🗓️ Legal Roundup · Education · Finance · Governance · In a Legal Nutshell

Happy Calends! Eight New Vietnamese Rules That Took Effect on November 1, 2026 🗓️📜

By Nguyen Le Bao Ngoc (Ngoc Prinny) · Consulted by Ls. Le Thi Kim Dung and Ls. Nguyen Van Diep of Thay Diep & Associates Law Firm

📖 Word Nerd Corner: Why the First of the Month Is a Big Deal

The word "calendar" comes from the Latin kalendae (the "calends"), the first day of the Roman month, when the new month was formally announced. It was also the day when debts and interest came due, and the account book that tracked them was called a calendarium. 📒 So the first of the month has been "settling up day" for about two thousand years. Fitting, then, that on November 1, 2026, eight new Vietnamese rules came due all at once, covering schools, poverty lines, credit data, green loans, court debts, credit funds, digital paperwork, and human rights. Let's open the account book. 📖

1️⃣ 📚 Compulsory Education Gets a New Decree (Decree 353/2026/NĐ-CP)

Decree 353/2026/NĐ-CP replaces Decree 20/2014/NĐ-CP on universalizing education and eliminating illiteracy.

• 👧 Who falls under compulsory education (Articles 13 and 17): children aged 6 to 14 who haven't completed primary school, and adolescents and young people aged 11 to 18 who finished primary school but not lower secondary school.
• 📘 Duties (Article 8, Clauses 1 and 2): citizens of the relevant age have a duty to study to complete compulsory education, and families and guardians must make that possible. People past the age range are supported to study in suitable forms.
• 🔄 What changed: the lower secondary age group is still 11 to 18, as it was under Article 12 of Decree 20/2014. The shift is in framing: from a framework for universalizing lower secondary education to organizing compulsory lower secondary education, tied to the duty to complete the program and to the responsibilities of families and schools.

🧒 Everyday picture: Student Sam finished primary school at 11 but then stopped attending lower secondary school. Under the new framing, Sam's family and school have clear responsibilities to help Sam complete it, and Sam is within the 11-to-18 compulsory age range until then.

2️⃣ 🏘️ Hanoi Raises Its Poverty Income Line (Decision 149/2026/QĐ-UBND)

Hanoi's multidimensional poverty income thresholds for 2027–2030 (Article 2, Clause 1):

Area	2022–2025 (Decision 13/2021/QĐ-UBND)	2027–2030 (Decision 149/2026/QĐ-UBND)
Rural	VND 2,000,000 per person per month	VND 3,000,000 (+1 million)
Urban	VND 2,500,000 per person per month	VND 3,500,000 (+1 million)

Under Article 3 (Clauses 1 and 2), for a household whose income does not exceed the threshold:

• 🔴 Poor household: deprived in 3 or more basic social service indicators
• 🟠 Near-poor household: deprived in fewer than 3 indicators

So low income alone isn't the only test. The decision took effect on November 1, 2026, but support policies under the new standard apply from January 1, 2027, after the household is recognized by the competent authority.

⚠️ Scope check: this is a Hanoi decision. It sets Hanoi's thresholds, not national ones.

🏠 Everyday picture: Household Hoa lives in urban Hanoi with income under VND 3.5 million per person per month. Whether Hoa's household counts as poor, near-poor, or neither depends on the second test too: how many basic social services the household lacks. And any support starts from 2027, once the household is officially recognized.

3️⃣ 💳 Clearer Consent Rules for Credit Information (Circular 46/2026/TT-NHNN)

Effective November 1, 2026, Circular 46 adds requirements on borrower consent in credit information activities. Under Article 6, Clause 2 (adding Clause 7 to Article 12 of Circular 15/2023/TT-NHNN), providing a borrower's information to certain recipients needs the borrower's consent, and must comply with the contract with the Credit Information Center (CIC). The recipients named are voluntary participating organizations, foreign credit information organizations, and other organizations in the specified groups.

• ✍️ Form of consent: clear, specific, and capable of being printed or copied in writing, including electronically or in another verifiable format
• 🔁 Also applies in the other direction: Article 9 sets the same requirement for voluntary organizations that provide information to the CIC
• 📚 Before vs. now: Clause 1 of Article 17 of Circular 15/2023/TT-NHNN already required voluntary organizations to ensure customer consent. The new part is more specific rules on how consent is expressed, whether it can be verified, and compliance with personal data protection law.

🏦 Everyday picture: Borrower Bao signs up for a loan. If the lender later wants to share Bao's information with a covered organization, a vague checkbox buried in the terms won't be a strong basis. Bao's consent should be clear, specific, and recorded in a form that can be produced later.

4️⃣ 🌱 How to Prove a Project Is "Green" (Decision 46/2026/QĐ-TTg)

Decision 46/2026/QĐ-TTg, effective November 1, 2026, guides how to determine green projects and projects meeting circular economy criteria, and how to apply the ESG framework.

• 🔎 Independent assessment (Article 4, Clause 1): the determination is made through an independent assessment organization that meets the requirements.
• 💸 Link to interest support (Article 5, Clause 5): a project found to qualify, with a report on applying the ESG framework, is a basis for considering interest rate support.
• 📜 Background: Article 7, Clause 1 of Resolution 198/2025/QH15 already provides a 2% per year interest rate support for private enterprises, households, and individual businesses borrowing for green and circular projects and applying ESG. The new Decision makes the criteria, dossier, and assessment mechanism concrete.

⚠️ Don't skip this: being identified as a green or circular project does not automatically mean receiving the interest support. Other applicable requirements must still be met.

🏭 Everyday picture: EcoBrew Ltd. plans a water-recycling upgrade at its factory. To be considered for interest support, it would go through an independent assessor to establish the project is green or circular and prepare its ESG framework report, then still satisfy the rest of the support rules.

5️⃣ ⚖️ Late-Enforcement Interest Follows the Waiver (Joint Circular 11/2026/TTLT-BTP-TANDTC-VKSNDTC)

Under Article 10, Clause 3: when the amount a debtor must pay under a judgment or decision is waived or reduced, the late-enforcement interest on that amount is automatically waived or reduced too.

