Companies that process personal data in Việt Nam have been filing their impact-assessment dossiers with one agency in Hà Nội since the Personal Data Protection Law (Luật Bảo vệ dữ liệu cá nhân) and its implementing decree took effect on 1 January 2026. A new government decree changes who reviews those files, how long the review takes and what result a company can get back.
The change sits inside a long omnibus decree whose title is mainly about security-order business conditions. It is easy to miss, so this post goes through the data-protection part first and then the identity (VNeID) changes that sit next to it.
The document
- Number: Nghị định 392/2026/NĐ-CP, “Sửa đổi, bổ sung các Nghị định có liên quan đến thủ tục hành chính, điều kiện đầu tư kinh doanh trong lĩnh vực an ninh, trật tự”.
- Issued by: the Government, on the proposal of the Minister of Public Security; signed by Deputy Prime Minister Phạm Gia Túc.
- Signed: 20 October 2026. The signed scan was posted on the government legal documents portal on 21 October.
- Effective: 15 November 2026 (Điều 48).
- Size: 8 chapters, 51 articles. It amends seven decrees: 96/2016 (security-order conditions for conditional businesses), 99/2016 (seals), 137/2020 (fireworks), 69/2024 (electronic identification and authentication), 70/2024 (the Identity Law), 149/2024 (weapons, explosives and support tools) and 356/2025 (the personal data protection decree). Điều 50 also deletes or adjusts cross-references in several other decrees, including Nghị định 347/2026 on data products and services.
The legal bases listed include the Personal Data Protection Law 97/2025/QH15 and the Identity Law 26/2023/QH15.
Chapter VII: what changes in the personal data decree
Provincial police can now handle the files
Under the original Nghị định 356/2025, impact-assessment dossiers went to the specialised personal data protection agency of the Ministry of Public Security, and that agency alone reviewed them.
From 15 November, the ministry’s agency still receives and classifies every dossier. It then forwards files to provincial police (Công an cấp tỉnh) for handling, using criteria based on location, scale and sector that the Minister of Public Security will set (new khoản 5, Điều 18 and Điều 19). Dossiers must now be kept available for inspection by both the central agency and provincial police. Provincial police can also apply administrative penalties when a company does not complete a deficient file.
This applies to both kinds of dossier:
- the personal data processing impact assessment (hồ sơ đánh giá tác động xử lý dữ liệu cá nhân, Điều 19), and
- the cross-border transfer impact assessment (hồ sơ đánh giá tác động chuyển dữ liệu cá nhân xuyên biên giới, Điều 18).
LuatVietnam’s annotated text of Nghị định 356 links these amendments to Nghị quyết 22/2026/NQ-CP. That resolution had already listed the procedures for simplification, with the ministry receiving and classifying files and passing them to provincial police. Nghị định 392 turns that plan into binding text.
Review deadlines in working days, and three possible results
| Nghị định 356/2025 (before) | After Nghị định 392/2026 | |
|---|---|---|
| Deadline to file after processing or transfer begins | 60 days | 60 days (unchanged) |
| Review of an impact-assessment dossier | 15 days | 11 working days |
| Possible results | meets / does not meet requirements | pass / pass but needs supplementing / fail |
| Time to complete a deficient dossier | 30 days | 30 days (unchanged) |
| Filing channel (processing dossier, updates) | “online”, in person or by post | National Public Service Portal, in person or by post |
Fifteen calendar days and eleven working days come to roughly the same length of time, so this is mainly a change of unit rather than a faster review. The more practical change is the middle result, “đạt cần bổ sung” (pass, needs supplementing). Under the old rule a file either passed or failed. The new wording separates files that are broadly acceptable but missing items from files that fail outright.
The cross-border transfer dossier still says “online, in person or by post”. The processing dossier and dossier updates (Điều 20) now name the National Public Service Portal as the online channel.
