English pages
Personal data protection for your business in Vietnam
From compliance records to a data governance system
Data on customers, employees, users and partners runs through almost everything your business does. FC Legal helps you review your data flows, find the gaps, build the documents you need and set up governance that fits how you actually work.
- Identify your dataWhat you hold, where it comes from and where it goes.
- Set up compliancePolicies, procedures, forms and impact assessments.
- Maintain governanceKeep records current as your business changes.
Data runs through your whole business
Data governance is not only about your website. Data is created, used and shared across the employee lifecycle, customer relationships, marketing and work with partners.
- Candidates
- Employee records
- Timekeeping
- Payroll
- Contact details
- Transactions
- Customer service
- Forms
- Accounts
- Cookies
- User behaviour
- Leads
- Advertising
- Loyalty programmes
- Data sharing
- Contracts
- Processors
Do you really know where your data goes?
To govern data, you first need to see its whole journey through your business.
To build a system, first understand where you stand
FC Legal starts by surveying your data and processing activities, so we can see what needs attention first before we propose a solution.
Identify data sources, processing activities and how data moves.
Look at how data is collected, stored, used, shared and managed.
Set out the issues to address and the order of priority.
More than paperwork: a system you can run
Review & assess
- Data mapping
- Review of processing activities
- Gaps and risks identified
Build the system
- Policies and procedures
- Forms and internal mechanisms
- Impact assessment records
Implement & train
- Clear allocation of responsibilities
- Guidance for each department
- Internal training
Monitor & update
- Updates to impact assessments
- Review of changes in processing
- Fixing non-compliant points
Incidents & requests
- Data subject requests
- Incident handling guidance
- Support when issues arise
What does your business get from the project?
Depending on the agreed scope, the project may include:
Data survey
Survey results and the processing activities identified within the project scope.
Policies & procedures
A set of documents built or reviewed to suit your rollout.
Impact assessment records
Records and implementation guidance within the agreed scope of work.
Internal training
Guidance that helps each department understand its role and how to work together.
Request and incident guidance
A support mechanism for when requests or situations need handling.
The exact deliverables depend on the survey scope, the service proposal and the contract with each business.
Choose the level of support that fits your business
Annual plans with a fixed fee, so you know the cost of staying protected.
Fines reach up to 5% of the previous year's revenue for unlawful cross-border transfers. Breaches must be reported within 72 hours.
VND, excluding VAT. Legal basis: Law No. 91/2025/QH15 and Decree No. 356/2025/ND-CP.
When you need to solve a specific issue
The scope and fee are confirmed after FC Legal reviews your needs and the relevant documents.
Turn compliance into work you can track
From where you are today to a system that works
- IntakeUnderstand your business model and needs
- Survey & data mappingIdentify your data and processing activities
- AssessmentIdentify gaps, risks and priorities
- Solution designSet the documents, procedures and governance you need
- Rollout & trainingWork with your teams to put the solution into practice
- Monitor & updateTrack changes and support continuous improvement
Frequently asked questions
Which businesses should review their personal data processing?
Any business that collects, stores or uses data on customers, employees, users or partners, whether through a website, app, CRM, marketing or HR records, should have a clear picture of how it processes data. A review matters even more when you expand, change systems or work with several processors.
How does FC Legal start a personal data protection project?
We take in information about your business model and needs, then survey your data and processing activities (data mapping), assess the gaps and propose a suitable scope before both sides agree the contract.
What is data mapping?
Data mapping means building a map of your data: what you collect, from which sources, for what purpose, where it is stored, who can access it, who it is shared with and how long it is kept. It is the basis for deciding what to do next.
What is the difference between building a system and ongoing support?
Building a system is for businesses that need to review and set up their compliance: data survey, policies, impact assessment records and internal training. Ongoing support is for businesses that already have the basics in place: updating impact assessment records, handling data subject requests and guidance on incidents. The annual plans above cover different levels of support; the exact scope is set in the contract.
Are impact assessment records included in every service?
No. Impact assessment records are included where the agreed scope covers them, and can also be prepared as a separate service. Whether they are included is set in the service scope and the contract with each business.
What happens when we change our website, CRM, suppliers or marketing?
These changes can affect how data is collected, stored or shared. FC Legal helps review the changes and update the related records and documents, either within an annual plan or as a separate request.
Does FC Legal help handle data subject requests?
Yes. We help you set up a process to receive, handle and respond to data subject requests. This support is available as part of ongoing support or on request; the scope is agreed in the contract.
If a data incident happens, what support does FC Legal provide?
We support you on the legal side: guiding your incident response process, assessing the related obligations and helping prepare the information and documents you need. FC Legal does not provide technical cybersecurity services. The exact scope of support is agreed case by case.
Personal data insights
Do you know where your data goes?
Start by reviewing where you stand. FC Legal works with you to map your data flows, identify the issues to tackle first and choose the right scope, in English or Vietnamese.
Please do not send confidential documents or personal data through the form.
FC Legal Law Company Limited, Hanoi, Vietnam. This page is general information, not legal advice for any specific situation.
