Vietnam PDPL Compliance Advisor
Run gap analysis against Vietnam's Personal Data Protection Law (Law 91/2025 + Decree 356/2025), build rights workflows, handle cross-border transfer assessments, breach notification, and DPO reviews.
Vietnam's PDPL and Decree 356/2025 took effect January 1, 2026 — with cross-border transfer impact assessments, breach notification, and DPO requirements that catch foreign companies off guard. Processing Vietnamese citizens' data without a plan is now a live exposure.
Who it's for: companies processing Vietnamese citizens' personal data, privacy and legal teams expanding into Vietnam, finance/AI/cloud/blockchain operators with sector-specific duties, teams running cross-border transfer assessments, compliance officers reviewing DPO qualifications
Example
"Run a Vietnam PDPL gap analysis and build our cross-border transfer impact assessment" → A gap report against Law 91/2025 and Decree 356, a transfer impact assessment, breach-notification procedure, and privacy notice
CLAUDE.md Template
New here? 3-minute setup guide → | Already set up? Copy the template below.
# Vietnam Personal Data Protection Law (PDPL) Skill
## Overview
You are an expert advisor on Vietnam's **Law on Personal Data Protection No. 91/2025/QH15** (passed 26 June 2025, effective **1 January 2026**) and its implementing regulation **Decree 356/2025/ND-CP** (31 December 2025). This is Vietnam's first comprehensive personal data protection law, administered by the **Ministry of Public Security** (specialized agency for personal data protection).
The law applies to:
- Vietnamese organisations and individuals processing personal data in Vietnam
- Foreign organisations and individuals processing data of Vietnamese data subjects (extraterritorial reach)
**Always read the relevant reference file before drafting detailed guidance:**
- `references/articles-overview.md` — law structure, definitions, data categories, rights, obligations, penaltiesGet new playbooks like this one
One email a week with new Claude Code workflows. Free, like everything here.
No spam. Unsubscribe anytime.
What This Does
Turns Claude Code into a Vietnam Personal Data Protection Law (PDPL) advisor for Law No. 91/2025/QH15 and implementing Decree 356/2025/ND-CP (effective January 1, 2026). It runs gap analysis, builds data-subject rights workflows, prepares cross-border data transfer impact assessments, drafts privacy notices and internal policies, designs breach-notification procedures, addresses sector-specific obligations (finance, AI, cloud, blockchain), and reviews DPO qualifications.
The Problem
Vietnam's PDPL regime is new and demanding: cross-border transfers require documented impact assessments, breaches carry notification duties, and certain sectors face additional obligations. Foreign companies processing Vietnamese citizens' data frequently discover these requirements only after they're already operating — and the law is already in force.
Quick Start
Step 1: Create Your Workspace
mkdir -p ~/Documents/Vietnam-PDPL
Step 2: Download the Template
mv ~/Downloads/CLAUDE.md ~/Documents/Vietnam-PDPL/
Step 3: Add Context (Optional)
Add your data inventory, transfer descriptions, or current privacy documentation.
Step 4: Run Claude Code
cd ~/Documents/Vietnam-PDPL
claude
Step 5: Start
Say: "Run a Vietnam PDPL gap analysis for our operations."
Example Commands
"Run a gap analysis against Vietnam's PDPL and Decree 356/2025"
"Build a cross-border data transfer impact assessment"
"Create a data-subject rights fulfillment workflow"
"Draft a Vietnam-compliant privacy notice and internal policy"
"Design a breach-notification procedure under the PDPL"
"What sector-specific obligations apply to us (finance / AI / cloud)?"
"Review our DPO qualifications against the PDPL requirements"
What You Get
| Output | Contents |
|---|---|
| Gap Analysis | Findings against Law 91/2025 and Decree 356 |
| Transfer Assessment | Cross-border impact assessment documentation |
| Rights Workflows | Data-subject request fulfillment processes |
| Breach Procedure | Notification steps and templates |
| DPO Review | Qualification and appointment guidance |
Tips
- Prioritize transfers — cross-border impact assessments are a core, documented obligation.
- Check sector rules — finance, AI, cloud, and blockchain carry extra duties.
- The law is already in force — treat readiness as urgent, not future work.
Important Disclaimer
This is a compliance support tool, not legal advice. Vietnam's PDPL and Decree 356 are recent and subject to evolving guidance. Have qualified Vietnamese counsel review outputs before relying on them.