Personal data protection policy drafting services for businesses in Vietnam help companies develop, review, and finalize documents governing the collection, use, storage, sharing and protection of the personal information of clients, employees and partners. Under the Vietnamese Law on Personal Data Protection 2025 and Decree 356/2025/ND-CP, businesses must ensure that their data processing activities are consistent with their legal obligations and actual governance model. Viet An Law Firm provides personal data protection policy drafting in Vietnam, covering internal personal data processing policies, privacy policies, employee data protection policies and bilingual Vietnamese – English policies for FDI companies, helping clients control risks and fulfil their compliance obligations.
What is a personal data processing policy in Vietnam?
A personal data processing policy is a document that sets out the principles, scope, responsibilities and methods for managing personal data processing activities within a business. The policy may take the form of an internal governance document, a public policy for clients and users, or specialized documents for each data processing activity.
In practice, businesses often use related names such as:
- Personal data protection policy;
- Personal data processing policy;
- Personal information privacy policy;
- Privacy policy;
- Client privacy policy;
- Employee data protection policy.
These names may differ in scope and purpose. A business should not use one general policy template for all subjects if its data processing activities differ significantly.
For example, a website privacy policy usually focuses on transparency towards users, while an internal policy may regulate access rights, records management, retention periods and the responsibilities of each department in greater detail.
Legal note: Not every business is required to issue a standalone document titled exactly “Personal data processing policy”. However, businesses must fulfil the personal data protection obligations applicable to their actual activities. Developing an appropriate policy is an important tool for organizing and demonstrating compliance with those obligations.
Which businesses in Vietnam need a personal data protection policy?
The need for drafting personal data protection policies arises in many business models, not only in companies operating in the information technology sector.
Businesses collecting client information
Businesses in retail, e-commerce, real estate, tourism, hospitality, education and services regularly process full names, phone numbers, addresses, transaction information and other personal data.
The policy should specify the types of information collected, purposes of use, legal bases for processing, retention periods, client rights and the scope of information sharing with related parties.
In particular, businesses need to distinguish data used to perform transactions from data used for advertising, client care or direct marketing.
Businesses managing employees’ personal data
HR data may include recruitment records, employment contracts, identification information, bank accounts, payrolls, insurance, timekeeping data, surveillance camera footage and health information.
An employee data protection policy should clarify how data is accessed, used, stored and shared among the HR, accounting and management departments, service providers and related units.
For timekeeping data based on facial recognition, biometric data or health records, businesses must assess the specific protection requirements under the law.
Legal basis: Article 25 of the Law on Personal Data Protection No. 91/2025/QH15 sets out data protection responsibilities in recruiting, managing and employing workers. Accordingly, businesses should pay attention to collecting information for recruitment purposes, obtaining candidates’ consent, deleting or destroying the data of unsuccessful candidates as prescribed, retention periods for employee data and the use of technology in HR management. Exceptions regarding the retention, deletion or destruction of data must be determined by law or by lawful agreement.
FDI companies and multinational groups
Foreign-invested enterprises often use HR, client or accounting management systems shared with their parent company and other group entities, which raises specific issues of employee personal data protection for FDI companies in Vietnam.
Applying a global data protection policy does not automatically ensure full compliance with Vietnamese law.
FDI companies and other foreign-invested enterprises should consider:
- Whether the group policy complies with Vietnamese law;
- The role and responsibilities of the Vietnamese legal entity;
- Data access rights of the parent company and affiliates;
- Data protection mechanisms on ERP, CRM and HRM systems;
- Conditions for sharing and transferring personal data abroad;
- The language and form of publishing the policy to employees and clients in Vietnam.
Viet An Law Firm assists in reviewing and developing a Vietnam local data protection policy, while ensuring the necessary consistency with the group’s internal policy system.
Legal scenario: An FDI company using its parent company’s data protection policy
For example, a foreign-invested company operating in Vietnam uses HRM and CRM systems shared with its parent company in Singapore. Employee and client data in Vietnam is stored on a cloud platform, and some group staff abroad are granted access rights.
The company already has a data protection policy based on international standards but has not developed a document specifically applicable in Vietnam.
