When a company entrusts its entire payroll, tax, and HR data to an external provider, the first and most important question is always: Is our payroll and HR data truly secure?
This is not merely a technical question. For FDI enterprises and multinational corporations operating in Vietnam, payroll data security is a core compliance requirement, especially since Vietnam’s Personal Data Protection Law officially took effect on 01/01/2026.
This article provides a detailed analysis of how terra builds a comprehensive payroll data protection system that meets the international standard ISO/IEC 27001:2022, safeguarding client data across three layers: technical, organizational, and legal.
Why payroll and HR data security is a critical business priority
Few categories of business data contain as high a density of personal information as payroll data. Consider the types of sensitive personal data found in a typical payroll table:
SENSITIVE DATA IN A TYPICAL PAYROLL
Special note: For foreign employees, additional data includes visa details, work permit information, and tax residency status |
Every cell in a payroll table is not just a number. It is sensitive personal data strictly protected under Vietnam’s Personal Data Protection Law 2025. A payroll data breach does not only cause immediate financial damage. It triggers a serious trust crisis between employees and the organization.
Beyond that, companies face stringent legal risks from targeted inspections by the Ministry of Public Security, along with administrative penalties that can reach up to 5% of total revenue under the latest enforcement framework applicable from 2026.
Legal context in Vietnam: Under the Personal Data Protection Law (effective from 01/01/2026) and its implementing regulation Decree 356/2025/ND-CP, every organization that processes sensitive personal data (such as salary and banking information) is required to establish multi-layered technical security systems and rigorous organizational procedures to ensure absolute data safety. Companies are responsible for ensuring that any service provider processing data on their behalf also complies with equivalent requirements. Violations can result in administrative penalties and civil legal liability. |
Common security risks when outsourcing payroll
Many companies encounter security issues not because their systems are overly complex, but because of fundamental gaps in the processes and technology their providers use. Two main risk categories require attention:
|
|
How terra approaches payroll data security: 3 layer protection
terra does not rely on a single solution. The terra security system is built on a 3 layer model that covers the entire data lifecycle, from creation through storage and transmission.
Layer 1: Technical: protecting infrastructure and data in transit
This is the first and foundational layer of protection. If the infrastructure is not solid, the layers above it carry little meaning.
Server infrastructure
All data in the terra system is stored on servers at Viettel IDC, one of the highest standard data centers in Vietnam, with automated backup mechanisms to ensure data is never lost in the event of any incident.
SSL encryption: data is locked the moment it leaves your screen
Think of it this way: every time an HR staff member logs into the system and views a payroll table, that data is converted into an unreadable code sequence before being transmitted over the internet. Only the correct destination system can decrypt it.
This is the HTTPS protocol with an SSL certificate issued by Sectigo. The terra system completely rejects unsecured HTTP connections.
Firewall: the gatekeeper between application and data
terra deploys firewalls at two critical positions: at the network access gateway to filter all incoming and outgoing traffic, and between the application layer and the database to ensure only legitimate queries can reach the actual data. Access to the server infrastructure is granted only to specifically authorized individuals with a clear business justification.
Layer 2: Organizational: controlling the people who operate the system
No matter how good the technology is, it is not sufficient if the people operating it are not properly managed. terra applies a simple principle: each person sees only what they genuinely need for their work.
|
Layer 3: Legal: binding commitments through contracts
The final layer is a clear legal framework ensuring all commitments carry binding force.
Confidentiality clauses in service contracts
All terra service contracts include specific personal data confidentiality clauses that clearly define the purpose of data processing, the scope of information use, and terra’s confidentiality obligations throughout the contract term and after termination.
Data Processing Agreement (DPA)
For FDI enterprises belonging to multinational groups with internal GDPR regulations or equivalent standards, terra is prepared to sign a DPA as an additional legal commitment. The DPA covers the types of data processed, the specific purpose and scope, terra’s responsibilities, and the protection measures committed to.
Summary of all terra security measures
|
Case study: How an FDI manufacturer secured payroll data in 3 weeks
The story below is typical of many FDI companies in Vietnam that realize their current HR data management practices carry serious risks they had never previously identified.