• ⏪ Older waivers: where a waiver or reduction decision was made before July 1, 2026, the corresponding interest is automatically waived or reduced, and the head of the civil judgment enforcement agency issues a decision to terminate enforcement of that interest portion.
• 📚 Before: Article 2 of Joint Circular 12/2015/TTLT-BTP-BTC-TANDTC-VKSNDTC listed late-enforcement interest on waived or reduced amounts among the items eligible for consideration. The new rule clarifies that the corresponding interest is dealt with automatically.

⚠️ Limit: this applies within the scope of amounts payable to the state budget. It does not mean every civil debt or late-payment interest between individuals or businesses can be waived.

🧾 Everyday picture: Debtor Dan owes a budget-related amount under a judgment, and part of it is waived. Under the new rule, the late-enforcement interest on that waived part falls away automatically, without needing a separate waiver request for the interest.

6️⃣ 🏦 People's Credit Funds: Send Internal Rules Within 10 Days (Circular 40/2026/TT-NHNN)

Circular 40/2026/TT-NHNN, effective November 1, 2026, restates the limits and safety ratios for people's credit funds. Under Article 5, Clause 7, within 10 days of issuing, amending, supplementing, or replacing its internal rules, a fund must send the text to the State Bank regional branch, with a report on the changes if any.

Under Clause 6 of Article 4 of Circular 32/2015/TT-NHNN (as amended by Circular 13/2024/TT-NHNN), the earlier period was 10 working days. The source notes the new rule says 10 days, so funds need to adjust their filing schedule.

🤔 Did you know? "10 days" and "10 working days" are not the same deadline. Say a fund adopts new internal rules on Monday, November 2, 2026. Ten working days would run to about Monday, November 16 (ignoring holidays), while ten calendar days would end on Thursday, November 12. A bare "10 days" is typically read as calendar days, though it's worth confirming how the filing authority counts it. 📅

7️⃣ 🔏 Digitally Signed Documents Replace Paper in Government Exchanges (Decision 43/2026/QĐ-TTg)

From November 1, 2026, a properly digitally signed electronic document has the same legal value as the paper original and travels through the National Document Interconnection Axis, replacing paper sending and receiving, unless specialized law says otherwise.

• 🤖 The Axis automatically checks and warns about documents that are unsigned or have an invalid digital signature.
• 🧾 Every transaction must be authenticated and logged. Sending and receiving agencies must store the documents and keep their legal validity intact for the whole storage period.
• ⭐ The rules prioritize fully electronic documents: created, signed, issued, sent, and received entirely in the electronic environment, with no parallel paper copy and not a scan of paper. There is also a roadmap to minimize documents digitized from paper.

🏢 Everyday picture: Office Olivia works at a government agency. Instead of printing, stamping, and couriering a letter, she issues it digitally signed through the Axis. A scanned paper letter is the thing the system is nudging everyone away from.

8️⃣ 🕊️ Ministry of Justice Gains a Human Rights Function (Decree 383/2026/NĐ-CP)

Decree 383/2026/NĐ-CP, effective November 1, 2026, adds state management of protecting and ensuring human rights to the Ministry of Justice's functions. The Ministry acts as the focal point to advise on organizing implementation, and it:

• 📋 Monitors, gives professional guidance, disseminates and educates on the law, and checks implementation of human rights policies and laws
• 🌍 Proposes the signing of, accession to, and implementation of international human rights treaties within its management scope, and appraises, comments on, joins negotiations for, and carries out international cooperation in this field
• 📌 Continues as the national focal agency for implementing the International Covenant on Civil and Political Rights (ICCPR). That role was assigned earlier and now sits in a separate clause along with the new tasks.

📊 The Whole Month at a Glance

#	Rule	Who should care most
1	Decree 353/2026/NĐ-CP, compulsory education	Families, schools, local education authorities
2	Hanoi Decision 149/2026/QĐ-UBND, poverty line 2027–2030	Hanoi households and local officials
3	Circular 46/2026/TT-NHNN, credit information consent	Lenders, credit data participants, borrowers
4	Decision 46/2026/QĐ-TTg, green and circular projects	Private businesses seeking interest support
5	Joint Circular 11/2026/TTLT, enforcement interest	Judgment debtors owing state budget amounts, enforcement agencies
6	Circular 40/2026/TT-NHNN, people's credit funds	People's credit funds
7	Decision 43/2026/QĐ-TTg, e-documents	Government agencies and their correspondents
8	Decree 383/2026/NĐ-CP, human rights function	Ministry of Justice and related agencies

🌿 Nature's version: Scientists call it photoperiodism. When the days shorten, many living things respond to the same cue at once: trees drop leaves, some animals thicken their fur, birds head south. 🍂🦆 A legal effective date works like a day-length signal: one date, many different systems switching over together. The trick is noticing which of those changes applies to your own corner of the forest.

💡 Practical Tips

• Read the "what stays the same" part, too. Several of these rules mostly tighten or clarify existing ones (consent, enforcement interest, the 11-to-18 age range), so the real task is spotting the small differences.
• Watch the "scope" qualifiers. Hanoi-only, state-budget-only, and "not automatic" all appear above for a reason.
• Check your deadlines' units. "Days" versus "working days" can move a filing date by several days.
• Keep proof. For consent (Circular 46), green project assessment (Decision 46), and digital documents (Decision 43), the common thread is that evidence must be verifiable.
• Look for follow-up guidance. Many of these rules will be applied in practice through further instructions or forms, so confirm the current process with the relevant authority.

📝 Quick Self-Check Quiz

Q1. What age range does compulsory lower secondary education cover under Decree 353/2026?

Reveal answer

Young people aged 11 to 18 who completed primary school but not lower secondary school.

Q2. What are Hanoi's new income thresholds for 2027–2030, and when does support under them begin?

Reveal answer

VND 3 million per person per month in rural areas and VND 3.5 million in urban areas. Support under the new standard starts January 1, 2027, after the household is recognized.

Q3. Does a project identified as "green" automatically receive interest rate support?

Reveal answer

No. The determination and ESG report are a basis for considering support, but other applicable requirements must also be met.

Q4. When a judgment amount owed to the state budget is waived, what happens to the late-enforcement interest on it?

Reveal answer

It is automatically waived or reduced as well. The rule is limited to state budget amounts, not private civil debts.

Q5. What is the legal value of a properly digitally signed electronic document under Decision 43/2026?

Reveal answer

The same as the paper original, and it can be exchanged through the National Document Interconnection Axis in place of paper, unless specialized law says otherwise.