In this case, the business should consider the following legal issues:
- Suitability of the global policy: Does the existing policy meet Vietnamese legal requirements on personal data processing?
- Role of the Vietnamese legal entity: What responsibilities do the Vietnamese company and the parent company bear for each data processing activity?
- Cross-border data access: Does the parent company’s access to data in Vietnam give rise to legal obligations relating to the cross-border transfer of personal data?
- Employee data protection: Does the policy fully reflect the requirements for recruitment data, HR management data and data collected via technology systems?
- Language and method of publication: Does the group’s English-language policy need a Vietnamese version or specialized documents for data subjects in Vietnam?
Viet An Law Firm’s advisory solution: Review the parent company’s data protection policy, compare it with Vietnamese law and draft a Vietnam local data protection policy. At the same time, advise on the contents that need to be aligned with HR policies, privacy policies and related documents.
Developing a separate policy does not replace the obligation to carry out a personal data processing impact assessment in Vietnam or the cross-border personal data transfer obligations where the business falls within the cases required by law.
Technology, software and online platform businesses
Businesses providing software, mobile applications, e-commerce platforms or software as a service (SaaS) often process user data through multiple systems, analytics tools and service providers.
The policy should be built around actual data flows, including account registration, user authentication, use of cookies and tracking technologies, behavioral analytics, client care and account management.
In particular, the information published in the policy must be consistent with the actual functions of the website, application and integrated third parties.
Key contents when drafting a personal data processing policy in Vietnam
A personal data processing policy should be developed based on the business’s actual operations and comply with the Law on Personal Data Protection 2025 and its guiding regulations. Depending on the business sector, the policy should focus on the following groups of contents:
Scope, data types and processing purposes
Identify the subjects of application, the types of basic and sensitive personal data, and the purposes of data collection and use. At the same time, businesses need to distinguish processing based on the data subject’s consent from cases where the law permits processing without consent.
Collection, use, storage and sharing of personal data
Regulate the methods of collection, scope of use, retention periods and conditions for sharing data with partners, service providers or entities within the same group. For foreign-invested enterprises, the mechanisms for accessing and transferring personal data abroad should be considered.
Data subject rights and business responsibilities
Establish a mechanism for receiving, verifying and handling data subjects’ requests, and define the responsibilities of the HR, legal, IT and management departments in implementing the policy.
Protection measures and handling of personal data incidents
Set out principles on security, access rights, control over data use and responsibilities for reporting and coordinating when an incident occurs. The measures stated in the policy must be consistent with the business’s actual governance capacity and technology systems.
Issuing, publishing and updating the policy
Determine the approval authority, methods of communicating the policy, effective date and responsibilities for reviewing and updating it when the law, processing purposes or business model change.
For businesses that recruit and manage employees, the policy should also address the specific requirements under Article 25 of the Law on Personal Data Protection 2025, especially regarding the handling of unsuccessful candidates’ records, the retention of employee data after contract termination and the processing of data collected through technological labor management measures.
Sample structure of a personal data protection policy for businesses in Vietnam
A policy drafted specifically for a business’s operations may include the following articles:
| Article | Content |
| Article 1 | Purpose, scope and subjects of application |
| Article 2 | Definitions and data processing principles |
| Article 3 | Types of personal data collected and processed |
| Article 4 | Purposes and legal bases for data processing |
| Article 5 | Methods of data collection and use |
| Article 6 | Data sharing and recipients |
| Article 7 | Transfer of personal data abroad, if any |
| Article 8 | Retention period, deletion and destruction of data |
| Article 9 | Rights of data subjects |
| Article 10 | Security measures and access rights |
| Article 11 | Responsibilities of departments and personnel |
| Article 12 | Receipt of requests, incident handling and complaints |
| Article 13 | Effect, amendment and implementation |
This is a suggested reference structure, not a mandatory template for all businesses. The content and level of detail should be adjusted according to the type of policy, the data processing model and the characteristics of the business.
A data protection policy for FDI companies may be drafted in both Vietnamese and English to serve both domestic application and internal group governance.
