vn-pdpl

Identify your role as controller or processor, map your data inventory into basic versus sensitive categories, then check consent mechanisms, rights response procedures, cross-border transfer flows, DPIA obligations, and DPO appointment. The skill outputs a prioritised gap register with remediation owners and timelines.

Acknowledge any request within 2 working days. Fulfil access and correction requests within 10 working days, deletion within 20 working days, and consent withdrawal or restriction within 15 working days, per Decree 356 Article 5. One extension is allowed if the data subject is notified.

Yes, transferring Vietnamese data subjects' personal data abroad requires submitting an impact assessment dossier to the Ministry of Public Security within 60 days of the first transfer, updated every 6 months. Exemptions cover state agencies, employee HR data in cloud systems, and data subjects transferring their own data.

Controllers must notify the personal data protection authority within 72 hours of becoming aware of a breach, and notify affected data subjects simultaneously or as soon as practicable. The finance sector requires mandatory simultaneous notification to both the authority and data subjects.

Small and micro enterprises may opt out of DPIA, security measure, and certain processor obligations for 5 years from January 1, 2026. The exemption does not apply if they process sensitive personal data or process data at large scale.

Consent must be voluntary, explicit, specific per purpose, informed, and recorded through verifiable methods such as signed documents, recorded calls, SMS, email, or web forms. Silence, pre-ticked boxes, and bundled consent for unrelated purposes are invalid.