😂 Vietnamese law on November 1: "Surprise! Eight new rules!" Everyone else: "Is any of this on the exam?" 📝😅

🗣️ Your Turn

Which of these eight will touch your life or work first: school, credit data, green financing, paperwork, or something else? Tell us in the comments, and if one of these raised a question, drop it below. 👇

---

🏷️ #VietnamLaw #NewRegulations #Nov2026 #CompulsoryEducation #CreditInformation #GreenFinance #EDocuments #HumanRights #ChinhSachMoi #NgocPrinny #DELULU #LegalEducation

SEO keywords: new Vietnamese laws November 1 2026, Decree 353/2026/NĐ-CP compulsory education, Hanoi poverty line 2027-2030, Circular 46/2026/TT-NHNN credit information consent, Decision 46/2026/QĐ-TTg green project ESG, Joint Circular 11/2026/TTLT-BTP-TANDTC-VKSNDTC, Decision 43/2026/QĐ-TTg electronic documents, Decree 383/2026/NĐ-CP human rights Ministry of Justice, chinh sach moi co hieu luc 01/11/2026.

Category: Legal Roundup · Regulatory Update

---

🚨 Fun But Serious: A Brief Legal Disclaimer 🚨

Hey there, legal explorer! 🕵️‍♂️ Before you act on any of the eight...

• This article is like a map, not a teleporter 🗺️ — it'll orient you, but it won't zap your legal problem away instantly.
• Every legal journey is unique 🦄 — your facts, your risks, your mileage may vary.
• For real-world quests, please summon a professional legal wizard 🧙‍♂️ (may we humbly suggest Thay Diep & Associates Law Firm?).

Reading this doesn't make you a lawyer, just like watching "Top Gun" doesn't make you a fighter pilot ✈️😉

Full disclaimer here: ngocprinny.blogspot.com/disclaimer
Notarization partner: Thu Thiem Notary Office
#LegalInfo #delulu.vn #NotLegalAdvice #ConsultAPro #NgocPrinny

💝 Support Your Legal Ninja's Wellness Fund! 🍵

Enjoyed Ngoc Prinny's witty legal wisdom on calends, credit data, and eight rules in one day? Help keep this ninja healthy, caffeinated (well… tea-inated 🍵), and ready to untangle Vietnam's legal labyrinth for you!

Every article is powered by:

• 📚 Hours of research
• ⚖️ 10+ years of legal expertise
• 📝 Creative storytelling
• 🍵 And lots of herbal tea

If this roundup saved you a few hours of digging, consider treating me to a green tea! 🌱
👉 Support Ngoc Prinny here

🌙 Nếu bạn đọc bài này vào buổi tối, chúc bạn ngủ thật ngon, không bị quy định mới nào làm xáo trộn giấc mơ 😴
☀️ Nếu bạn đọc vào buổi sáng, chúc bạn một ngày tràn đầy năng lượng, bắt đầu tháng mới thật suôn sẻ và nhiều niềm vui 😄
🍀 Dù đọc lúc nào, cũng chúc bạn luôn cập nhật kịp thời, hồ sơ đúng hạn và mọi thay đổi đều đến với bạn nhẹ nhàng!

🔐 Data Protection · Cross-Border Compliance · In a Legal Nutshell

Filing Is Not Complying: Why Handing In Vietnam's DPIA and CbTIA Is Only Half the Job 📑🌐

By Nguyen Le Bao Ngoc (Ngoc Prinny) · Consulted by Ls. Le Thi Kim Dung and Ls. Nguyen Van Diep of Thay Diep & Associates Law Firm

📖 Word Nerd Corner: "Data" Means "Things Given"

The word "data" is Latin for "things given": the plural of datum, from dare, "to give." 🎁 That little etymology is a useful compass for today's topic. Personal data is something a person gives to you, for a reason, under conditions. Vietnam's personal data law asks organizations to show their work: what exactly was given, to whom it went, and why you were entitled to it. Two assessment reports sit at the center of that: the DPIA and the CbTIA. Let's decode them. 🔓

🧭 The 30-Second Summary

• 📑 DPIA = Data Protection Impact Assessment (assessing the impact of processing personal data)
• 🌐 CbTIA = Cross-border Transfer Impact Assessment (assessing the impact of sending personal data abroad)
• ⏱️ General filing deadline: 60 days from when the relevant processing or transfer starts
• 🔑 The big idea: the reports are only as good as the evidence behind them. A beautifully filled form built on guesses is still a weak assessment.
• 📆 New on November 15, 2026: Decree 392/2026/NĐ-CP changes how filings are received, appraised, and updated.

🎭 Meet Our Example Company

🛍️ Lotus Mart
A Vietnamese retailer with stores plus an online shop, loyalty program, marketing campaigns, and customer support. Lots of customers, lots of data.

🧑‍💼 Compliance Officer Clara
Lotus Mart's data protection lead. She's been told: "Please file the DPIA and CbTIA by Friday."

☁️ Nimbus Cloud Ltd.
An overseas platform vendor that runs Lotus Mart's e-commerce system. It's about to become very important to Clara's report.

📜 The Legal Foundations

• ⚖️ Personal Data Protection Law (PDPL) No. 91/2025/QH15, effective January 1, 2026
• 📘 Decree 356/2025/NĐ-CP, the implementing decree, also effective January 1, 2026
• 👮 Decree 330/2026/NĐ-CP, issued and effective August 19, 2026, on administrative penalties
• 🆕 Decree 392/2026/NĐ-CP, issued October 20, 2026, effective November 15, 2026, amending the procedures

📑 DPIA: What the Law Asks For

Article 21 of the PDPL governs the DPIA. In general, data controllers and controller-processors must prepare, retain, and file the assessment within the prescribed time. A data processor has its own, separate duty to prepare and keep assessment documents as agreed with the controller. Don't assume a processor's obligations mirror the controller's.

Article 19 of Decree 356 lists three components of a DPIA dossier:

1. 📄 The DPIA report (Form 10): covering activities, purposes, data types, parties involved, data flow diagram, consent mechanisms, retention and deletion, system architecture, protective measures, compliance findings, processing risks, and risk mitigation
2. 🤝 Processing contracts or agreements: recording each party's responsibilities
3. 📚 Supporting governance documents: relevant policies, procedures, rules, and forms actually in use

🌐 CbTIA: What the Law Asks For

Article 20 of the PDPL covers cross-border transfers. It reaches three situations:

• 📦 Transferring personal data stored in Vietnam to a storage system abroad
• ✈️ Transferring personal data from Vietnam to organizations or individuals abroad
• 🖥️ Using a platform outside Vietnam to process personal data collected in Vietnam

⚠️ The third bullet catches people out. You don't have to deliberately "export a customer database" to be in scope. An overseas e-commerce platform, customer management system, cloud service, or analytics tool can bring your processing within Article 20.