Distinguishing a personal data protection policy from related documents in Vietnam
| Document | Main purpose | Characteristics |
| Personal data protection policy | Establishing principles and rules for data processing and protection | Internal governance or public document, depending on the purpose |
| Privacy policy | Providing information on how the business processes user data | Usually published on websites and applications |
| Personal data processing notice | Fulfilling the obligation to notify of processing activities | Directed at data subjects |
| Consent to data processing | Recording valid consent where required by law | May be expressed by an appropriate lawful method |
| Data processing agreement (DPA) | Establishing obligations and responsibilities between the data processing parties | Agreement or contract |
| Personal data processing impact assessment dossier | Assessing processing activities, risks and protection measures as required by law | A dossier with its own content, forms and implementation mechanism |
Legal note: Under the Law on Personal Data Protection No. 91/2025/QH15 and Decree 356/2025/ND-CP, effective from January 1, 2026, developing and publishing a policy must be considered within the overall personal data protection obligations of the business. Data protection policies, processing notices, consent documents and the dossier of personal data processing impact assessment in Vietnam serve different functions. Issuing a policy does not automatically replace other documents or procedures where required by law.
Common mistakes when using ready-made personal data protection policy templates in Vietnam
Copying another company’s policy
Each business has its own organizational structure, technology systems, and data processing purposes and methods. Copying a policy from another business may lead to inaccurate information or commitments beyond its capacity.
Translating a GDPR privacy policy template verbatim
A privacy policy under the European Union’s General Data Protection Regulation (GDPR) may be a useful reference, but it does not automatically fully satisfy Vietnam’s Law on Personal Data Protection and the applicable sector-specific regulations.
For FDI companies, the compatibility between the global policy and the mechanism applied in Vietnam should be reviewed through GDPR policy localisation in Vietnam rather than a mere translation of the content.
Failing to distinguish internal and public policies
Public policies usually serve the goal of transparency towards data subjects. Meanwhile, internal policies may need more detailed rules on responsibilities, access rights, supervision and operating procedures.
Combining both purposes in one unsuitable document may make the policy overly complex or leave out necessary provisions.
Absolute security commitments
Statements such as “the business guarantees that data will never be disclosed” may create unrealistic commitments.
Businesses should describe appropriate protection measures and implementation responsibilities instead of giving absolute guarantees.
Having a policy but not implementing it in practice
Even a fully drafted policy may be ineffective if employees are not informed of it, systems lack appropriate access controls or the business has not set up a mechanism for receiving requests.
Therefore, drafting should be accompanied by guidance on approving, publishing and applying the policy.
Viet An Law Firm’s personal data protection policy drafting services for businesses in Vietnam
Viet An Law Firm provides personal data protection legal services, including developing, reviewing, amending and finalizing personal data processing policies for businesses under Vietnamese law.
Drafting new personal data protection policies
This service suits businesses that do not yet have a policy or are launching new business activities, recruitment, websites, applications or data processing systems.
The scope of work may include:
- Receiving information on data processing activities;
- Identifying the subjects and scope of the policy;
- Reviewing data types, purposes and processing methods;
- Building the policy structure and clauses;
- Preparing the draft;
- Receiving feedback and finalizing the content;
- Guiding the approval, issuance and publication of the policy.
Data protection policy compliance review and updates
For businesses that already have a privacy policy or data processing policy, Viet An Law Firm conducts a privacy policy review to check its compliance with the Law on Personal Data Protection 2025 and Decree 356/2025/ND-CP.
The privacy policy review focuses on the content of the document, its consistency with actual processing activities and the clauses that need to be amended or supplemented.
Privacy policy drafting services for websites and applications
Viet An Law Firm assists in developing a privacy policy suited to data collection activities on websites, applications and online platforms.
The content is tailored to the collection methods, technologies used, processing purposes, partners with whom data is shared and user interaction mechanisms.
The policy should be aligned with registration forms, data processing notices and consent mechanisms where required by law.
Drafting HR data protection policies
This service focuses on developing policies for processing the data of candidates, employees and management personnel, including employee personal data protection for FDI companies in Vietnam.
Key contents include the collection of recruitment records, contract management, timekeeping, payroll, insurance, cameras, biometric data and data sharing with HR service providers.
