Data Compliance
Review data flows, access and privacy safeguards. The working scope is confirmed only after reviewing the circumstances, available records and current requirements.
What you receive
- 01
Personal data inventory — We map every category of personal data your business collects, where it enters, where it is stored, who can see it, and when it leaves — the record that every subsequent obligation is built on, and the one almost no micro-business has.
- 02
Gap assessment against Law 91/2025 and Decree 356/2025 — Your current practice tested against the obligations in force since 1 January 2026 — lawful basis, notice, consent, data subject rights, cross-border transfer and impact assessment — with each gap graded red, amber or green, given an owner and a deadline.
- 03
Template document set, ready to deploy — A privacy notice, a consent capture wording, a data subject request handling procedure and an internal retention rule — drafted in English and Vietnamese, ready to place on your site and in your workflow.
- 04
Vendor and cross-border check — Where your tools store data outside Vietnam, we identify the transfer and tell you what the law requires of you before that transfer happens, rather than after a customer complains.
- 05
Written compliance handover and review point — A dated compliance file you can show if you are ever asked, plus a scheduled review point — because this regime is new and enforcement practice is still forming.
Delivery routes
Choose the level of support that fits your capacity, timing and desired control. Each party's role is confirmed before work begins.
Route A — You act, we guide
You keep control of execution. LotusGuard provides the costed roadmap, working notes and review checkpoints.
Route B — We execute under mandate
LotusGuard coordinates and files the agreed work within the authority and scope set out in writing.
Route C — Independent third-party QC
When a specialist provider is required, LotusGuard vets the provider and supervises delivery for a disclosed management fee.
Timing and quote
Fees are fixed against the scope stated in the quote and applied consistently. The quote identifies included work, exclusions, assumptions and any pass-through costs.
Legal notice
LotusGuard implements and advises; it does not assume the client's statutory role as data controller. Personal data obligations in Vietnam are governed by the Law on Personal Data Protection No. 91/2025/QH15 and Decree No. 356/2025/ND-CP, in force from 1 January 2026, which replaced Decree No. 13/2023/ND-CP. This is an independent advisory deliverable reviewed by our in-house Chief Legal Officer, not a legal opinion issued by a licensed law practice. Third-party tool licence fees are payable by the client at cost — we take no commission from any vendor.