Article 18 of Decree 356 lists the CbTIA dossier: the CbTIA report (Form 09), the cross-border transfer agreement, and supporting governance documents. Clause 3(i) specifically requires an assessment of the recipient abroad's data protection measures, the risks of transfer and cross-border processing, possible unintended consequences, and mitigation. Naming the company and attaching a signed cloud agreement is not enough.

🚪 What About Exemptions?

Not every organization or transfer faces the same requirements. Clause 6 of Article 20 PDPL and Article 17 of Decree 356 exempt certain situations from the CbTIA, including some cloud storage of employee data, transfers by competent state agencies, transfers made by the data subject themselves, and other specified cases. Clause 6 of Article 21 excludes competent state agencies from the DPIA requirement, and limited transitional or relief rules may apply to qualifying small businesses.

The key caution: assess exemptions against the actual facts. An exemption from one assessment does not remove other data protection duties, and a large company handling lots of customer information should start with a documented scoping assessment rather than assuming it is exempt.

🪞 Procedurally Complete vs. Substantively Ready

Procedural completeness ✅	Substantive readiness 🔍
Are the forms, contracts, supporting documents, and signatures all included and correctly prepared?	Does the dossier accurately explain the real processing, the legal basis, the risks, the safeguards actually in place, and the organization's true compliance status?

Both matter, but only the second tells you whether the assessment is true. The cleanest folder in the world can't rescue a conclusion with nothing behind it.

🧹 Myth-buster: Some administrative guides sort a filing into eight groups of supporting files (notification form, assessment report, data protection staff documents, policies, consent documents, contracts, diagrams, appendices). That can be handy for assembling a package, but it is not a general legal requirement for eight documents, and it doesn't prove that eight areas of compliance work have been done. Articles 18 and 19 of Decree 356 set out the actual components.

🛠️ What Needs to Exist Before the Report Can Be Trusted

The assessment is the end product of real work. The source article suggests a practical set of workstreams. To be clear: this is a recommended operating method, not a list of ten statutory forms.

Workstream	The question it answers
🗺️ Data discovery and mapping	What personal data exists, where does it live, how does it move, who can access it?
📋 Processing inventory	What activities and purposes exist, and who are the data subjects?
🤝 Vendor onboarding and due diligence	Who processes or receives the data, including subcontractors, and with what safeguards?
✅ Consent and legal basis	For each purpose, what makes the processing lawful, and can you prove it?
🏷️ Data classification	Which data is basic and which is sensitive, and what protection does each need?
📘 Policies and procedures	How are retention, deletion, protection, and handling run across the data lifecycle?
🔒 Technical security review	Are access controls, encryption, logging, and architecture actually as described?
⚖️ Risk analysis and mitigation	What could go wrong, how likely, how bad, and what risk is left over?
🌍 Cross-border recipient due diligence	What are the recipient's systems, safeguards, and onward transfers abroad?
🗂️ Governance and evidence upkeep	Who owns it, who reviews it, and how is it kept current?

🔎 Four Places Where Reports Tend to Wobble

• 1️⃣ The data map must match reality. Clause 3(c) of Article 19 requires a detailed description of processing and a data flow diagram. A diagram drawn from assumptions or an outdated architecture can miss important processing. Check it against what systems, integrations, and vendor arrangements actually do.
• 2️⃣ Vendor onboarding is more than attaching a contract. A signed agreement is part of the evidence. It doesn't show you assessed the vendor's actual handling, data location, sub-processors, safeguards, and unresolved risks.
• 3️⃣ Every purpose needs a legal basis. Consent is not the only lawful basis under Vietnamese law: Article 19 of the PDPL lists cases where processing can happen without consent. But a commercial interest doesn't create unlimited rights. Where consent is needed, you need a valid mechanism and verifiable proof, and attaching a consent template doesn't prove your site or app actually applies it.
• 4️⃣ Policies must describe controls that really operate. A retention policy doesn't prove data gets deleted. An access policy doesn't prove permissions are configured correctly. Keep operating evidence: configuration records, access reviews, deletion logs, security assessments, incident records. That is the difference between compliance on paper and compliance in operation.

🛒 A Worked Example: Clara's E-Commerce Surprise

Clara drafts a DPIA covering orders, accounts, and marketing, and a CbTIA naming Nimbus Cloud as the overseas platform. Looks complete. Then a technical review asks some awkward questions:

• 🌐 Does the website send personal data to analytics or advertising services abroad before the visitor has given consent?
• 🪪 Are marketing identifiers shared with other technology vendors?
• 📞 Do the customer support tool and logistics integrations add more processors?
• 🎁 Are loyalty records copied into an environment abroad?
• 🧑‍💻 Can an offshore tech team or subcontractor remotely access customer information?
• 🗺️ Do all of these show up in the processing inventory and the transfer map, and have all the recipients been assessed?

Each answer could change the assessment. If tracking technology moves data without valid consent or another lawful basis, saying "we collect consent" doesn't fix it. And a CbTIA that names only the main overseas vendor may be incomplete if other recipients or processing mechanisms were missed.

💡 The right response: investigate, record the actual position, assess compliance, fix the material gaps, and report accurately. Do not invent missing facts, and do not describe planned measures as if they were already in place. A sound assessment states the real environment, the real controls, the real risks, and the remediation still needed, rather than claiming everything is perfect.

🌿 Nature's version: Cargo ships take on ballast water in one port and discharge it in another, quietly carrying living organisms across oceans. The cargo manifest says "steel," yet species have moved. 🚢🦠 Hidden data flows work the same way: the paperwork can say "no overseas transfer" while a tracker, plugin, or remote-access tool is moving identifiers abroad. A good assessment checks the ballast tanks, not just the manifest.

