Personal data protection in Vietnam became a licensing question on 1 January 2026, and payroll is where it lands first. Payroll is the largest file of identified individuals most companies hold: names, identity numbers, bank accounts, dependants, salary history, in many cases health and union membership, all in one place. This guide covers what the rules now require of employers, what they require of a payroll vendor, and what to check before the next pay run. For the service context, see terra.
Updated October 2026. Decree 356/2025/ND-CP was issued on 31 December 2025 and took effect on 1 January 2026.
Quick reference: what changed on 1 January 2026
| Item | Before | From 1 January 2026 |
|---|---|---|
| Governing instrument | Decree 13/2023/ND-CP | Law on Personal Data Protection and Decree 356/2025/ND-CP |
| Status of a payroll vendor | Processor, with limited detail | Processor, with documented duties and a licensing route |
| Providing data processing as a business | No specific licence | Certificate of eligibility issued by the Ministry of Public Security |
| Relief for small enterprises | None specific | Five year grace period on some duties, with exclusions |
| Employer liability for vendor conduct | Implied | Stated, the employer remains accountable |
What the rules ask of employers
An employer processing employee data is a data controller. Personal data protection in Vietnam requires it to have a lawful basis for processing, to tell employees what is collected and who else receives it, to keep processing records, to run an impact assessment, and to apply security measures proportionate to the data held. Where the employer hands data to a third party, a written processing agreement must be in place before the transfer, not after.
The duty most often missed is the notification one. Companies document consent at hiring and then add a payroll vendor, a benefits broker and an HR platform over the following three years without telling anyone. Each of those is a new recipient of employee data, and the obligation to inform does not expire with the employment contract signature.
Scope note: this article covers employee and payroll data. Customer data, marketing databases and cross-border transfer mechanics each carry additional requirements that are not covered here.
Why payroll is the highest risk dataset you hold
Payroll concentrates in one place almost every category of data the rules treat as needing care, for every person in the company, with a retention period measured in years rather than months. A marketing list can be deleted. A payroll record cannot, because tax and insurance rules require it to be kept.
There is a second reason specific to payroll, and it is the one companies underestimate. Payroll data moves. It goes to the bank as a payment file, to the social security agency as a contribution declaration, to the tax authority as a withholding return, to an insurance broker, and often to a parent company abroad for consolidation. Each hop is a disclosure, and the last one is a cross-border transfer with its own assessment requirement.
A practical boundary worth knowing: whether salary itself falls inside the sensitive data category under Decree 356 affects which security standard applies, and the classification is not something to assume from the English translation. Confirm it against the Vietnamese text for your own dataset before you design controls around it.
Do you know every destination your payroll file reaches? Most companies can name three and are surprised by the fourth. Map the flow before you write the policy: ask terra for a payroll data flow review.
What is a data processor in payroll terms?
A processor is an organisation that processes data on the controller’s instructions and for the controller’s purposes, which is precisely what an outsourced payroll provider does. The distinction matters because it sets who carries which duty. The employer decides what is collected and why. The provider executes, and may not decide to do anything else with the data.
Under Decree 356 a processor must keep processing documentation, apply security measures that step up for sensitive data, including encryption, anonymisation and continuous monitoring, and delete or destroy the data when the contract ends. That final duty is the one to put in writing with a deadline attached, because a vendor that keeps a copy of your payroll history after termination is a liability that sits on your side of the line.
Here is the part employers tend to read too quickly: appointing a processor does not transfer accountability. If the vendor mishandles the file, the employer is still answerable for having chosen and instructed that vendor. Outsourcing payroll moves the work. It does not move the responsibility.
Does your payroll provider need a licence?
If an organisation provides data processing as a business activity, Decree 356 requires a certificate of eligibility issued by the Ministry of Public Security, which also renews, reissues and revokes it. The conditions are published by the Government in its summary of the conditions for organisations providing personal data processing services. A company that outsources payroll is therefore buying from a regulated category of supplier, and the certificate is a reasonable thing to ask to see.
