Decree 392/2026/ND-CP: Changes to Impact Assessment Procedures and Personal Data Processing Services
Decree 392: what changes for personal data impact assessments from 15 November 2026
Decree 392/2026/ND-CP amends the procedures under Decree 356 on personal data protection. Several interim arrangements under Resolution 22 become permanent, and some genuinely new rules are added.
*Key changes*
🔹 *Provincial police:* the MPS Specialised Agency still receives DPIA/DTIA dossiers, but may now allocate them to provincial police for assessment and inspection.
🔹 *New assessment result:* results can now be "pass", "pass subject to supplementation" or "fail". The 11-working-day assessment period replaces the previous 15 days.
🔹 *Certificate for processing services:* the application no longer needs a copy of the Enterprise Registration Certificate. Assessment takes 8 working days. Re-issuance and replacement are merged into a single procedure using Form No. 06, with supporting documents required in every case.
🔹 *Defence data:* the Ministry of Public Security must consult the Ministry of National Defence on cross-border transfers involving defence personnel data. The Specialised Agency's existing power to require a transferor to stop transfers still applies.
*Practical points*
âś… Don't treat a conditional pass as full approval.
âś… The transition rules turn on the date the authority *receives* a dossier, not the date you send it. Dossiers posted before 15 November but received on or after that date fall under the new rules.
âś… Keep evidence of the receipt date.
Read our full update below.
Comments