⏱️ The 60-Day Clock Is Not a Grace Period

Articles 20 and 21 of the PDPL set a general 60-day filing deadline, subject to any exemptions. The trigger differs:

• 📑 DPIA: from when the in-scope personal data processing starts
• 🌐 CbTIA: from when the relevant cross-border transfer starts

These are two separate triggers. Also, Decree 356 requires DPIA documents to be prepared and kept from the start of processing, so the 60 days does not license unlawful processing, delayed safeguards, or ignoring consent duties. The clock doesn't restart when a new compliance officer is appointed or when the team decides to begin preparing the report. And filing late doesn't automatically cure an earlier violation.

The filing deadline runs from the processing or transfer itself, not from the day the compliance team decides to start writing.

🆕 What Changes on November 15, 2026 (Decree 392/2026/NĐ-CP)

As I write this on November 3, 2026, the change is less than two weeks away. Decree 392 amends Decree 356, and Chapter VII revises how DPIA and CbTIA dossiers are received, appraised, and updated.

What's New

• 👮 A bigger role for provincial police. Under amended Articles 18 and 19 of Decree 356, the specialized personal data protection agency under the Ministry of Public Security receives and classifies the initial dossier. It can then pass the dossier to provincial police for appraisal, based on locality, scale, and field. The Ministry remains the point of contact for initial filings.
• ⏱️ Appraisal timeline: from November 15, 2026, the competent authority must appraise and return a result within 11 working days. Possible results: pass, pass with supplements required, or fail. If a dossier is incomplete or non-compliant, the amended rules set a 30-day completion process.
• 🔄 Transition: before November 15, Decree 356 sets a 15-day appraisal. Article 49 of Decree 392 provides that dossiers already received before the effective date continue under the earlier procedure.
• 📬 Forms and submission: the main report forms stay Form 09 (CbTIA) and Form 10 (DPIA). The notification forms for organizations are Form 01a (CbTIA), Form 02a (DPIA), and Form 03a (updates). Forms 01b, 02b, and 03b are the equivalents for individuals. From November 15, filing can be done electronically, in person, or by post, and the amended DPIA rule names the National Public Service Portal.

⚠️ A pass is not a blessing. Having your dossier received or assessed as acceptable should not be read as the regulator approving all the underlying processing. And confirm the current submission method, accepted formats, and competent authority at the time of filing. Tips like emailing ZIP files or file-naming conventions may help in a given administrative process but shouldn't be mistaken for legal requirements.

🔁 Compliance Continues After the First Filing

Article 22 of the PDPL and Article 20 of Decree 356 treat the assessment as a living record.

Requirement	Timeframe	Notes
Initial filing	60 days	From start of in-scope processing or transfer
Appraisal, before Nov 15, 2026	15 days	Original Decree 356 procedure
Appraisal, from Nov 15, 2026	11 working days	As amended by Decree 392
Periodic update	6-month cycle	For specified changes, such as new processing or transfer purposes or changes in the parties involved
Prompt update	10 days	For specified changes in the organization, data protection service providers, and business activities
Completing a dossier	30 days	When completion or correction is needed

The six-month rule applies when a specified change occurs, with the cycle counted from the initial filing. It doesn't require every company to file a brand-new assessment every six months regardless. The ten-day rule applies to the particular events in Clause 2 of Article 20 of Decree 356, and not every technical change automatically triggers it. Still, you need a process for spotting changes in vendors, systems, activities, purposes, and overseas infrastructure and checking how each affects your assessment.

💸 When the Documents Don't Match Reality: Penalties (Decree 330/2026/NĐ-CP)

📑 DPIA violations (Article 55)

• Starting in-scope processing without preparing or keeping the required dossier, missing the filing deadline, or failing to update as required: some of these draw fines of VND 20–30 million
• Intentionally falsifying data, giving inaccurate information in the assessment dossier, or refusing to correct it when required: VND 50–100 million
• Remedies include being required to complete the dossier and, for specific violations, suspension of processing until the obligations are met

🌐 CbTIA violations (Article 56)

• Some failures to prepare, file, retain, or update a CbTIA: VND 30–50 million
• Other violations (on contractual safeguards, consent or notice, security measures, or cooperating with the authorities) can attract higher fixed fines

📈 Revenue-based fines of up to 5%

Clause 3 of Article 56 applies revenue-based fines to certain serious cross-border transfer violations. These involve unlawful conduct plus defined consequences, such as failing to prepare an assessment, or hiding or misreporting data flows, leading to a leak or loss of personal data. Tiers for qualifying violations:

Vietnamese citizens affected	Possible revenue-based fine
10,000 to under 100,000	1%–2%
100,000 to under 1 million	2%–3%
1 million or more	3%–5%

Article 56 also covers continuing a prohibited transfer after the authorities order it to stop, if it harms national defense or security. The calculation basis is Vietnam-market revenue in the preceding financial year, with alternative fixed fines where the decree's conditions are met.

⚠️ Don't over-read this. Having over a million customers, running an overseas platform, or simply not filing doesn't automatically trigger a 5% fine. A specific violation and the statutory conditions must be established. But the structure shows how seriously the framework treats accurate data-flow reporting and complete governance evidence.

🤔 Did you know? Look at the DPIA penalty bands again. Missing a deadline sits in one band (VND 20–30 million), while intentionally falsifying data or giving inaccurate information in the assessment can reach VND 50–100 million. In other words, an assessment that is filed on time but built on information that isn't true can be treated more harshly than one that is simply late. That is the whole theme of this post in one fine schedule. 🎯

✅ A Pre-Filing Readiness Check

The source article offers a 19-point checklist (a recommended method, not an official form). In condensed form, it asks four sets of questions:

• 🧭 Scope and accountability: Which legal entities are involved, and in what roles (controller, processor, transferor, recipient)? Do the DPIA and CbTIA duties apply, and do any exemptions truly fit? Have you recorded start dates and worked out the deadlines, including any that are already overdue? Who owns data protection governance?
• 🔎 Discovery and operating evidence: Do you have a structured inventory of processing activities? Are the data flows validated against real systems? Is there a legal basis, with proof, for each purpose? Have vendors, processors, and recipients been assessed? Is there evidence of security, retention, deletion, rights-handling, and incident response?
• ⚖️ Assessment readiness: Do you have a register of cross-border transfers (recipients, locations, purposes, data types)? Have you reviewed the recipients' protections? Have risks, existing controls, residual risk, and mitigation been assessed? Are gaps assigned to owners with actions and dates?
• 📤 Preparing and filing: Are Form 10 / Form 09 and all agreements, policies, diagrams, and supporting documents ready? Do the report, contracts, technical diagrams, and consent records all describe the same environment? Has management approved it, and has a qualified Vietnamese lawyer reviewed anything sensitive (exemptions, overdue filings, uncertain interpretations)? Have you confirmed the competent authority, forms, submission method, signatures, and proof of filing? Is there a process for ongoing updates?

