Outsourcing Payroll for a 10–50 Person Company in Ho Chi Minh City: Scope, Data Flow and Confidentiality

Outsourcing payroll in Ho Chi Minh City usually means that each month the provider receives your attendance, salary changes and new-joiner details, calculates gross-to-net pay, personal income tax and insurance contributions, prepares payslips and reports, and supports the related filings. Your company remains the employer: it approves the payroll, pays the salaries and must give each employee a payslip every time it pays (Clause 3, Article 95 of the Labour Code 2019). Since 1 January 2026, the provider is also a personal data processor under the Law on Personal Data Protection No. 91/2025/QH15, and it may only receive your employees’ data after a contract on that processing is signed.

This guide covers the scope of the service, the monthly data flow, who should see what, the contract terms that keep salary data confidential, who is responsible for errors, and the questions to ask a provider. It reflects the law as of 30 October 2026 and is written for owners, general managers and HR leads of companies with 10 to 50 employees.

What outsourcing payroll in Ho Chi Minh City covers

Providers package the service differently, but for a company of 10 to 50 people the monthly work usually splits as in the table. The right-hand column matters as much as the middle one: some tasks cannot be handed over, because the law places them on the employer.

Task	Provider usually does	Company keeps
Employee master data	Maintains the payroll database from the data you send	Collects the data and confirms it is correct
Attendance and timesheets	Processes the attendance file and overtime	Records attendance and approves overtime
Gross-to-net calculation	Calculates salary, allowances, deductions, insurance contributions and personal income tax	Decides salaries, raises and bonuses
Payroll approval	Sends the draft payroll and a variance report	Reviews and approves before payment
Salary payment	Prepares the bank payment file if agreed	Makes the payment from the company’s own account
Payslips	Prepares individual payslips	Makes sure each employee receives one every time salary is paid
Personal income tax	Calculates withholding, prepares returns and the year-end finalisation	Signs or authorises filings and pays the tax
Social, health and unemployment insurance	Prepares registrations, changes and monthly contribution reports	Pays contributions and keeps the original records
Reports	Payroll summary, cost by department, reports for management or the parent	Uses the reports and keeps them on file

Before signing, write the scope down at this level of detail. Most disputes over outsourcing payroll in Ho Chi Minh City come from a task that each side assumed the other would do, such as checking new-joiner documents or chasing a missing tax code.

The monthly data flow

When outsourcing payroll in Ho Chi Minh City, a clear calendar keeps salary data moving through as few hands and channels as possible. The example below is for a company that pays at the end of the month; the exact days depend on your pay date and the provider’s agreement.

When	What moves	From → To
Cut-off (about 5 working days before pay date)	Attendance, overtime, new joiners, leavers, salary changes, unpaid leave	Company → provider, through one agreed secure channel
Cut-off + 2 working days	Draft payroll, list of changes against last month, questions	Provider → company
Cut-off + 3 working days	Approval or corrections	Named approver at the company → provider
Pay date − 1 working day	Bank payment file and final payroll	Provider → company
Pay date	Salary payment; payslips sent to employees	Company’s bank; payslips through the agreed channel
After pay date	Tax and insurance returns, monthly reports	Provider prepares; company files or authorises

Statutory filing and payment deadlines for personal income tax and insurance do not move with your pay date. The calendar should list them separately, and the provider should confirm them each year.

Payroll data under Vietnam’s 2026 data protection law

The Law on Personal Data Protection No. 91/2025/QH15 took effect on 1 January 2026 (Article 38), together with Decree No. 356/2025/ND-CP, which replaced Decree No. 13/2023/ND-CP. Three of its rules shape every payroll outsourcing arrangement.

First, the roles. Your company decides why and how employee data is processed, so it is the personal data controller. A payroll provider that processes the data on your instructions under a contract is a personal data processor (Clauses 7 and 8, Article 2). Under Article 37, the controller must set out each side’s responsibilities in the contract and choose a suitable processor, and the processor may only receive personal data after a processing agreement or contract is in place, must process it as agreed and is liable to the controller for damage it causes.