Project overview
| INDUSTRY | Manufacturing and trading (FDI) |
| HEADCOUNT | 150+ employees, including foreign nationals |
| CORE ISSUE | Payroll data stored in Excel with no access control |
| SCOPE | Full payroll, tax, and HR data processing and security |
| IMPLEMENTATION TIME | 3 weeks for complete setup and training |
The problems Company B was facing
Company B is a foreign invested manufacturing firm operating in Vietnam with over 150 employees, including several senior managers holding foreign nationality.
Before working with terra, their HR data management process looked like this:
THE SITUATION BEFORE WORKING WITH TERRA
|
This is a common reality at many mid-sized FDI companies. Not because of a lack of concern, but because there was no system in place to do it correctly. When the parent company started asking about data protection procedures at the Vietnam subsidiary, management realized they did not have a clear answer.
The implementation journey with terra
terra’s deployment followed a structured 3 phase process, ensuring a smooth transition and absolute data security for the company.
terra’s expert team worked closely with the company to standardize the data foundation: reviewing current payroll tables and HR policies, configuring the system based on company specific regulations on the cloud platform (web and mobile app), and establishing detailed access permissions for each role (HR, management, employees). |
This was the critical buffer step to ensure system accuracy before live operation: running attendance and payroll features in parallel using real data for cross checking, conducting in-depth training sessions for HR staff, managers, and all employees on features such as leave requests, approvals, and payslip viewing, and evaluating results to fine tune the system based on actual feedback. |
After completing parallel testing, the system went fully live with continuous support: finalizing attendance data, salary calculations, and issuing secure payslips directly on the platform. terra’s team maintained ongoing connectivity through support channels (chat, email) to address questions and promptly update any changes in labor law, tax regulations, or insurance rules. All data remained stored at Viettel IDC, ensuring safety and transparency in accordance with ISO/IEC 27001:2022. |
Results after implementation
After 3 months of operating on the terra system, the transformation was clear:
| Area | Before terra | After terra |
| Data storage | Excel files sent via unencrypted email | SSL encrypted, hosted at Viettel IDC with automated backup |
| Access visibility | No way to know who viewed or edited payroll data | Granular role based access, each user sees only their authorized scope |
| Legal framework | No DPA signed with any party | DPA executed, data privacy clauses included in every contract |
| IT access | IT department had unrestricted access to all HR files | Only assigned personnel with relevant business need can access data |
| Security standard | No certification, unable to answer HQ compliance questions | ISO/IEC 27001:2022 certified, independently audited |
More important than any single metric: Company B could, for the first time, give a definitive answer to their parent company’s question: Who is accessing your HR data, and under what controls? The answer: the right people, within the right scope, audited under ISO/IEC 27001:2022.
What Company B valued most after using terra: “terra did not simply deliver a technology solution. From the very beginning, the terra team worked alongside the company throughout the entire implementation process: reviewing the current state, designing a solution tailored to the company’s scale and operational characteristics, completing the necessary legal framework, and training the team to use the system. The entire process was executed seamlessly, ensuring that the company’s monthly payroll operations were never interrupted. |
terra: BPaaS payroll outsourcing built for data security
terra operates on the BPaaS (Business Process as a Service) model. This means companies do not just receive software. They receive both the technology platform and a dedicated team of payroll specialists who manage the entire payroll process.
terra is operated by Vina Payroll Outsourcing Co., Ltd. (VPO), a member of the I-GLOCAL Japan group, with over 21 years of experience advising and supporting Japanese and international enterprises investing in Vietnam.
When considering payroll outsourcing, many companies worry about losing control over their data and internal processes. The terra BPaaS model is specifically built to address this concern:
|
Conclusion
Building a multi-layered security shield is not just about avoiding heavy administrative penalties. It is a commitment to protecting a company’s most valuable digital asset: its people’s information. Investing in international security standards and proper data handling processes is the most strategic investment an FDI company can make to operate with confidence and meet the strictest audit requirements from headquarters.
Discover how terra can secure your payroll and HR data
Whether you are an FDI manufacturer, a Japanese invested IT company, or a multinational expanding into Vietnam, terra can build a payroll security framework that satisfies both local regulations and global headquarters requirements.