Drafting a data protection policy for FDI companies
For FDI companies, Viet An Law Firm can assist with:
- Reviewing the parent company’s global policy;
- Drafting a policy applicable specifically in Vietnam;
- Adjusting clauses that are incompatible with Vietnamese law;
- Developing bilingual Vietnamese – English policies;
- Clarifying the responsibilities of the Vietnamese legal entity and the implementing departments;
- Advising on mechanisms for publishing, applying and updating the policy.
Documents businesses in Vietnam need to provide
To carry out the drafting of a personal data processing policy, businesses should prepare documents relevant to the scope of work, such as:
- Legal information and business lines of the company;
- A description of data collection, storage, use and sharing activities;
- A list of websites, applications, CRM, HRM or related software systems;
- Forms used to collect information from clients, employees and partners;
- Security or privacy policies or internal regulations currently in force;
- A list of supplier and partner groups with access to data;
- The group’s global policy, if any;
- Requirements on language, scope of application and method of publication.
Businesses do not necessarily have to provide actual personal data of clients or employees for drafting purposes. Anonymized documents, data descriptions or sample forms may be used where appropriate.
Process of personal data protection policy drafting in Vietnam
Step 1. Receiving the request and defining the policy scope
Viet An Law Firm discusses with the business the type of policy to be developed, the subjects of application, the number of systems and the related data processing activities.
Step 2. Reviewing documents and actual data processing activities
Our lawyers examine the existing documents, processing purposes and the groups of clauses to be reflected in the policy.
Step 3. Building the structure and preparing the draft
Viet An Law Firm proposes the document structure, drafts the clauses and adjusts the content according to the law, industry and business model.
Step 4. Collecting feedback and finalizing the policy
The draft is sent to the business for review. Our lawyers receive feedback from the legal, HR, technology or management departments and finalize the policy within the agreed scope.
Step 5. Handover and implementation guidance
Viet An Law Firm hands over the finalized policy, explains its key clauses and advises on how to approve, publish, communicate or update it when necessary.
Deliverables when using Viet An Law Firm’s policy drafting services
Unlike ready-made personal data protection policy templates, Viet An Law Firm’s services aim to develop documents tailored to each business’s sector, data types, processing purposes and governance structure.
Depending on the scope of services, Viet An Law Firm may provide the following documents:
| Deliverable | Content and practical value |
| Internal personal data protection policy | Sets out data processing principles, departmental responsibilities, access rights, data retention and security |
| Privacy policy | Discloses data processing information to clients and website or application users |
| Employee data protection policy | Regulates the management of recruitment data, employment contracts, salaries, timekeeping and HR records |
| Vietnam-specific policy for FDI companies | Adapts the group’s global policy to Vietnamese law and actual operations in Vietnam |
| Bilingual Vietnamese – English policy | Supports FDI companies’ governance and communication with the parent company, investors or partners |
| Review table and proposed amendments | Presents the results of the data protection policy compliance review and identifies clauses that are unsuitable or need to be supplemented or adjusted |
| Issuance and implementation guidance | Advises on approving, communicating, publishing and updating the policy within the business |
Businesses may choose to draft a standalone policy or develop a set of personal data protection policies for multiple groups of subjects. The scope of work, number of documents, languages and supporting documents are specified in the legal services contract.
The value of the service lies not only in the drafted document but also in its legal compliance, practical feasibility and the consistency between the policy and the business’s data processing activities.
Cost of drafting a personal data protection policy in Vietnam
Service fees depend on the characteristics and complexity of the policy to be developed.
Factors affecting the quotation include:
- Drafting a new policy or reviewing an existing one;
- Internal or public policy;
- Number of data subject groups;
- Types of personal data processed;
- Number of systems, departments or legal entities involved;
- Whether data is shared with third parties or transferred abroad;
- Bilingual drafting requirements;
- Number of policy versions and scope of implementation support.
For FDI companies, technology companies or groups with multiple entities, the policy may be developed in phases to fit their compliance plan and budget.
Viet An Law Firm receives information and provides a service quotation based on each client’s specific scope of work.
Why should businesses in Vietnam choose Viet An Law Firm’s drafting services?
A personal data processing policy is a legal and governance document that requires a combination of legal knowledge and practical understanding of business operations.
Viet An Law Firm approaches the drafting service as follows:
- Compliance with Vietnamese law: Developing content based on the personal data protection regulations in force.
