An organisation in Vietnam adopts an overseas customer-management platform. Staff work locally, but customer records are processed abroad. Before treating this as an ordinary software purchase, the organisation needs to understand its cross-border personal data obligations.

Vietnam’s Personal Data Protection Law, Law No. 91/2025/QH15, establishes the transfer assessment requirement. Decree 356/2025/NĐ-CP specifies the dossier and forms, including Form 09.

Reviewed on 31 October 2026: Decree 392/2026/NĐ-CP, issued on 20 October, amends the procedure from 15 November 2026. This guide separates the existing rules from those upcoming changes. Official decree and commencement date.

What counts as a cross-border transfer?

Article 20 of the Personal Data Protection Law covers transferring personal data stored in Vietnam to overseas storage, transferring it from Vietnam to overseas organisations or individuals, and using overseas platforms to process personal data collected in Vietnam.

Consequently, the review should cover more than files emailed abroad. Overseas hosting, cloud applications and group systems can also be relevant. Map where information is collected, stored and processed, who receives it, and whether recipients pass it onwards.

Identify the parties’ actual responsibilities. The labels in a vendor contract may not describe every activity correctly; see Vietnam PDPL: controller and processor roles.

What are Form 09 and Forms 01a/01b?

The assessment is often called a cross-border transfer impact assessment, abbreviated CTIA or TIA in English guidance. The Vietnamese legal term is đánh giá tác động chuyển dữ liệu cá nhân xuyên biên giới. For filing, the legislation and form numbers provide the clearest references.

Under Articles 18–20 and the appendix to Decree 356, these documents serve different purposes:

Document	Purpose
Form 09	The cross-border personal data transfer impact assessment report.
Form 01a or 01b	The notification accompanying submission of the transfer assessment dossier, using the applicable version for the submitting party.
Form 03a or 03b	The applicable form for updating assessment dossiers.
Form 10	The separate personal data processing impact assessment report.

Form 09 is therefore one component of the dossier. Article 18 also requires a copy of the binding transfer contract or document and relevant personal data protection policies, procedures and supporting documents.

Completing a processing assessment does not automatically satisfy the separate transfer requirement.

What should the assessment explain?

Article 18(3) of Decree 356 requires information about the parties, protection contacts, purposes, data types, transfer and processing activities, consent arrangements, retention, deletion, security, systems, onward transfers, compliance and risks.

A practical way to prepare that evidence is to answer five questions:

1. What is moving, and why? Describe the people concerned, data categories, purpose and actual processing flow. Include a diagram.
2. Who receives and controls it? Identify recipients, processors, other relevant parties and personal data protection contacts.
3. What happens after receipt? Explain storage systems, access, retention, deletion and onward disclosure.
4. What protects the information? Describe security measures and applicable standards, and provide the compliance self-assessment.
5. What could go wrong? Assess recipient protection, potential harm and the measures used to reduce or eliminate risks.

The recipient assessment deserves particular attention. A vendor’s statement that it is secure does not explain how the specific transfer will work. Useful evidence could include access arrangements, security assurance reports, incident procedures and contractual restrictions. These are practical evidence examples, not a universal list of mandatory attachments.

When and where must the dossier be submitted?

Where the assessment is required, Article 20(2) of the Law sets a deadline of 60 days from the first cross-border transfer. Article 18 of Decree 356 provides for online, direct or postal submission, accompanied by Form 01a/01b. The dossier must remain available for inspection.

Plan the assessment before introducing the service. The filing period should not become a reason to start transferring information without understanding the recipients, safeguards and applicable obligations.

What changes under Decree 392?

Articles 43, 45, 48 and 49 of Decree 392 change the administrative procedure from 15 November 2026:

Issue	Existing procedure	Amended procedure
Assessment results	Within 15 days; satisfactory or unsatisfactory.	Within 11 working days; satisfactory, satisfactory subject to supplementation, or unsatisfactory.
Handling authority	Specialised personal data protection agency.	Ministry of Public Security agency receives and classifies dossiers, with provincial allocation under prescribed criteria.
Initial filing deadline	60 days.	Remains 60 days.

The amendment retains Forms 01a/01b and does not replace Form 09. It also changes the submission routes and competent recipients for updates using Forms 03a/03b. Incomplete or non-compliant transfer dossiers must be completed within 30 days.

Transition matters: dossiers received before 15 November remain subject to the existing Decree 356 procedure. Do not apply the new timetable simply because assessment continues after that date.

Keep the dossier aligned with actual operations

Article 20 of Decree 356 requires six-monthly updates, measured from the first submission, for specified changes such as new purposes or relevant parties. Certain changes require updating within 10 days, including organisational restructuring, changes to personal data protection service providers, and specified processing-related business or service changes.

For the overseas customer platform, maintain a record of recipients, purposes, systems and safeguards. If a new subcontractor or processing purpose appears, assess the legal update trigger and the operational risk. Assign someone to obtain evidence and track the response.

This is where a data governance framework supports compliance: procurement identifies the service, technical teams verify the flow, privacy specialists assess requirements, and authorised management resolves outstanding risks. The submitted dossier should describe those real arrangements accurately.

Sources

• Law 91/2025/QH15, particularly Articles 20–22.
• Decree 356/2025/NĐ-CP, official text and appendix, particularly Articles 17–20 and Forms 01a/01b, 03a/03b, 09 and 10.
• Decree 392/2026/NĐ-CP, official publication, particularly Articles 43, 45, 48 and 49; English translation.

This guide explains the personal data transfer assessment process. Separate sector, cybersecurity or other data requirements may also apply. The Vietnamese legal text is authoritative.