Cross-border personal data transfers: what to check when using cloud, SaaS or a parent company

Many businesses believe they do not transfer personal data abroad because they have never sent a file to a foreign partner. But email, cloud, CRM, global HRM, marketing tools, technology vendors and a parent company’s access rights can all create cross-border data flows. From 1 January 2026, the Law on Personal Data Protection 2025 and Decree No. 356/2025/ND-CP require the transferring party to prepare an impact assessment dossier in many cases, and the maximum fines for violations are significant. This article helps businesses spot six commonly overlooked situations, understand when no dossier is required, and map their data flows before thinking about Form No. 09.

This article focuses on identifying data flows. How to prepare the dossier and Form No. 09 is covered in the article “Using AWS, Google Cloud or foreign SaaS: has your business prepared its Form No. 09 dossier?”.

1. What counts as a cross-border personal data transfer?

Analysis: The rule is not limited to “sending files abroad”. Storing data on a cloud abroad, handing it to a foreign organisation, or putting it on a foreign platform for processing all need to be considered.

Data rarely travels in a single step. Any link in the chain that is located or operated outside Vietnam can create a transfer.

So the question should change from “Do we send data abroad?” to “Over its whole lifecycle, which systems, organisations and locations does this data pass through?”

A typical data chain where each link needs checking:

1. Website / collection form
2. CRM or HRM
3. The provider’s cloud infrastructure
4. Vendors and sub-processors
5. Regional or group systems

2. Six situations businesses often overlook

1. The business uses cloud services

The cloud may hold documents, websites, backups, databases, email, CRM, ERP and HRM. Users see an interface in Vietnam but often do not know in which region the data is stored and backed up. You need to identify: which provider, which services hold personal data, where data is stored and backed up, and whether there are sub-processors.

2. The business uses international SaaS

SaaS is used in almost every department: recruitment and payroll (HR); CRM and customer service (Sales); email marketing and analytics (Marketing); project management. For each tool, record the type of data, purpose, provider, processing location, access rights and onward recipients. Cross-check the list with finance and procurement, because many subscriptions are signed up for by individual departments.

3. A Vietnamese company sends data to its parent company

For foreign-invested (FDI) companies, data sent to the group may include HR data (salary, appraisals, training), business data (contact persons at customers and suppliers) and management data (reports, audits). You need to establish: which data, for what purpose, who at the group has access, on which system, and whether it is shared further with other group companies.

4. The vendor is in Vietnam but its infrastructure is abroad

The business signs with Company A in Vietnam, but A uses a cloud or sub-processor abroad. The actual flow is: the business → Vietnamese vendor → foreign cloud / sub-processor.

Analysis: The vendor’s registered address is not enough to reach a conclusion. As Article 17 of Decree 356 also applies to data processors and third parties, the contract should clearly set out who is the transferring party and who prepares the dossier.

5. People abroad have access to the system

A system located in Vietnam can still be accessed by global IT, regional HR, group compliance or a vendor’s support team in another country.

Analysis: The law does not list “remote access” as a separate case. However, when people abroad are given rights to view, download or process data, that activity needs to be assessed to see whether it is a transfer to a recipient abroad, depending on the scope of the rights and how they are actually used. So businesses should build an Access Map, not just a map of servers.

6. Website and marketing tools (MarTech)

Websites collect data through cookies, forms and analytics, then push it to CRM, marketing and advertising platforms, most of which are operated by foreign providers. Ask: which tools are installed on the website, where do the forms send data, and does the agency have access? A privacy policy written without checking the actual MarTech tools is unlikely to describe the processing correctly.

3. When is an impact assessment dossier not required?

Analysis: The exceptions are listed specifically and are fairly narrow. The employee data exception does not automatically cover customer or candidate data held in the same system. HR data sent to the parent company for purposes other than HR management needs a separate assessment. An exception also only removes the transfer impact assessment. Other data protection obligations still apply. A conclusion that “no dossier is required” should be recorded in writing, with the legal basis and the scope of the data.

