01
Dossiers for the authority
What must you file, and when? We prepare and file DPIA and TIA dossiers, and certificate applications where they apply.
See the packagesLegal & cybersecurity consulting
Personal data protection compliance, from dossiers to daily operations
White Cyber VN helps businesses meet Vietnam's Personal Data Protection Law and Decree 356/2025/ND-CP: we prepare dossiers for the authority, build internal compliance documents and assess the measures already in place.
Legal basis:Personal Data Protection Law 91/2025/QH15Decree 356/2025/ND-CPDecree 330/2026/ND-CP (penalties)TCVN 14423:2026
Legal context
The obligations are in force and the deadlines are counted in days
Every business that collects or processes data about customers, employees or partners is covered. Key dates and deadlines:
1 Jan 2026
The Personal Data Protection Law and Decree 356 take effect
Law 91/2025/QH15 · Decree 356/2025/ND-CP
60 days
To file DPIA and TIA dossiers after processing or transfer begins
Decree 356, Art. 18 and 19
72 hours
To notify the personal data protection authority of a breach
Law 91/2025, Art. 23
10 days
To update dossiers after a reorganisation or change of business lines; every 6 months for other changes
Decree 356, Art. 20
| Provision | Common violation | Fine |
|---|---|---|
| Art. 43 | Obtaining consent improperly: pre-ticked boxes, treating silence as consent, keeping no evidence | VND 30–70 million |
| Art. 44 | No procedure or form for data subject requests, or handling them late | VND 10–40 million |
| Art. 52 | Transferring data without an agreement or without security measures | VND 20–80 million |
| Art. 54 | Not reporting a breach, or reporting it more than 72 hours late | VND 10–80 million |
Source: Decree 330/2026/ND-CP, abridged; the exact fine depends on the violation and the party. Applies per violation.
White Cyber VN capabilities
Legal and technical expertise in one team
Personal data protection is both a legal obligation and an engineering problem. We handle both, so the dossiers on paper match how your systems actually run.
- Legal entity
- Công ty TNHH White Cyber VN
- Tax ID
- 0319686055
- Field
- Legal and information technology consulting
- Location
- Ho Chi Minh City, serving businesses across Vietnam
Legal
Interprets obligations under Law 91 and Decree 356; drafts dossiers, contracts and data processing agreements.
Data security
Maps data, access rights, encryption, retention, and deletion or destruction of data as the rules require.
Cybersecurity
Assesses technical measures against TCVN 14423:2026 and the information system's security level.
Hands-on experience
We have delivered IT consulting projects and software for businesses in psychotherapy, which routinely handle health data classed as sensitive personal data, and in event management.
Company profile under Decree 356
Under Decree 356/2025, Article 16, clients review the profile of a personal data protection service provider before signing a contract. White Cyber VN's profile, including staff information and supporting documents, is sent with the consulting slides when you contact us.
Request our company profileHow we provide our services
Your data is protected throughout the engagement
Client confidentiality
We sign a confidentiality agreement before any survey or access to data.
Data processing agreement
Signed with the service contract, setting out the scope of processing of your data.
Within the contract scope
We carry out only the tasks agreed in the contract.
Legal compliance
We never use our services as a means to break the law.
Data deletion
Personal data we processed is deleted or destroyed once the contract is complete.
Reply within 24 hours
From receipt of your request at [email protected].
Based on the obligations of personal data protection service providers: Decree 356/2025/ND-CP, Article 16.
Services
Three services for three questions every business must answer
02
Internal compliance documents
Which documents do you need to comply? We build the policies, procedures, forms and contracts for your whole organisation.
See the packages03
Gap assessment
Do your systems have the measures they need? We compare your organisational and technical measures with the rules and set out a remediation roadmap.
See the packagesHow we work together
It starts with a 20-minute call
- 01
Survey
A short questionnaire and a 20-minute call about how your business processes data.
Output: consulting slides, scope and quote
- 02
Current-state review
We map your data and compare your existing documents and measures with the rules.
Output: data inventory, data flow diagram
- 03
Delivery
We prepare and file dossiers, build internal documents or run the gap assessment for the chosen package.
Output: dossiers, documents, handover report
- 04
Ongoing compliance
We update dossiers regularly, support breach notifications and work with inspectors when they visit.
Output: dossiers that match reality
Contact
Get our introduction slides and detailed advice
The scope of each package, the list of dossiers and the quote are set out in consulting slides prepared for your business after the call.