Second, employee data has its own article. Article 25 requires employee data to be kept for the period set by law or by agreement, and deleted or destroyed when the employment contract ends, unless the law or an agreement provides otherwise.

Third, part of a payroll file is sensitive data. Article 4 of Decree No. 356/2025/ND-CP lists sensitive personal data, including health status, images of identity cards, and login details for bank accounts. Payroll files often hold copies of ID cards and sick-leave documents for insurance claims. When sensitive data is processed, the Decree requires rules on access rights, processing procedures and security measures.

Small companies and the 2026 rules

The law gives small enterprises and start-ups the option not to apply Article 21, Article 22 and Clause 2 of Article 33 for five years from 1 January 2026; micro-enterprises are exempt from them. These provisions cover the personal data processing impact assessment and its updates, and part of the data protection staffing rules. The option does not apply to an enterprise that provides personal data processing services, directly processes sensitive personal data, or processes the data of a large number of people (Clauses 2 and 3, Article 38 of the Law; Article 41 of Decree No. 356/2025/ND-CP).

Whether a 10 to 50 person company qualifies depends on its size classification and on whether it processes sensitive data itself, for example by keeping ID card scans in its HR files. This needs legal review for each company. The exemption covers those specific provisions only: the duties on contracts, security and employee data in Articles 25 and 37 still apply.

Who should see what

Confidentiality depends less on the provider’s software than on how few people can open the salary file. In our professional view, a company of 10 to 50 people can run outsourcing payroll in Ho Chi Minh City with access set out like this:

Role	Sees	Does not need
General manager or owner	Full payroll and reports; approves payment	Raw attendance details
HR or admin lead	Inputs they collect: attendance, new joiners, leavers, changes	Other people’s net pay, unless they approve payroll
Chief accountant or accountant	Payroll totals for the books and the tax and insurance amounts	Individual payslips, where the books can use totals by department
Provider preparer	All inputs needed to calculate	Bank login details or the authority to make payments
Provider reviewer	Draft payroll and variance report	Access after the engagement ends
Employee	Their own payslip only	Anyone else’s data

The practical measures that support this split are simple: one shared folder or portal with named users instead of email attachments, two-factor login, password-protected payroll files, payslips sent to each employee individually, and a log of who downloaded what.

Contract terms for outsourcing payroll in Ho Chi Minh City

Article 37 of the Law on Personal Data Protection expects the responsibilities of each side to be written into the contract. For outsourcing payroll in Ho Chi Minh City, we suggest the contract or a data processing annex covers at least the following:

• Purpose and scope: the data categories the provider receives and the payroll tasks it may use them for, and nothing else.
• Instructions: the provider processes data only on the company’s written instructions.
• Security: access limited to named staff, two-factor login, encrypted storage and transfer, and the treatment of sensitive data such as ID card images.
• Sub-processors and cloud services: whether the provider may use them, and where the data is stored.
• Breaches: the provider informs the company without delay when it detects a breach (Clause 1, Article 23 of the Law). The company, as controller, notifies the specialised data protection authority within 72 hours where the breach may cause the harm described in that clause.
• End of the engagement: return of the data and files, deletion by the provider, and written confirmation.
• Liability: the provider’s responsibility for damage it causes, consistent with Point d, Clause 2, Article 37.

If payroll reports go to a parent company abroad, or the provider uses a platform outside Vietnam, check Article 20 of the Law on cross-border transfers. It requires an impact assessment file sent to the authority within 60 days of the first transfer, with listed exceptions, such as an organisation storing its own employees’ data on a cloud service.

Who is responsible when the payroll is wrong

Outsourcing payroll in Ho Chi Minh City does not move the employer’s legal duties to the provider. The company still pays the salaries, gives employees their payslips, withholds and pays personal income tax and pays insurance contributions. If an amount is wrong, the authorities and the employees will look to the employer.