- Tailored to the business model: Adjusting clauses to the industry, operations and data processing systems.
- Clear responsibilities: Distinguishing the obligations of the business, its employees and related parties.
- Limiting unfavorable commitments: Reviewing clauses that are overly broad, impractical or lack a legal basis.
- Easy implementation: Guiding businesses to issue, publish and apply the policy in practice.
- Support for FDI companies: Reviewing foreign policies and developing documents suited to operations in Vietnam.
The service aims not only to complete a policy document but also to help businesses establish clear and feasible data processing rules in line with their legal obligations.
Legal basis for drafting personal data processing policies in Vietnam
Legal documents to note include:
- Law on Personal Data Protection No. 91/2025/QH15, effective from January 1, 2026;
- Decree 356/2025/ND-CP detailing a number of articles of and measures to implement the Law on Personal Data Protection;
- Civil Code 2015 and regulations on the protection of private life and personal secrets;
- Laws on cybersecurity, network information security and electronic transactions, to the extent applicable;
- Sector-specific regulations on the data of employees, clients and consumers and on specific processing activities.
Businesses that developed policies under Decree 13/2023/ND-CP need to review and update them in line with the legal framework applicable from 2026, and personal data processing legal advisory services in Vietnam can support this transition.
Frequently asked questions about drafting a personal data protection policy
Is a business required to have a personal data protection policy?
It should not be understood that every business must issue a standalone document titled “Personal data protection policy” using the same template. However, businesses must meet the personal data protection obligations applicable to their actual activities. A policy is an important tool for organizing and managing the performance of those obligations.
Does a personal data protection policy need to be registered with the Ministry of Public Security?
There is no general registration procedure applicable to all personal data protection policy documents. Businesses need to distinguish issuing a policy from the obligation to prepare, submit or update an impact assessment dossier and other obligations where required by law.
Can a ready-made personal data protection policy template be used?
Businesses may refer to policy templates but should adapt them to their industry, data types, processing purposes and actual business model. Copying a template verbatim may result in missing mandatory content or non-compliance with Vietnamese law.
Does a personal data protection policy replace the privacy policy and consent documents?
Not automatically. A personal data protection policy, a privacy policy and a consent to data processing serve different functions. Businesses need to determine the appropriate documents and mechanisms for each data processing activity.
Can an FDI company use its parent company’s GDPR-based policy?
The parent company’s policy may be used as a reference but must be reviewed and adjusted under Vietnamese law. FDI companies should consider GDPR policy localisation in Vietnam by developing a policy applicable specifically in Vietnam, especially when processing employee or client data or sharing data with overseas entities.
What services does Viet An Law Firm provide for drafting personal data protection policies?
Viet An Law Firm drafts, reviews and updates internal personal data protection policies, website privacy policies, employee data processing policies and policies for FDI companies as part of its personal data processing legal advisory services in Vietnam. The services can be performed in Vietnamese, English or bilingually at the client’s request.
Conclusion on personal data protection policies for businesses in Vietnam
Using personal data protection policy drafting services for businesses in Vietnam is not only about building an information security document but also about defining the principles, scope and responsibilities for data processing in business operations. The policy must accurately reflect the types of data processed, purposes of use, protection mechanisms and the rights of data subjects under Vietnamese law.
Viet An Law Firm provides personal data protection legal services, including drafting, reviewing and updating policies for Vietnamese businesses, FDI companies and multinational groups. Clients who need privacy policy drafting services, HR data processing policies or a complete personal data protection documentation system may contact Viet An Law Firm for advice and a suitable quotation.
Author: Do Quynh Trang – Trainee lawyer
Lawyer in charge of expertise and content review: Lawyer Trung Thi Lieu
Legal update: October 30, 2026
Hotline | Zalo | WhatsApp: (+84) 961 571 818
Email: info@vietanlaw.com
Hanoi office: 3rd Floor, Hoang Ngan Plaza Building, 125 Hoang Ngan Street, Yen Hoa Ward, Hanoi.
Ho Chi Minh City office: Room 2.26–2.27, Charmington La Pointe Building, 181 Cao Thang Street, Hoa Hung Ward, Ho Chi Minh City.