🚦 Give Every Item a Status

Status	Meaning	Next step
🟢 Verified	Evidence exists and has been checked	Use or cite it in the assessment
🟠 Needs remediation	A weakness or control gap has been identified	Assign an owner, assess risk, set a fix
🟡 Not yet assessed	Facts or evidence are missing	Finish discovery and assessment
⚪ Not applicable	A documented legal or factual basis excludes it	Record the explanation and approval

⏰ An unfinished checklist doesn't pause the legal deadline. If you're late or close to the deadline, get legal advice on filing strategy and remediation. The goal is accurate, timely compliance, not indefinite delay while waiting for a perfect internal score.

🗃️ Building an Evidence Pack

A structured internal evidence library helps connect each conclusion in the report to its proof:

• 🏛️ Governance: appointments of data protection staff, responsibilities, competence, service agreements
• 🗺️ Processing and flows: processing register, classification, system catalog, architecture and flow diagrams
• ✅ Consent and legal basis: privacy notices, consent records, purpose assessments, withdrawal procedures
• 🤝 Vendors and transfers: due diligence, processing agreements, recipient files, transfer mechanisms
• 🔒 Controls: security policies, configuration evidence, access reviews, retention records, incident response
• ⚖️ Assessment and risk: the DPIA/CbTIA reports, recipient assessments, risk register, remediation actions, approvals

This creates a traceable chain between processing activities, legal duties, assessments, and evidence, which also makes updates and regulator requests far easier. Again, it's a recommended way to organize documents, not a substitute for the statutory components. And AI-assisted tools can help organize evidence and flag inconsistencies, but any automated conclusion must trace back to verified facts and stay under human oversight. Automation can't turn undocumented processing into verified processing.

💡 Practical Tips

• Start with a scoping memo. Document whether the DPIA and CbTIA duties apply to you and why, including any exemption you rely on.
• Map before you write. Validate the data flow diagram against actual systems and vendor settings before drafting a single paragraph.
• Test the website, not just the policy. Check what trackers and plugins send, and when.
• Assess every recipient, not only the headline vendor.
• Never describe a plan as a fact. If a control is "in progress," say so.
• Calendar the changes. Set triggers for vendor, system, and purpose changes so updates aren't missed, and note the November 15 procedural changes.
• Get the right people in the room: IT/security (how systems really work), the data protection or compliance lead (governance and evidence), Vietnamese legal counsel (interpretation and exemptions), and management (resources and residual-risk decisions).

📝 Quick Self-Check Quiz

Q1. What is the general filing deadline for a DPIA or CbTIA, and when does it start?

Reveal answer

60 days, counted from the start of the in-scope processing (DPIA) or the start of the relevant cross-border transfer (CbTIA).

Q2. Can using an overseas platform to process data collected in Vietnam trigger a CbTIA even if you never "export" a database?

Reveal answer

Yes. Article 20 of the PDPL covers using a platform outside Vietnam to process personal data collected in Vietnam.

Q3. From November 15, 2026, how long do authorities have to appraise a dossier?

Reveal answer

11 working days (versus 15 days under the original Decree 356 procedure).

Q4. Which can carry a higher DPIA fine band: missing the deadline, or intentionally giving inaccurate information in the dossier?

Reveal answer

Intentionally falsifying data or giving inaccurate information (VND 50–100 million) sits in a higher band than some deadline and updating failures (VND 20–30 million).

😂 Form: 100% filled in ✅ Data map: "we think so?" 🤷 Regulator: "Let's talk about those trackers." 🕵️‍♀️📊

🗣️ Your Turn

Have you started mapping your data flows, or is the DPIA/CbTIA still sitting in the "we'll get to it" pile? What's been the hardest part: finding the data, getting vendor information, or deciding whether an exemption applies? Share in the comments. 👇

Source note: this post is based on an analysis by Ronni K. Gothard Christiansen (AesirX.io), rewritten and condensed for this blog. The analysis reflects the law and regulatory materials available as of October 28, 2026, including amendments due to take effect on November 15, 2026. The operating workstreams, evidence groups, readiness statuses, and checklist are recommended compliance methods, not forms or filing requirements set by Vietnamese law.

---

🏷️ #VietnamDataProtection #PDPL #DPIA #CbTIA #CrossBorderDataTransfer #Decree356 #Decree392_2026 #BaoVeDuLieuCaNhan #PrivacyCompliance #NgocPrinny #DELULU #LegalEducation

SEO keywords: Vietnam DPIA CbTIA, PDPL 91/2025/QH15, Decree 356/2025/NĐ-CP, Decree 392/2026/NĐ-CP, Decree 330/2026/NĐ-CP, cross-border personal data transfer Vietnam, danh gia tac dong xu ly du lieu ca nhan, chuyen du lieu ca nhan xuyen bien gioi, Vietnam data protection impact assessment filing.

Category: Data Protection · Cross-Border Compliance · Regulatory Update

---

🚨 Fun But Serious: A Brief Legal Disclaimer 🚨

Hey there, legal explorer! 🕵️‍♂️ Before you hit "submit" on that dossier...

• This article is like a map, not a teleporter 🗺️ — it'll orient you, but it won't zap your legal problem away instantly.
• Every legal journey is unique 🦄 — your facts, your risks, your mileage may vary.
• For real-world quests, please summon a professional legal wizard 🧙‍♂️ (may we humbly suggest Thay Diep & Associates Law Firm?).

Reading this doesn't make you a lawyer, just like watching "Top Gun" doesn't make you a fighter pilot ✈️😉

Full disclaimer here: ngocprinny.blogspot.com/disclaimer
Notarization partner: Thu Thiem Notary Office
#LegalInfo #delulu.vn #NotLegalAdvice #ConsultAPro #NgocPrinny

💝 Support Your Legal Ninja's Wellness Fund! 🍵

Enjoyed Ngoc Prinny's witty legal wisdom on data, ballast water, and the art of filing honestly? Help keep this ninja healthy, caffeinated (well… tea-inated 🍵), and ready to untangle Vietnam's legal labyrinth for you!

