Enterprises must designate personal data protection personnel or outsource services by 2026

Enterprises must designate personal data protection personnel or outsource services must consider when implementing activities related to the collection, processing, and storage of personal information. Compliance with this regulation not only ensures information safety but also enhances corporate reputation and builds trust with customers and partners. The following article provides detailed information on this matter.

Businesses must appoint personnel to protect personal data or hire a service starting in 2026

Under Clause 2, Article 33 of the Law on Personal Data Protection 2025, agencies and organizations are responsible for designating a department or personnel with sufficient capacity for personal data protection or hiring organizations/individuals to provide data protection services.

• Exemptions and Extensions: Decree 356/2025/NĐ-CP provides specific guidance for different business scales.
  • Small Enterprises and Startups: May choose whether or not to implement this requirement for a period of 05 years from the effective date of the Law.
  • Micro-enterprises and Business Households: Are generally exempt from this obligation.
  • High-Risk Exceptions: The above extensions and exemptions do NOT apply if the entity processes sensitive personal data, provides data processing services, or reaches a scale of 100,000 data subjects or more.

>>> See more: List of Sensitive Personal Data Effective from January 1, 2026

Requirements for personnel responsible for protecting personal data, and for the personal data protection department within an agency or organization

Under Article 13 of Decree 356/2025/NĐ-CP, designated personnel or departments must satisfy formal and professional standards.

• Formal Designation: The appointment must be executed through an official written document of the organization, clearly defining functions, duties, authority, and requirements.
• Capacity Requirements: Designated personnel must meet the following criteria:
  • Hold an associate degree or higher.
  • Possess at least 02 years of experience (post-graduation) in fields such as legal affairs, IT, cybersecurity, data security, risk management, compliance control, or HR.
  • Have completed training and refreshment courses on personal data protection laws and professional skills.
• Organizational Accountability: The organization is responsible for evaluating and selecting suitable personnel.
  • Long Phan Consulting Company helps draft official appointment decisions and job descriptions.
  • We facilitate the signing of confidentiality liability agreements between the organization and the protection personnel.
  • Our team monitors the training and capacity-building process for designated staff to ensure ongoing compliance.

>>> See more: Personal Data Protection in Recruitment

Technical standards and regulations on personal data protection

Systematic technical standards for personal data protection are detailed in Article 34 of the Law on Personal Data Protection 2025.

• Standards: Include recognized standards in Vietnam for information systems, hardware, software, management, and operational processes for data processing and protection.
• Technical Regulations: Comprise technical codes for systems and software developed, issued, and applied specifically for data protection within the Vietnamese territory.
• Regulatory Compliance: The issuance of these standards follows the general law on standards and technical regulations.

Long Phan Consulting Company provides personal data protection consulting services for businesses

Long Phan Consulting Company provides comprehensive solutions to help businesses adapt to new data protection requirements. We understand that designating personnel or outsourcing services imposes significant pressure on staffing, costs, and internal governance.

• We advise on the best option: appointing personnel to protect personal data or hiring a service provider.
• Examine the entire process of data collection, storage, use, and sharing; identify the role of the business (controller, data processor, or third party).
• Identifying sensitive personal data, assessing risk levels, and proposing appropriate technical and organizational measures to ensure compliance with legal regulations.
• Prepare a Personal Data Impact Assessment (DPIA) report, privacy policy, internal regulations, and required forms for submission to the competent authority.
• Perform registration and notification procedures regarding data protection; assist in explaining and working with inspection and auditing agencies when required.

Frequently Asked Questions about Personal Data Protection

Enterprises must designate personal data protection personnel or outsource services. Below are some frequently asked questions regarding appointing personnel to protect personal data or hiring such services; please refer to them:

What is the deadline for entities to complete the appointment of personnel responsible for protecting personal data?

Organizations must complete the establishment of a dedicated department or personnel by the date the Personal Data Protection Act 2025 officially comes into effect in 2026, except in cases where extensions are granted.

(Legal basis: Article 38 of the Law on Personal Data Protection 2025.)

Are micro-enterprises required to appoint personnel responsible for protecting personal data?

Household businesses and micro-enterprises are exempt from this regulation, except for household businesses and micro-enterprises that provide personal data processing services, directly process sensitive personal data, or process personal data from the time their scale reaches 100,000 or more personal data subjects based on the accumulated total amount of personal data processed.

(Legal basis: Clause 2, Article 41 of Decree 356/2025/ND-CP.)

Can personnel responsible for protecting personal data be performing this job as a secondary duty?

The law does not prohibit dual roles; however, the individual must meet the following competency requirements:

• Must have a college degree or higher;
• At least two years of work experience (since graduation) related to one of the following fields: legal affairs, information technology, cybersecurity, data security, risk management, compliance control, human resource management, or organizational structure.
• They have received training and professional development in legal knowledge and skills related to personal data protection.

(Legal basis: Clause 2, Article 13 of Decree 356/2025/ND-CP.)

What key information should a document designating data protection personnel include?

The designation of personnel or a personal data protection department must be made in writing by the agency or organization concerned; it must clearly state the assignment, functions, duties, authority, and other requirements for personal data protection within that agency or organization.

(Legal basis: Clause 1, Article 13 of Decree 356/2025/ND-CP.)

Are businesses allowed to hire freelancers to provide data protection services?

Yes, agencies and organizations are responsible for designating departments and personnel with the necessary qualifications and capabilities to protect personal data, or for hiring organizations or individuals to provide personal data protection services.

(Legal basis: Clause 2, Article 33 of the Law on Personal Data Protection 2025.)

In what situations are small businesses required to appoint personnel right and it cannot be renewed for 5 years?

Small businesses and startups providing personal data processing services, directly processing sensitive personal data, or processing personal data once their volume reaches 100,000 or more data subjects based on the accumulated total amount of personal data processed, are required to appoint personnel immediately and are not eligible for a 5-year extension.

(Legal basis: Clause 1, Article 41 of Decree 356/2025/ND-CP.)

Is a company liable when its data protection personnel make mistakes?

Businesses can agree on exemptions from liability in the signed agreement, but in principle, the organization remains responsible for evaluating and selecting suitable personnel.

(Legal basis: Clauses 4 and 5, Article 13 of Decree 356/2025/ND-CP.)

>>> See more: Procedures for Notification of Personal Data Protection Violations

Conclusion

Designating personal data protection personnel or outsourcing services is an urgent requirement to ensure legal compliance. Businesses should proactively review their systems and prepare personnel meeting the standards of the Law on Personal Data Protection 2025. Enterprises must designate personal data protection personnel or outsource services. For in-depth support and effective risk management solutions, contact Long Phan Consulting Company via hotline 1900636389.