4. What are the obligations once a cross-border flow is found?

Analysis: Finding a cross-border flow does not mean the business is in breach. It is the starting point for assessing the parties’ roles, the purpose, whether an exception applies, and the dossier, contracts and protection measures needed. A data map that is wrong from the start will lead to a dossier that does not match the systems in operation.

5. How to map cross-border data flows

FC Legal suggests reviewing five layers before reaching a legal conclusion: data (what type, whose, is it sensitive) → systems → providers and sub-processors → processing location and access rights → onward flows. A simple summary table is usually enough to reveal flows that were not visible before:

From data map to compliance roadmap:

1. List systems, vendors and data flows.
2. Flag flows with a cross-border element.
3. Assess roles, purposes, exceptions and obligations.
4. Prepare or update the impact assessment dossier where needed.
5. Adjust contracts, procedures and controls.
6. Review again when a new vendor or system is added.

6. Where should the business start?

Answer Yes / No / Not sure to these 8 questions:

• Do you have a complete list of the cloud and SaaS services you use, and which systems hold personal data?
• Do you know where the data is stored and processed?
• Do you know which people and organisations outside Vietnam have access?
• Have you identified vendors and sub-processors?
• Have you mapped the data sent to the parent company or group?
• Have you reviewed the contracts with the relevant vendors?
• Have you assessed the obligations and exceptions for each flow?
• Does your existing dossier match the systems in operation?

If many answers are “No” or “Not sure”, the first question is not yet “How do we fill in Form No. 09?” but “Where is our data actually going?”

7. Frequently asked questions

Is using email or cloud services from a foreign provider a cross-border personal data transfer?

It can be. Clause 1, Article 17 of Decree No. 356/2025/ND-CP covers storing data collected in Vietnam on servers outside Vietnam or on a cloud computing service of a provider abroad. You need to identify which services hold personal data, where they store it, and whether a no-dossier case applies.

Does storing employee data in the cloud require an impact assessment dossier?

Point (b), Clause 6, Article 20 of Law No. 91/2025/QH15 provides that an organisation storing personal data of its own employees on cloud computing services does not need to prepare a dossier. However, this exception does not automatically cover customer or candidate data, or the use of HR data for other purposes. Other data protection obligations still apply.

Is sending data to a parent company abroad exempt because it is within the group?

The law has no general exception for transfers within a group. A parent company abroad is a recipient abroad. Only transfers for cross-border HR management under labour rules and regulations are exempt from the impact assessment under Clause 3, Article 17 of Decree 356. Other flows need a separate assessment.

If the vendor is a Vietnamese company, does the business still need to worry?

Yes. A Vietnamese vendor may still store or process data on a cloud or sub-processor abroad. Article 17 of Decree 356 applies to data processors and third parties too, so the business should ask the vendor about the processing location and sub-processors, and allocate responsibility for the dossier in the contract.

What is the deadline for filing the cross-border transfer impact assessment dossier?

Under Article 18 of Decree No. 356/2025/ND-CP, the transferring party files 1 original of the dossier (including the report on Form No. 09) with Form No. 01a/01b with the competent personal data protection authority within 60 days from the date the cross-border transfer starts.

8. Legal basis and references

• Law on Personal Data Protection, Law No. 91/2025/QH15, passed 26 June 2025, in force from 1 January 2026: Articles 8, 20 and 22.
• Decree No. 356/2025/ND-CP dated 31 December 2025 detailing certain articles of and measures to implement the Law on Personal Data Protection, in force from 1 January 2026 (replacing Decree No. 13/2023/ND-CP): Articles 17 and 18 and the Appendix (Forms No. 01a/01b and No. 09).
• Legal texts consulted on the Government’s legal documents portal (vanban.chinhphu.vn) and Thư viện Pháp luật (thuvienphapluat.vn).
• EY Vietnam, legal alert on Decree No. 356/2025/ND-CP (March 2026).