DPO Radio
MPS A05 Administrative Procedures Decision 778
MPS A05 Administrative Procedures (Decision 778/QD-BCA-A05)
The Ministry of Public Security procedure layer for personal data protection work
Connect the right form, dossier, channel, owner, review, response, and authority outcome in one auditable record.
Decision 778/QD-BCA-A05: Scope and Current Status
Decision 778/QĐ-BCA-A05 is the active administrative-procedure layer for relevant personal data protection interactions with the Ministry of Public Security. It has been effective since 1 February 2026.
The decision addresses how applicable dossiers and forms move through authority-facing procedures. It complements the PDPL and Decree 356; it does not replace the legal obligation or the implementing form requirements.
Procedure references and deadlines should be taken from the current official source for the specific case. ComplianceOne avoids presenting representative or internal procedure identifiers as authority-issued codes.
How Decision 778 Relates to the Vietnam PDPL
The PDPL establishes the parent obligations. Decree 356 adds implementing detail and official forms. Decision 778 provides the related administrative-procedure layer for Ministry of Public Security handling.
Government Resolution NQ22/2026 temporarily adjusts selected procedures across this stack. The temporary overlay must be applied without erasing the underlying Decision 778 context.
Administrative Procedure Operations
| Procedure Stage | Operational Need | Evidence to Maintain |
|---|---|---|
| Dossier preparation | Select the applicable official form and assemble supporting records | Form, evidence index, contributor history, and completeness review |
| Internal approval | Confirm the package is ready for authority-facing use | Reviewer comments, decision, approver, and timestamp |
| Submission | Record the selected official channel and package sent | Submission copy, receipt, channel, and sender or submitter proof |
| Authority request | Capture requests for supplements, clarification, or inspection material | Request, scope, owner, response due date, and linked work |
| Response | Prepare, review, approve, and deliver the response | Response package, approval, transmission proof, and authority outcome |
| Closure | Preserve the complete case and any follow-up action | Decision, follow-up, hard-copy record, and audit history |
Forms and Dossier Evidence
Decision 778 procedures work with official personal data protection forms and their supporting dossier components. ComplianceOne connects form preparation to the underlying assessment, transfer, incident, or service-provider evidence.
The procedure layer should never be reduced to a form number alone. Channel selection, review, receipt, authority requests, responses, and outcomes are part of the operational record.
How ComplianceOne Supports Decision 778 Procedures
ComplianceOne coordinates each case from form and dossier preparation through approval, authority interaction, response, and closure. The current procedure can reflect temporary NQ22 handling while retaining the Decision 778 source context.
Authority requests create linked response work with accountable owners and evidence. The response package passes human review and approval before it is recorded as sent.
Submission proof, authority responses, and any hard-copy follow-up remain connected to the original dossier. This creates a complete record for audit, inspection, and internal review.
Related Modules
Audit Trail
Preserves approval, submission, receipt, response, and closure history.
Explore Audit TrailTask Management
Assigns preparation, response, supplement, and follow-up work.
Compliance Readiness Checklist
Organizations implementing Decision 778 A05 procedure compliance should confirm:
See Decision 778 Procedures in Action
See how ComplianceOne connects dossiers, approvals, channels, authority requests, responses, and outcomes.
Ronni K. Gothard Christiansen - Technical Privacy Engineer & CEO
Technical Compliance Expert, 32+ Years Open Source Advocate, X-BoD Open Source Matters Inc.
Frequently Asked Questions
Decree 356 provides implementing rules and official forms beneath the PDPL. Decision 778 provides the related Ministry of Public Security administrative-procedure layer for applicable authority interactions.
Decree 356 tells you which form to use and what data to put in it. Decision 778 tells you how to submit that form to MPS A05 – which procedural channel to use, which DLCN-HC code to cite, how MPS will handle the review, and what happens if MPS requests additional information. Both layers are required for a successful MPS filing. Getting the form right but citing the wrong procedure code, or submitting through the wrong MPS channel, creates administrative friction even if the form content is technically correct.
No. The instruments work together. Decision 778 adds procedure handling without replacing the parent law or the implementing decree.
The six procedures follow the same general sequence (submission, review, supplement if needed, determination), but the receiving unit, review criteria, and acceptable supplement documentation may differ by form type. DPIA procedures (Mau so 02a/02b) involve a substantive assessment of the impact assessment methodology, while dossier update procedures (Mau so 03a/03b) involve a comparison against the originally submitted dossier. Cross-border transfer procedures (Mau so 01a/01b) involve assessment of the transfer risk basis. ComplianceOne models each procedure type separately to reflect these differences.
Decision 778, in conjunction with Decree 356, requires organizations to notify MPS of material changes to a previously submitted DPIA dossier or cross-border transfer filing. Material changes include changes to the categories of personal data processed, changes to the purposes of processing, significant changes to the systems involved, or changes to the legal basis for processing. The threshold for "material change" is defined in Decree 356. When such a change occurs, Mau so 03a (controller) or 03b (processor) is filed through the A05 procedure, linking the update to the original filing.
NQ22 temporarily adjusts selected personal data protection procedures. ComplianceOne can apply that temporary handling while retaining the original Decision 778 context and the NQ22 expiry review.
No. Procedure references and deadlines should come from verified official sources for the specific case. Unverified representative codes are not presented as authority-issued requirements.
Yes. When an MPS A05 supplement request is logged in the system (via the practitioner recording the supplement request receipt), the platform calculates the 15-working-day deadline from that date and creates a deadline-tracked task for the supplement response. If the deadline approaches without a response being submitted, escalation notifications can be configured. The supplement response, when completed, is linked to the original filing record and the supplement request in the audit trail.
The record can include the approved package, channel, receipt, authority requests, responses, outcomes, and required hard-copy follow-up.
Next Steps
Start a Compliance Pilot
Test MPS A05 procedure workflows with your team – filing lifecycle management, DLCN-HC procedure code configuration, and supplement request handling.
Discuss Your Compliance Needs
Talk to our team about Decision 778 procedure configuration, deadline tracking, and how ComplianceOne models A05 interactions for your organization.
The evolution of Aesir is Aesir + 
(the Norse symbol for Necessity)"Needed in order to achieve a particular result"
♥Join the AesirX Privacy Newsletter. Stay Informed. Stay Compliant.
