The use of cloud computing platforms ("Cloud") such as Microsoft 365, Amazon Web Services ("AWS"), Google Cloud or global ERP systems such as SAP, Oracle and Microsoft Dynamics has become a familiar infrastructure in business operations. On these systems, employee, customer, supplier, salary, transaction data and many other data for operation can exist simultaneously. Legal issues therefore do not stop at information security: depending on how the system is configured and operated, a purely technical storing, synchronization or processing operation can give rise to cross-border data transfers.
The use of Microsoft 365, AWS, Google Cloud, or global ERP can give rise to cross-border data transfers even in the process of storage, synchronization, or automated processing.
Currently, this issue needs to be considered under two legal layers: (1) Data Law No. 60/2024/QH15 dated November 30, 2024, effective from July 1, 2025, regulating digital data in general and establishing a separate mechanism for core data and important data; (2) Personal Data Protection Law No. 91/2025/QH15, effective from January 1, 2026, regulating the processing of personal data separately. The same system can contain multiple data groups subject to different legal regimes. Therefore, businesses need to classify data and determine obligations by group, instead of implicitly applying two sets of obligations to the same data set at the same time.
1. Not only sending files is "transferring data"
The use of Microsoft 365, AWS, Google Cloud, or global ERP can give rise to cross-border data transfers even in the process of storage, synchronization, or automated processing. The deciding point is not the trade name of the platform, but what data is included in the system, where the data goes, which subjects receive or have the right to process it, and where the actual processing takes place. In other words, before asking "whether using the cloud means transferring data across borders", businesses must be able to see their own data flow.
The current law does not limit the concept of "cross-border" to the act of actively sending a data file abroad. Article 23.2 of the Data Law stipulates the transfer and processing of core data and important data across borders, including: (i) transferring data stored in Vietnam to a storage system located outside the territory; (ii) transferring data to foreign organizations and individuals; and (iii) using a platform outside the territory of Vietnam to process data. Similarly, Article 20.1 of the Law on Personal Data Protection covers the transfer of personal data stored in Vietnam to an overseas system, the transfer of data from Vietnam to an overseas organization or individual, or the use of a platform outside the territory of Vietnam to process personal data collected in Vietnam. The latter case is particularly noteworthy for SaaS, Cloud, and global ERP: processing can already be cross-border even if the user doesn't perform a separate "data send" operation.
For example, businesses upload customer records to Microsoft 365 to store on overseas infrastructure; configure AWS or Google Cloud to store databases in Singapore; or put personal data collected in Vietnam into ERP located abroad for analysis. These scenarios can fall under the above scenarios, even if the user only performs daily document saving or data entry operations.
2. Did the server in Vietnam solve the whole problem?
The risk of cross-border data transfer is often more pronounced for cloud and ERP operating under a global model. An SAP, Oracle, or Microsoft Dynamics system can simultaneously contain employee, customer, supplier, salary, bank account, and transaction data. In the corporate model, data is entered in Vietnam but can be synchronized, stored, analyzed, or accessed through a regional or global system. Therefore, locating a server in Vietnam or choosing a location in Vietnam is not enough to conclude that the entire data processing lifecycle takes place within the territory of Vietnam.
In fact, a "data synchronization" operation in the ERP system can essentially create a cross-border data transfer flow. For example, Company A in Vietnam uses the group's common SAP system. Employee data is entered in Vietnam, then automatically synchronized with the HR system located in Singapore to serve the group's human resource management. From an operational perspective, this can only be called global synchronization. However, from the perspective of personal data protection, businesses need to determine which data is transmitted, to which subjects, where it is stored and processed, as well as which parties have access to the data. In particular, if the system allows the information technology department, human resources or other units of the group abroad to access the personal data of Vietnamese employees, enterprises need to separately assess the possibility of this activity within the scope of cross-border personal data transfer.
For Microsoft 365, AWS, and Google Cloud, the problem is not limited to the location of the data center where the primary data is located. Depending on the configuration and service used, data or data-related information may pass through technical support mechanisms operated in other countries; the provider may also use another provider for part of the service.
So, for the Cloud or global ERP, the factor to consider is the focus on the flow of data in and out, not just the location where the data is located.
Before deploying, renewing or significantly changing a global Cloud/ERP system, businesses should create data-flow mapping for related data groups.
3. Cross-border data transfer is not necessarily necessary to make a DTIA
The fact that a data flow is determined to be cross-border transfer does not mean that the business must always prepare a cross-border personal data transfer impact assessment ("DTIA"). Article 20.6(b) of the Personal Data Protection Law provides an exception for the case where an agency or organization stores the personal data of its employees on a cloud computing service. However, this exception is associated with a specific data subject and storage activity, not covering the entire account or cloud system. The same Microsoft 365 environment can contain employee records, customer lists, and vendor contact information; the exception of the first group of data does not automatically entail the other two groups. Similarly, if an ERP uses employee data for purposes other than the scope of the exception, the business must still evaluate that processing flow separately.
It is necessary to distinguish the above exception from another case in Decree 356/2025/ND-CP. Article 17.3(d) stipulates an exemption for cross-border transfer of personal data for personnel management in accordance with labor rules, regulations and collective labor agreements in accordance with the law. The two exceptions have different scopes and grounds. Therefore, it is not enough for a system called a global HR system or an enterprise to have internal HR regulations to automatically include all data sharing activities with the parent company or processing for other purposes within the scope of exemption. The purpose of processing, the type of data and the labor documents used as a basis must be compared with the actual data flow.
The practical difficulty is therefore not only to determine "whether to transfer data or not", but also to prove the boundaries between data flows on the same system: which data is only stored, which data is used for personnel management, which data is shared or processed for other purposes, and which flows are exempt. Contracts with suppliers, technical configurations, and operational realities must tell the same story. If these three layers are not consistent, the exemption basis on paper may not properly reflect the actual processing.
4. What do businesses need to review?
Before deploying, renewing or significantly changing a global Cloud/ERP system, businesses should create data-flow mapping for related data groups. The review should not stop at the question of "where is the data stored", but should answer at least the following questions: where is the data collected from; which system goes into it; where it is stored, backed up or backed up; which entities have access; whether it is provided to overseas suppliers; and for what purpose the data is processed. This is also the basis for making DTIA records when obligations arise, because the law requires a description of the processing flow and the system of storing and processing data after transfer.
At the same time, businesses need to correctly determine the legal role of each entity in the processing chain. Vietnamese enterprises can be the party that decides the purpose and means of processing; Cloud providers can be processors; parent companies or regional IT units can become recipients or continue processing; and other subsidiary service providers can undertake technical support, security, or storage services. The right assignment of roles determines who must perform which obligations, how responsibilities should be allocated to the contract, and what points in the data flow must be controlled.
In terms of contract, you should review your data processing agreement, data transfer terms, recipient lists, storage/processing locations, access rights, incident notification mechanisms, security, data retention and deletion periods. A special point to check is whether the provider has the right to unilaterally add a data processing service provider or move processing activities to another country. If so, you need to ensure that you have an appropriate notification mechanism, the right to evaluate or object, and the ability to update compliance records as data flows change.
In a global cloud and ERP environment, the legal boundaries of cross-border data transfers cannot be determined by the location of the server or the name of the service provider. What determines is the actual data flow: where the data is transferred, who receives it, who processes it, and for what purpose. Only by identifying these factors can businesses distinguish three legal situations: no cross-border data transfer; no cross-border data transfer; or transfer but exemption from impact assessment; or transfer and DTIA must be implemented. Cloud legal risk management, therefore, must start with understanding and controlling the data flow, rather than relying solely on the provider's storage commitment.