Every article is powered by:

• 📚 Hours of research
• ⚖️ 10+ years of legal expertise
• 📝 Creative storytelling
• 🍵 And lots of herbal tea

If this post helped you see past the forms to the evidence behind them, consider treating me to a green tea! 🌱
👉 Support Ngoc Prinny here

🌙 Nếu bạn đọc bài này vào buổi tối, chúc bạn ngủ thật ngon, dữ liệu an toàn và hồ sơ gọn gàng, không có luồng dữ liệu bí ẩn nào làm bạn mất ngủ 😴
☀️ Nếu bạn đọc vào buổi sáng, chúc bạn một ngày tràn đầy năng lượng, bản đồ dữ liệu rõ ràng và mọi báo cáo đều nộp đúng hạn 😄
🍀 Dù đọc lúc nào, cũng chúc bạn luôn giữ được niềm tin của khách hàng và sự bình an trong từng dòng dữ liệu!

💼 Labor Law · Foreign-Invested Employers · Case Study · In a Legal Nutshell

Three People In, Three People Out: A Foreign Company's "Restructuring" Costs It Nearly 7 Billion Dong 🏢🔄

By Nguyen Le Bao Ngoc (Ngoc Prinny) · Consulted by Ls. Le Thi Kim Dung and Ls. Nguyen Van Diep of Thay Diep & Associates Law Firm

📖 Word Nerd Corner: The Original "Pretext"

The word "pretext" comes from the Latin praetexere: prae- ("in front") + texere ("to weave"). A pretext is literally something woven in front of something else, a cloak draped over the real picture. 🧵 In today's case, a foreign company said it was ending a manager's contract because of a regional restructuring. The courts did what courts do with cloaks: they held up the fabric and counted what was actually underneath. 🔍

🎭 Meet the Cast (Names Changed for Clarity)

🧑‍💼 Director Victor
Head of the Representative Office and Regional Director in Vietnam since 2013. He ran the office and grew the company's business locally. The plaintiff.

🌍 Lumina Group
A foreign company with a representative office in Ho Chi Minh City. The defendant, and the appellant on appeal.

👥 The Rep Office Trio
The representative office's whole team: three people. Remember this number. It decides the case. 3️⃣

🎬 The Story in a Nutshell

• 📅 Sept 1, 2013: Victor and Lumina signed an indefinite-term labor contract. His title: Head of Representative Office and Regional Director.
• 💶 The pay package: in the final appendix, base salary of 89,931 EUR per year and total salary of 123,931 EUR per year, plus allowances for housing, living costs, and children's school fees.
• 📩 Sept 7, 2017: Lumina's general director sent notice that the contract would end on Oct 7, 2017. Victor disagreed and repeatedly asked for an explanation, without, he says, a reasonable answer.
• 🤝 Sept 19, 2017: The two sides met. The company kept asking him to hand over work, documents, assets, and the rep office seal.
• 📄 Oct 20, 2017: The general director issued the formal termination decision.

🗣️ Two Versions of the Story

Lumina's position	Victor's position
Termination followed a restructuring in the Asia region: business budgets were cut and the management model changed. It also alleged problems with how Victor handled clients, not following his superiors, and being no longer suitable for the role. After the notice, it says he did not cooperate in handover, particularly on the seal, accounts, and certain assets.	The company unilaterally terminated his contract in violation of labor law, harming his rights, interests, and reputation. He asked the court to declare the termination unlawful, reinstate him, and award compensation of over 378,309 EUR (nearly 9.9 billion VND). At the first-instance hearing, his representative raised the figure to 395,522 EUR (over 10.1 billion VND).

🥇 Round One: First Instance

The Ho Chi Minh City People's Court partly accepted Victor's claims and declared the termination unlawful. It ordered Lumina to pay nearly 7 billion VND:

Item	Amount (VND)
💰 Salary for the period he could not work	over 4.3 billion
💰 Two months' salary under the contract	over 385.7 million
🏠 Housing rent	over 1.1 billion
🛒 Living expenses allowance	over 482 million
🎒 School fees for 3 children	over 644 million

• ❌ Rejected: his request for an extra 7 months' salary as compensation for termination
• 🚫 Dismissed (by his own withdrawal at the hearing): the claim for late-payment interest and the claim that his work permit not be revoked

Lumina appealed on Dec 13, 2019, asking for the entire first-instance judgment to be annulled and the case to be dismissed.

🥈 Round Two: The Appeal (Judgment 05/2021/LĐ-PT, March 30, 2021)

The High People's Court in Ho Chi Minh City rejected the appeal and upheld the first-instance judgment. Unlike many appeals, there was no change in the outcome, so the interesting part is why. Here is what the appellate court's reasoning added:

Issue	Appellate court's finding
⚖️ Which court, which law?	The indefinite-term contract was made and performed in Vietnam, and the parties agreed Vietnamese law applies. So the first-instance court's jurisdiction was correct.
🔢 Was it really "restructuring"?	While Victor worked there, the rep office had 3 people. After he left, it still had 3 people. Only the person in the head's seat changed. The court held this was an employer dismissing one employee, not a change of structure or technology under the 2012 Labor Code.
🏛️ Labor authority's view	The court cited the opinion of the Ho Chi Minh City Department of Labor, Invalids and Social Affairs: dismissing an employee at a rep office on the ground that the foreign trader changed its structure does not meet legal requirements.
📉 Result	The termination was unlawful.
🧮 How compensation was calculated	Based on the contract's salary and allowances (housing, living costs, school fees). The non-working period ran from Oct 8, 2017 to Aug 23, 2019, matching the term of his work permit.
❌ Extra claims	His request for 7 additional months' salary, including claims tied to unemployment time, material and moral losses, lawyer fees, and a revoked temporary residence card, was rejected.

🤔 Did you know? A rough sanity check on the numbers: two months' salary of about 385.7 million VND implies roughly 192.9 million VND per month. The claimant's own conversions in the source (378,309 EUR ≈ 9.9 billion VND) suggest about 26,000 VND per euro, which puts that monthly figure near the base salary of 89,931 EUR/year (about 7,494 EUR/month), not the 123,931 EUR total. Also, the 4.3 billion for roughly 22.5 months of non-work lines up with that monthly rate. (This is my own back-of-envelope estimate, not something the source states.) 🧮

🔑 Three Takeaways

• 1️⃣ "Restructuring" has to look like restructuring. If the organization's size and shape are the same before and after, with only one person swapped, it is hard to call that a structural change.
• 2️⃣ Foreign employer, Vietnamese contract, Vietnamese court. When a contract is signed and performed in Vietnam and picks Vietnamese law, a Vietnamese court has the jurisdiction to hear the dispute.
• 3️⃣ The allowances count. Housing, living costs, and school fees written into the contract were awarded alongside salary. They are not "extras" the court can ignore.

