DPIA dossier on Form No. 10: how to prepare it and 5 common mistakes to avoid

From 1 January 2026, a business that processes personal data and falls within the scope must prepare a personal data processing impact assessment (DPIA) dossier under Decree No. 356/2025/ND-CP. The report on Form No. 10 must be sent to the specialised authority within 60 days from the start of processing. Filling in every box on the form is not enough. The authority may ask for the dossier to be completed if the declared role conflicts with the contracts, the data flow diagram is vague, sensitive data is left out, or the protection measures are only slogans. This article explains what a DPIA dossier contains, the deadlines to track, 5 common mistakes on Form No. 10, and how Legal, IT and HR can work together so the dossier reflects reality.

1. What does a DPIA dossier on Form No. 10 contain?

The article “What is a DPIA? What businesses need to prepare for a personal data processing impact assessment” explained the concept and who must prepare one. This article goes straight to the harder part: how to prepare a DPIA dossier on Form No. 10 whose content holds up when the specialised authority reviews it, and the mistakes FC Legal often sees when reviewing dossiers that businesses drafted themselves.

Analysis: Form No. 10 is not a procedural declaration. It is a systematic description of what the business does with personal data and how it controls the risks. Each item in the report must match the attached documents. The role declared in the report must match the contracts. The protection measures declared in the report must be backed by matching policies and procedures. Most requests for additional information come from these mismatches, not from a missing stamp.

2. Deadlines for filing, review and updates

The life cycle of a DPIA dossier:

1. Processing starts; prepare the dossier.
2. Send the original with Form No. 02a/02b within 60 days.
3. The specialised authority reviews it.
4. Complete the dossier if asked (30 days).
5. Update every 6 months, or within 10 days after a major change.

Analysis: A 30-day period to complete the dossier sounds long. But if the mistake is fundamental (the wrong role, no real data flow diagram), the business almost has to rewrite the report and review its contracts and policies again. That time is usually not enough unless the input from IT and the other departments is already available.

3. 5 common mistakes on Form No. 10

The mistakes below come from FC Legal’s experience reviewing dossiers and from an analysis of the content requirements in Article 19 of Decree 356. They are not official statistics of the specialised authority. They are the weak points we see most often in dossiers that businesses drafted themselves.

Mistake 1: Getting the data controller and data processor roles wrong

The Law on Personal Data Protection distinguishes the data controller (decides the purposes and means of processing), the data processor (processes on behalf of the data controller under a contract) and the data controller-processor. Typical errors:

• A software provider (SaaS, CRM, payroll, storage) declares itself the data controller for all the data its business customers store on its system;
• Conversely, a business selling directly to consumers declares itself only a “data processor” to reduce its obligations.

The result: the role in the report conflicts with the attached contracts, and the description of the legal basis for processing and of consent is wrong as well.

Mistake 2: Describing processing activities and data flows too vaguely

A diagram such as “Customer enters data → System stores it → Sales team uses it” does not tell the reader where the data comes from, which system holds it, who has access, and through which channels it leaves the business. Without that, the risk assessment and the protection measures have no basis.

A usable data flow description usually shows:

• Collection points: website, app, service counter, paper files, API integrations;
• Storage systems: software, databases, in-house servers or cloud services, storage location;
• Recipients: SMS providers, email marketing, accounting, analytics tools;
• End points: storage period, and how data is deleted, destroyed or de-identified.

If the data flow includes storage or access from abroad, the business should also consider the cross-border personal data transfer impact assessment dossier on Form No. 09 (Article 18, Decree 356). That is a separate dossier and does not replace Form No. 10.

Mistake 3: Leaving out or misclassifying sensitive personal data

Analysis: Many businesses still use an old classification table. They forget data from website and app tracking code (pixels, analytics cookies, behaviour logs), or they put facial recognition attendance data, fingerprints and eKYC data in the basic data group. Wrong classification leads to protection measures that are not proportionate and to an incorrect description of consent.

Mistake 4: Describing protection measures as slogans

Sentences such as “the system applies advanced security standards” or “data is stored securely behind a firewall” do not show what the business actually does. The security plan should describe specific, verifiable measures, for example:

• Encryption of data at rest and in transit (state how it is actually applied);
• Role-based access rights, and multi-factor authentication for administrator accounts;
• Access logs and alerts for unusual access;
• Procedures for backing up, deleting and destroying data, and the person responsible.