In our professional view, the contract should therefore say how errors are found and corrected: which checks the provider runs before sending the draft, how a mistake found after payment is adjusted in the next payroll, who pays any late-payment interest or penalty caused by the provider’s error, and how quickly the provider must respond. A variance report each month, listing every change against the previous month, catches most errors before payment.

In-house or outsourced for 10 to 50 employees

Both in-house payroll and outsourcing payroll in Ho Chi Minh City work. The choice depends mainly on how often your headcount and pay rules change, and on who would cover the work if your payroll person left.

Aspect	In-house payroll	Outsourcing payroll
Who knows the salaries	One or two employees inside the company	The approver inside the company and named provider staff
Continuity	Depends on one person; a resignation can stop payroll	Provider team covers absences
Rule changes (tax, insurance)	The employee must follow them	The provider updates its process
Control	Direct	Through the contract, approval step and reports
Data protection duties	The company as controller	The company as controller and the provider as processor

7 questions to ask a payroll provider

Before outsourcing payroll in Ho Chi Minh City, ask the provider:

• Which tasks in the scope table do you do, and which stay with us?
• How do we send data each month, and who on your side can open it?
• Will you sign a data processing contract or annex that reflects Article 37 of the Law on Personal Data Protection?
• Where is our data stored, and do you use sub-processors or platforms outside Vietnam?
• What checks run before we receive the draft payroll, and do we get a variance report?
• How are errors corrected, and who bears the cost of an error you caused?
• What happens to our data and files when the engagement ends?

5 data mistakes to avoid

These are the mistakes we see most often in payroll data handling, in our professional view:

• Sending the full salary list by ordinary email, with the file forwarded to people who do not need it.
• Starting the service before a contract covering data processing is signed.
• Keeping scans of ID cards and health documents in shared folders with no access limits.
• Giving the provider the login for the company’s bank account instead of a payment file for the company to approve.
• Not asking for the data to be returned and deleted when changing providers.

Frequently asked questions

Is outsourcing payroll in Ho Chi Minh City allowed for a foreign-owned company? Yes. Nothing in the rules cited here prevents a company from using an outside provider for payroll calculation; the company keeps its duties as employer.

Does the provider need our employees’ consent to process their data? Article 19 of the Law lists cases where personal data may be processed without consent, including to perform an agreement between the data subject and the organisation in accordance with law. The company remains the controller responsible to employees, so confirm the legal basis for each type of data with an adviser, especially for sensitive data.

Do we still have to give payslips if the provider prepares them? Yes. The employer must give each employee a payslip every time salary is paid (Clause 3, Article 95 of the Labour Code 2019). The provider can prepare and send them on your behalf.

Is salary data sensitive personal data? Salary is not named in the list in Article 4 of Decree No. 356/2025/ND-CP. A payroll file often also holds data that is on that list, such as ID card images and health information, so plan access controls for the whole file.

What should happen to the data when we change providers? The contract should require the provider to return the files, delete its copies and confirm in writing. For employees who have left, Article 25 of the Law requires deletion when the contract ends unless the law or an agreement provides otherwise.

How Pham Consult supports companies in Ho Chi Minh City

Pham Consult’s payroll services include setting up the payroll for a newly registered company from your personnel data and pay policies, monthly payroll calculation, processing and reporting, maintaining the employee database and timesheets, preparing payslips and the salary summary, and calculating, withholding support and year-end finalisation of personal income tax. We also handle social insurance procedures, such as insurance books and health insurance cards, and advise on labour compliance.

For outsourcing payroll in Ho Chi Minh City, we agree the scope, the monthly calendar and the data channel with you before the first payroll. Pham Consult works from offices in Ho Chi Minh City and Hanoi.

Request a payroll review to map your current process, data flow and access before outsourcing payroll in Ho Chi Minh City.

Hotline: +84 909 660 105

Email: info@phamconsult.com

This article is general information as of 30 October 2026 and is not legal or tax advice for a specific case. Data protection, tax and insurance rules change; review your payroll arrangements regularly.