A new link to the Ministry of Defence
A new khoản 2a in Điều 17 says that if the Ministry of Public Security finds a risk to national defence in cross-border transfers of personal data of serving military officers, professional soldiers, defence workers and enlisted personnel, it informs the Ministry of Defence in writing so that ministry can act within its powers. The provision assigns duties between ministries. It does not add a new filing step for companies.
Data-processing service licence: shorter file, faster turnaround
Businesses that sell personal data processing as a service need a certificate of eligibility (Giấy chứng nhận đủ điều kiện kinh doanh dịch vụ xử lý dữ liệu cá nhân). Điều 46 and 47 change the procedure:
- The copy of the business registration certificate is dropped from the application file. The new list has four items: the application (Mẫu số 04), the document appointing the data protection unit or the service contract, the project proposal (đề án), and staff qualifications.
- The initial assessment of whether the file is acceptable now takes 8 working days (previously 10 days). If something is missing, the agency must say so, with reasons, within 11 working days (previously 15 days).
- Re-issue and replacement are merged. Before, a lost or damaged paper certificate (Mẫu số 05) and a correction or change of details (Mẫu số 06) were separate procedures. Now one application on Mẫu số 06 covers all of these cases. It is filed through the National Public Service Portal, in person or by post and decided within 5 working days.
Transition
Any processing impact assessment, cross-border transfer assessment or licence application received before 15 November 2026 continues under the original Nghị định 356/2025 (Điều 49 khoản 3).
The identity chapters: VNeID becomes the default channel
Chapters IV and V amend the electronic identification decree (69/2024) and the Identity Law decree (70/2024):
- Level-2 electronic ID accounts can be requested at any commune-level police station, regardless of place of residence. Applicants bring a valid citizen ID card and give their own registered mobile number. The result is sent through VNeID, by SMS or by email.
- Children under 14 and people under guardianship apply together with their representative, using the representative’s own registered mobile number.
- Organisation accounts: a legal representative or head of the organisation logs in to VNeID with their own level-2 account and applies on the organisation’s behalf. If the organisation has other legal representatives, all of them must consent first. A paper form (TK02) can still be filed at any convenient commune police station.
- Citizens can ask to have DNA and voice biometrics added to the identity database at commune police stations or through VNeID. Records already held by a qualified lab are checked and matched within 7 working days.
- Adding or updating information on the identity card can be requested through the National Public Service Portal, VNeID or the commune police.
In the security-order chapters, many filings, such as seal registration and fireworks permits, can now be made through the National Public Service Portal or VNeID. For in-person filings, the applicant gives their personal identification number. Casinos and betting venues must check guests’ personal information on VNeID or on an identity document (new Điều 33 of Nghị định 96/2016).
Who is affected
- Any company filing personal data impact assessments, including foreign companies transferring Vietnamese users’ data abroad. Your file may now be reviewed by provincial police in the province where you operate, and they can also inspect it and impose penalties.
- Licensed or prospective personal data processing service providers. The application is lighter and the deadlines are shorter.
- Legal and compliance teams handling identity onboarding. Organisation VNeID accounts and minors’ accounts now have clearer procedures.
Open questions
- The routing criteria (“địa bàn, quy mô, lĩnh vực”) are left to a decision of the Minister of Public Security. Until that is published, nobody knows which files stay central and which go to a province.
- “Pass, needs supplementing”: the decree does not say whether supplementing restarts the 11-working-day clock or how the 30-day completion period interacts with it.
- Consistency across 34 provincial police forces. Spreading review across provinces should spread the workload. It also raises the risk of different provinces reading the same rules differently.
Sources
- Nghị định 392/2026/NĐ-CP — signed text (VPCP, PDF)
- Government legal documents portal — list of new documents
- LuatVietnam — Nghị định 392/2026/NĐ-CP
- LuatVietnam — Nghị định 356/2025/NĐ-CP, annotated with the 392/2026 amendments
This post is general information, not legal advice.