D1 · ASSESS
Compliance Gap Review
Data-flow inventory, legal bases for processing, and consent state across systems, mapped against PDPL 91/2025 and Decree 13/2023.
- Data inventory & RoPA
- Legal-basis mapping
- Prioritized remediation plan
01.01.2026
PDPL 91/2025/QH15 in force
5%
of prior-year revenue — maximum penalty, cross-border violations
2
mandatory dossiers: processing DPIA & cross-border transfer (Decree 13/2023, Art. 24–25)
70M+
platform users our counsel has advised in-house
What we deliver
Five service components, sequenced from current-state review to regulator engagement. Each engagement is scoped and delivered by the counsel named on our team page.
D2 · FILE
Impact-Assessment Dossiers
Preparation and submission of the processing impact-assessment dossier and the cross-border transfer dossier, plus updates when processing changes.
- DPIA dossier (Art. 24)
- Cross-border dossier (Art. 25)
- Change management & refiling
D3 · GOVERN
Policies & Contracts
Privacy policies, data-subject rights procedures, and data-protection terms for partner, vendor and processor contracts.
- Privacy notice & consent UX
- DSR handling procedure
- DPA templates & negotiation
D4 · TRAIN
Training & Breach Readiness
Awareness training for business and operations teams, and breach-response playbooks aligned to statutory notification deadlines.
- Role-based training
- Breach notification playbook
- Tabletop exercises
D5 · REPRESENT
Regulator Liaison
Technical and legal point of contact with Vietnam's data protection authority (A05, Ministry of Public Security) through dossier appraisal, inspections and inquiries.
- Dossier appraisal support
- Inspection response
- Ongoing counsel retainer
+ · IT LAW
Technology & Platform Law
Adjacent advisory for digital platforms and e-commerce: cybersecurity obligations, data localization, electronic transactions and intermediary liability.
- Law on Data 60/2024/QH15
- Cybersecurity Law 24/2018 & Decree 53/2022
- E-commerce & e-transaction rules
PDPL 91/2025/QH15
Decree 13/2023/NĐ-CP
Law on Data 60/2024/QH15
Cybersecurity Law 24/2018
Decree 53/2022/NĐ-CP
Practice lead
Dola Pham — Lawyer, Data Privacy & Protection
Licensed lawyer (HCMC Bar, 2014), nearly 20 years of practice; 12 years at VNG Corporation as Head of Legal for Zalo Group (70M+ users), leading personal data protection for the entire group. Full profile →