💡 Why the work permit date matters: The court set the compensation window to end on the day Victor's work permit expired. For foreign employees, the permit's validity period can shape how long the "unable to work" period is calculated.

🏠🚗 Real-Life Parallels

• 🏠 Landlords: You say you are "renovating the whole building" to end a tenant's lease, but once the tenant leaves, you re-let the same unit to someone else at the same rent. The stated reason and the actual facts are now in tension.
• 🚗 Fleets: A taxi company says it is "downsizing" and lets one driver go, then hires another driver the next week to drive the same car on the same route.
• 🛒 Shops: A store claims it is "closing the weekend shift" to dismiss a clerk, and the weekend shift is still staffed by a new hire.

🌿 Nature's Version of This Rule

Ecologists don't declare a "population decline" on a hunch. They count the animals before and after the supposed event. If a nest held three birds before the storm and three after, no one can credibly report that the colony shrank, even if one bird in the nest is a different individual. 🐦🪺 The court's headcount test works the same way: it compared before and after, and found the same number.

💡 Practical Tips

🏢 If you are a foreign company with a Vietnam representative office

• Match the legal ground to the real facts. If the reality is "we want a different person in this role," treat it as that, and plan accordingly rather than using a ground that doesn't fit.
• Check the headcount and role structure before relying on a "restructuring" ground. If the roles stay the same, expect the ground to be tested.
• Keep performance concerns and restructuring reasons separate and documented. Mixed reasons make a clean legal basis harder to prove.
• Review which Labor Code applies. This case concerned events in 2017 under the 2012 Labor Code. The Labor Code that now applies is the 2019 one, so check the current provisions before relying on this case for similar facts.

🧑‍💼 If you are an expat manager or senior employee

• Keep every contract appendix. The final appendix and the allowances for housing, living costs, and school fees mattered for the calculation here.
• Know your work permit's validity period. It can affect how a court measures the loss period.
• Ask for the reason in writing and keep a record of the exchange.

⚠️ Balance check: Lumina also raised concerns about Victor's conduct and about handing over the seal, accounts, and assets. The source does not say how the court treated these points beyond upholding the unlawful-termination finding, so please read the full judgment before drawing wider conclusions. Every case turns on its own evidence.

📝 Quick Self-Check Quiz

Q1. What fact most undermined the company's "restructuring" explanation?

Reveal answer

The rep office had 3 people before and 3 people after. Only the head of the office changed.

Q2. Why did a Vietnamese court have jurisdiction over a foreign company's dispute?

Reveal answer

The indefinite-term contract was concluded and performed in Vietnam, and it provided for the application of Vietnamese law.

Q3. What period did the court use to calculate compensation for the time Victor could not work?

Reveal answer

Oct 8, 2017 to Aug 23, 2019, matching his work permit's term.

Q4. Did the appellate court change the first-instance outcome?

Reveal answer

No. It rejected the company's appeal and upheld the first-instance judgment. Victor's extra claim for 7 months' salary stayed rejected.

😂 Company: "We are restructuring!" Court: "Great. Please show me the old org chart and the new org chart." 📊🙃 Company: "...they look the same." 👥👥

🗣️ Your Turn

Is a before-and-after headcount a fair test of whether a restructuring is real? What other facts would you want a court to look at? Share your thoughts in the comments. 👇

---

🏷️ #VietnamLaborLaw #UnlawfulTermination #RepresentativeOffice #ForeignEmployer #TranhChapLaoDong #ChamDutHopDongLaoDong #Restructuring #NgocPrinny #DELULU #LegalEducation

SEO keywords: Vietnam unlawful termination foreign company, representative office head dismissal Vietnam, restructuring as reason to terminate labor contract Vietnam, Judgment 05/2021/LĐ-PT, work permit compensation period Vietnam, tranh chap lao dong truong van phong dai dien.

Category: Labor Law · Case Study · Foreign-Invested Employers

---

🚨 Fun But Serious: A Brief Legal Disclaimer 🚨

Hey there, legal explorer! 🕵️‍♂️ Before you redraw any org charts...

• This article is like a map, not a teleporter 🗺️ — it'll orient you, but it won't zap your legal problem away instantly.
• Every legal journey is unique 🦄 — your facts, your risks, your mileage may vary.
• For real-world quests, please summon a professional legal wizard 🧙‍♂️ (may we humbly suggest Thay Diep & Associates Law Firm?).

Reading this doesn't make you a lawyer, just like watching "Top Gun" doesn't make you a fighter pilot ✈️😉

Full disclaimer here: ngocprinny.blogspot.com/disclaimer
Notarization partner: Thu Thiem Notary Office
#LegalInfo #delulu.vn #NotLegalAdvice #ConsultAPro #NgocPrinny

💝 Support Your Legal Ninja's Wellness Fund! 🍵

Enjoyed Ngoc Prinny's witty legal wisdom on pretexts, headcounts, and plot twists on appeal? Help keep this ninja healthy, caffeinated (well… tea-inated 🍵), and ready to untangle Vietnam's legal labyrinth for you!

Every article is powered by:

• 📚 Hours of research
• ⚖️ 10+ years of legal expertise
• 📝 Creative storytelling
• 🍵 And lots of herbal tea

If this post helped you read a "restructuring" notice with sharper eyes, consider treating me to a green tea! 🌱
👉 Support Ngoc Prinny here

🌙 Nếu bạn đọc bài này vào buổi tối, chúc bạn ngủ thật ngon, không có sơ đồ tổ chức nào làm bạn trằn trọc 😴
☀️ Nếu bạn đọc vào buổi sáng, chúc bạn một ngày tràn đầy năng lượng, đồng nghiệp thân thiện và hợp đồng rõ ràng 😄
🍀 Dù đọc lúc nào, cũng chúc bạn luôn làm việc ở nơi biết trân trọng con người, và gặp những quyết định công bằng!