The conditions behind the certificate are specific enough to be useful as a due diligence checklist:
| Condition | What to ask the vendor |
|---|---|
| A head of personal data protection who is a Vietnamese citizen resident in Vietnam | Who holds the role, and are they in Vietnam |
| At least three personnel trained in the legal and professional requirements | How many, and trained by whom |
| Technical infrastructure and systems | Where the payroll data is hosted and under whose control |
| Processing impact assessment dossier | Is one on file, and when was it last updated |
| Cross-border transfer impact assessment, if data leaves Vietnam | Does any part of the service route data offshore |
Small enterprises and startups received a five year grace period from 1 January 2026 on appointing a data protection officer and meeting some operational standards. The exclusions are what matter: the relief does not apply to an organisation that processes sensitive data directly, that handles the data of more than 100,000 individuals, or that acts as a data processing service provider. A payroll vendor falls into the last category by definition, so a provider citing small enterprise relief for its own payroll service is misreading the exemption.
One more thing worth separating, because it comes up in every vendor conversation. An ISO certificate is not this certificate. ISO 27001 is an information security management standard audited by a private certification body, and it helps evidence the technical infrastructure condition above. The certificate of eligibility is a Vietnamese state licence. A vendor that answers the licence question with an ISO logo has not answered it.
What changed from Decree 13/2023?
Decree 13/2023 established the concepts. Decree 356/2025 added the enforcement architecture around them: a licensing regime for processing services, documented duties for processors, a defined relief track for smaller organisations, and clearer language on where accountability sits when data passes between parties.
For most employers the day to day processing rules feel familiar. What is new is that the supply chain is now regulated, so the questions worth asking moved from internal to external. In 2024 the useful question was whether your own consent wording held up. In 2026 it is whether your vendors can evidence their status, because their gap becomes your exposure.
What should an employer do before year end?
Start with an inventory, not a policy. Policies written before anyone has mapped where the payroll file actually goes tend to describe a company that does not exist. List every internal system and every external party that receives employee data, note what each one gets and why, and only then check each flow against the requirement.
Three items are worth closing this quarter. First, the processing agreement with every party that touches payroll, covering data categories, purpose, retention period, security measures, sub-processors and deletion on termination. Second, the notification to employees naming current recipients, which is usually out of date rather than absent. Third, the deletion clause and whether anyone has ever tested it with a departed vendor.
A reasonable boundary on effort: a company of 40 people with one payroll vendor and no offshore transfer can complete this in a few focused sessions. A group with shared services, a regional HR platform and consolidated reporting to a parent company is doing a different and larger exercise, and the cross-border assessment is the long pole. Teams reviewing their wider payroll setup at the same time can combine this with a payroll audit, and the broader filing obligations are in the 2026 payroll tax and insurance changes.
How terra BPaaS payroll handles your payroll data
terra delivers payroll as BPaaS, meaning the platform and the specialists arrive together. For personal data protection in Vietnam that matters, because the two halves of the risk sit in different places: the system holds the file, and the people decide what happens to it. Splitting those between a software licence and an unrelated service provider is how companies end up with two processors and one processing agreement.
| What terra covers | What it means for your exposure |
|---|---|
| Payroll calculation, payslips and the monthly register on one platform | One destination for the file instead of several, which shortens the flow map |
| Filings to the social security agency and tax authority | Disclosures are made by a party already inside your processing agreement |
| Defined retention and deletion on termination | The clause most employers never test is written into the engagement |
On credibility, the useful facts are structural rather than adjectival. terra operates as Vina Payroll Outsourcing Co., Ltd., a member of the I-GLOCAL Japan group, so payroll sits alongside accounting, tax and audit practices serving foreign invested companies in Vietnam. That becomes relevant precisely when a data question stops being a data question, for example when a group restructuring moves employee records between legal entities.
And the honest boundary: outsourcing does not discharge your duty. You remain the controller, you still owe employees the notification, and you still need the processing agreement. What changes is that one well documented processor replaces several undocumented ones.
Reviewing payroll vendors this quarter? terra can walk through our processing arrangements, hosting and deletion terms against the Decree 356 conditions above. Send us your requirements and we will respond with the specifics rather than a brochure.
Conclusion
Personal data protection in Vietnam is now a supplier question as much as an internal one. Map where the payroll file goes, get a processing agreement against every destination, and ask your vendor to evidence its status under Decree 356. Review your payroll arrangements with terra.
References reflect the Law on Personal Data Protection and Decree 356/2025/ND-CP dated 31 December 2025, effective 1 January 2026, replacing Decree 13/2023/ND-CP. This is general guidance and not legal advice. Confirm classification and licensing questions for your own entity with qualified counsel.