Specific technical standards (encryption algorithm, log retention period and so on) are the business’s choice, based on its actual infrastructure. What matters is to describe correctly what is in operation and to have matching internal documents.

Mistake 5: A box-ticking risk assessment and attached documents that do not match

The risk assessment and mitigation measures are a mandatory part of the report under Article 19. Yet they are often a single sentence such as “the company only processes data internally, there is no risk”. A meaningful assessment answers: what could happen (disclosure, loss, unauthorised changes, use for the wrong purpose), who would be affected, how likely it is, what measures are in place, and what risk remains.

A related mistake concerns documents. The report says there is a contract with the vendor, an incident response procedure and data protection personnel, but the dossier has no copy of the matching contract, policy or procedure.

4. How Legal, IT and HR work together on Form No. 10

Analysis: A dossier drafted by Legal alone usually has the right terms but describes the systems wrongly. A dossier drafted by IT usually has full technical specifications but lacks the legal basis and the allocation of roles. What works is a clear division of tasks:

• Legal/Compliance: determine the roles, purposes and legal basis for processing; review contracts, policies and consent forms; compile the report;
• IT/Information security: inventory the systems, draw the data flow diagram, describe the technical measures;
• HR, Sales, Marketing: provide the list of data actually being collected and the tools and vendors in use;
• Management: approve the risk assessment results and the remediation roadmap.

5. Where should a business start?

Before filling in Form No. 10, answer these questions quickly:

• Does the business have a complete list of its personal data processing activities (customers, staff, job applicants, partners)?
• For each activity, is the business the data controller, the data processor, or both?
• Is there a diagram showing which systems hold the data, who it is sent to and how long it is kept?
• Is the business collecting biometric data or online behaviour data?
• Are the protection measures you plan to declare actually in operation and documented internally?
• Do the contracts with vendors that process data contain data protection clauses?

If two or more answers are “not yet”, deal with the input first, before drafting the report.

Roadmap for preparing a DPIA dossier on Form No. 10:

1. Inventory the processing activities and the data.
2. Determine the role for each data flow.
3. Map the data flows with IT.
4. Review contracts, policies and consent forms.
5. Assess the risks; management approves.
6. Draft Form No. 10 and file it with Form No. 02a/02b.
7. Track requests for additional information and the update schedule.

6. Frequently asked questions

How is a DPIA dossier on Form No. 10 different from a dossier on Form No. 09?

Form No. 10 is for the personal data processing impact assessment report (Article 19, Decree 356). Form No. 09 is for the cross-border personal data transfer impact assessment (Article 18). A business that processes data in Vietnam and also transfers data abroad may have to prepare both dossiers.

What is the deadline for filing a DPIA dossier?

The dossier must be prepared from the start of processing. One original must be sent to the specialised personal data protection authority within 60 days from the date processing starts, together with Form No. 02a (organisations) or 02b (individuals), under Article 19 of Decree No. 356/2025/ND-CP.

What if the specialised authority asks for more information?

Under Article 19 of Decree 356, the specialised authority assesses the dossier within 15 days. If the dossier is incomplete, it asks for it to be completed within 30 days. Keep the input data ready so you can fix exactly the points raised, instead of starting again from scratch.

Once the dossier is filed, does it have to be redone?

The dossier must be updated every 6 months when there are changes, and within 10 days for certain major changes such as a reorganisation, termination of operations, a change of data protection service provider or a change in the relevant business lines (Article 20, Decree 356), using Form No. 03a/03b.

Is there a fine for not preparing a dossier, or for a poor one?

The Law on Personal Data Protection 2025 (Article 8) sets the maximum fine for an organisation at VND 3 billion for the general group of violations. The fine for each specific act is set in the regulations on administrative penalties. Apart from fines, a dossier that does not reflect reality causes problems during an inspection or when an incident occurs.

7. Legal basis and references

• Law on Personal Data Protection (Law No. 91/2025/QH15), passed on 26 June 2025, in force from 1 January 2026 (Article 8 on maximum fines).
• Decree No. 356/2025/ND-CP dated 31 December 2025 detailing certain articles of and measures to implement the Law on Personal Data Protection (Articles 18, 19, 20 and 41; Forms No. 02a/02b, 03a/03b, 09 and 10), replacing Decree No. 13/2023/ND-CP.
• LuatVietnam: New points of Decree 356/2025 compared with Decree 13/2023 on personal data protection.
• Indochine Counsel: Special Alert, Decree No. 356/2025/ND-CP (01/2026).