Law on Personal Data Protection — cross-border transfer of personal data

Vietnam's definition of a transfer is the part that catches businesses out. Decree 356 treats as a cross-border transfer not just sending data to a foreign recipient but STORING personal data on server systems located outside Vietnam or on a foreign provider's cloud service, and processing Vietnamese-collected data on overseas platforms — so ordinary use of a non-Vietnamese SaaS or cloud region is in scope. Transfers require a cross-border transfer impact assessment dossier, which must be kept available for inspection by the data protection authority and submitted within 60 days of the transfer. Decree 356 exempts several categories, including cross-border personnel management, transfers to fulfil legal obligations, and transfers to perform contracts or procedures for cross-border transport, logistics, remittance and payment. Penalties for cross-border transfer violations run to 5% of the previous year's Vietnamese revenue. Marked 'check': the Law and Decree are very recent, the primary texts are Vietnamese-language, and enforcement practice does not yet exist.