AesirX ComplianceOne | Vietnam Decree 356 PDPL Implementation

The Vietnam Personal Data Protection Law (Law 91/2025/QH15) is the parent statutory framework. It establishes the legal obligations that apply to all personal data controllers, processors, and service processors operating in Vietnam. For a full understanding of those statutory obligations, see the Vietnam PDPL (Law 91/2025/QH15) compliance page.

Decree 356 is the implementing instrument that operationalizes those obligations. The PDPL delegates to the Government (and through the Government, to the MPS) the authority to specify administrative procedures, form formats, and procedural timelines. Decree 356 exercises that delegation. This means that a compliance practitioner who reads only the PDPL knows what is required but not how to execute it in a way that MPS will accept. Decree 356 is the gap between statutory obligation and operational compliance.

For practitioners implementing PDPL compliance, this creates a two-layer working requirement: the PDPL layer defines the triggers (when must a DPIA be filed, when must a breach be notified), while the Decree 356 layer defines the execution (which form, which data fields, through which MPS procedure, within which timeline). ComplianceOne supports both layers in an integrated workflow, but understanding Decree 356's specific provisions is essential for configuring compliance programs at the procedure level.

ComplianceOne implements all 21 official Decree 356 form templates as interactive Form Wizard templates in the Compliance Forms module. Each template is pre-populated with its official template ID (e.g., "Mau so 02a," "Phu luc I"), structured to match the prescribed data fields, and available in Vietnamese and English. When a practitioner initiates a filing, the platform presents only the forms applicable to the selected procedure type, reducing the risk of selecting an incorrect form for a given MPS interaction.

The filing lifecycle is modeled as a structured state machine: Draft, Internal Review, Approved for Submission, Submitted to Authority, Supplement Requested, Supplement Submitted, and Accepted. Each state transition is captured as an audit event with the responsible user's identity, timestamp, and any associated document version. This mirrors the administrative procedure steps in Decision 778/QD-BCA-A05, ensuring that the platform's workflow tracks the actual MPS procedural timeline. For multi-department dossiers – such as DPIA submissions that require contributions from legal, IT security, HR, marketing, and procurement – the platform routes each dossier section to the responsible department owner, tracks completion status, flags overdue contributors, and consolidates inputs into a single submission-ready package. Contributor identity and completion timestamps are preserved throughout.

Breach notifications under Mau so 08 are managed through the Incident Response module. When a personal data breach is confirmed, the platform initiates the 72-hour notification countdown from the discovery timestamp, pre-populates Mau so 08 with incident data already captured in the case record, routes the notification for legal review and approval, and produces the submission-ready document for MPS filing. If MPS requests a supplement, the supplement workflow links back to the original notification record, tracking the 15-working-day response deadline. All Phu luc annexes (I through VIII) are maintained as live data structures within their respective modules – Records of Processing Activities in the Data Mapping module, consent records in Consent Governance, rights request records in Rights Requests – ensuring that when a filing package is assembled, the supporting annex data reflects the current operational state of the organization.