Personal data protection services

Service packages

Three services you can use on their own or together, each with a basic and an advanced package. This page gives an overview; the detailed scope, list of dossiers and quote are set out in consulting slides prepared for your business.

Dossiers for the authority

We prepare and file, on your behalf, the dossiers your business must submit to the personal data protection authority under the Ministry of Public Security.

Right for you whenYour business has started or is about to start processing data and must file within the 60-day deadline.

Basic package

One-off

Meet your first filing obligations on time.

Personal data processing impact assessment dossier (DPIA)
Cross-border data transfer impact assessment dossier (TIA), if applicable
Certificate application, if you provide data processing services
Filing on your behalf and completing the first submission

White Cyber VN advises case by case.

Advanced package

Ongoing

Everything in One-off, plus continuous compliance.

Regular dossier updates, and updates whenever your business changes
Drafting and sending breach notifications on your behalf
Certificate re-issue or replacement when needed
Preparing documents and supporting you during inspections

White Cyber VN is a personal data protection service provider for businesses under Decree 356/2025, Article 16.

Internal compliance documents

We build the policies, rules, procedures, forms and contracts your business needs to operate compliantly every day.

Right for you whenYour business needs to standardise data governance and be ready for an inspection by the authority.

Basic package

Standard

Full personal data protection compliance.

Personal data protection policy and rules
Procedures with owners, deadlines and accompanying forms
Contracts and agreements with the parties involved
Based on Law 91/2025/QH15 and Decree 356/2025/ND-CP

Delivered once, as a complete set.

Advanced package

Plus

Everything in Standard, plus risk management and cybersecurity.

Personal data and cybersecurity risk management framework
Cybersecurity requirements built into internal documents
Cybersecurity rules and procedures under TCVN 14423:2026, by system security level

Delivered once; later updates are available through the Ongoing package of Service 01.

Gap assessment

We check the organisational and technical measures you actually run against Law 91/2025, Decree 356/2025 and TCVN 14423:2026.

Right for you whenBefore investing in solutions, before an inspection by the authority, or when you need assessment results for a DPIA dossier.

Scope by number of systems and level

Gap report

On-site review: interviews with IT and operations; review of configuration, access rights, encryption, logging and backups
Comparison with the requirements that apply to your business
List of gaps, ranked by risk
Remediation roadmap and the items that need investment

White Cyber VN assesses and recommends; purchasing and deploying solutions are not included.

Package details are prepared for each business

The exact dossiers, documents, timeline and quote depend on how your business processes data. Contact us to receive the consulting slides together with White Cyber VN's company profile.

Get the consulting slides

Choosing a package

Where should you start?

The services can be combined; work done in one service is not repeated in another.

You have started processing data but have not filed any dossier
Service 01 · One-off
You have no fully staffed data protection team and need someone to monitor compliance continuously
Service 01 · Ongoing
You need to standardise internal procedures, contracts and forms
Service 02 · Standard
You provide data processing services or need a set of cybersecurity rules
Service 02 · Plus
You want to know which measures your systems are missing
Service 03 · Gap assessment

FAQ

Frequently asked questions

Do small businesses have to prepare a DPIA dossier?

Under Decree 356/2025, Article 41, small businesses and start-ups may choose not to do so for 5 years; household businesses and micro-enterprises are not required to.

Exceptions: the obligation still applies if the business provides personal data processing services, directly processes sensitive personal data, or processes data of 100,000 or more data subjects. The cross-border transfer dossier (TIA) has no size-based exemption.

When does a business need a TIA dossier?

When it transfers personal data abroad. The dossier must be filed with the authority within 60 days of the first transfer (Decree 356/2025, Article 18). The 20-minute call helps identify which of your activities are covered.

How are fees calculated?

Fees depend on the number of processing activities, the number of systems, their security level and the package you choose. The quote is sent with the consulting slides after the call.

Is the information we share during the survey kept confidential?

Yes. White Cyber VN signs a confidentiality agreement before the survey, signs a data processing agreement with the service contract, and deletes or destroys the personal data it processed once the contract is complete.

Why doesn't the website list every package in detail?

The dossiers and documents you need depend on your industry, size and how you process data. We set out the exact scope for each business in the consulting slides rather than publish a generic list that could include too much or too little.

Contact

Get our introduction slides and detailed advice

Send a request to receive consulting slides, our company profile and a quote that fits your business.

Send a consultation request

Phone+84 833 040 203 Email[email protected]