal data.
• Up to VND 3 billion: for other violations by organisations.

Impact assessment dossiers are now reviewed by the specialised authority under the Ministry of Public Security. Poorly prepared dossiers are often returned for revision, causing delays and disruption to business operations.

Who needs to comply?

Virtually every business that collects data from customers, employees or website and app users. Foreign organisations processing the personal data of Vietnamese citizens also fall within scope. Particular attention is required in:

• E-commerce, retail, digital platforms and technology
• Banking, finance, insurance and fintech
• Healthcare, education, logistics and real estate
• Foreign-invested enterprises and groups transferring data to an overseas parent company

Small businesses and start-ups may be exempt from certain obligations for a limited period, but exemptions do not apply where sensitive data or large volumes of data subjects are processed. CBI helps you determine exactly which obligations apply to your business.

Our Services

1. Compliance gap assessment

Data mapping, review against current regulations, identification of gaps and a prioritised remediation roadmap.

2. Impact assessment dossiers

Preparation of the personal data processing impact assessment and the cross-border transfer impact assessment. Filing, explanations to the authority and ongoing updates.

3. Policies and contracts

Data protection policies, privacy notices, consent mechanisms, internal rules, and data protection clauses in employment contracts and vendor agreements (DPAs).

4. DPO and data protection function

Advice on appointing a data protection officer or establishing a data protection department, or outsourced data protection services.

5. Incident response

Breach response procedures, support with statutory notifications, and representation before the authorities.

6. Training and ongoing compliance

Training for management and staff, periodic reviews and regulatory updates under a retainer arrangement.

Our Approach

• Discovery: consultation and information gathering through questionnaires and interviews.
• Assessment: gap report, risk rating and recommended roadmap.
• Implementation: drafting of dossiers, policies and contracts; filing and follow-up with the authority.
• Maintenance: training, periodic reviews and updates as laws or operations change.

Why CBI?

• Business-focused: solutions tailored to your business model, group structure and transactions.
• Integrated legal and cybersecurity approach: data protection aligned with cybersecurity requirements.
• Bilingual Vietnamese – English: seamless for foreign-invested companies and overseas parent companies.
• Practical and timely: risk-based priorities that fit your resources.