On January 1, 2026, the Vietnamese Personal Data Protection Law came into effect. Law 91/2025/QH15 was approved by the National Assembly in June 2025, and Decree 356/2025/ND-CP was issued on the last day of the year to explain its practical implementation.
If you've followed the reporting, you've probably seen the same sentence over and over: The PDPL is based on the GDPR. That's broadly correct, and it's precisely why many Vietnamese exporters will soon hit a wall.
“Based on” is not “equal to.” And whoever sells to the European Union — and with almost $74 billion in two-way trade in 2025, that's a lot — now lives under two laws at once. Passing one audit doesn't mean you'll pass the other.
These are the seven differences we most often encounter.
1. Consent is the standard in Vietnam. In Europe, it is the last resort.
The Vietnamese PDPL relies heavily on consent. Obtain explicit, specific, and informed consent, keep records of it, and you'll be largely compliant.
European regulators view that very differently. Under the GDPR, consent is one of six legal bases, and regulators have been pushing companies for years way Because consent can be withdrawn at any time and because it is rarely freely given in an employment or B2B context. A European lawyer reading your privacy statement and seeing “we process your data with your consent” everywhere will not see that as thorough. They will see that as untrained.
What you do: Link each processing activity to the correct GDPR legal basis – contract, legal obligation, or legitimate interest – and reserve consent for what it's truly needed for, like marketing. Then, write down why.
2. Cross-border transfers, that's where the money is
The PDPL provides for fines up to 5% of the previous year's annual revenue in breaches of cross-border data transfers. That's not a rounding error, and it tells you exactly where Vietnamese enforcement is going.
The GDPR has its own regime for the same problem, but in the opposite direction: transferring personal data from Europe outside of Europe requires an adequacy decision, standard contractual clauses, or another mechanism from Chapter V, plus a transfer impact assessment. Vietnam does not have a European adequacy decision.
So, a Vietnamese producer with a European sales office, a European CRM, and a Vietnamese support team operates two transfer regimes in opposite directions. And usually has no documentation for either.
What you do: Draw the actual data flows. Not the org chart—the flows. Which system contains what, hosted where, accessible to whom, in which country. Nine times out of ten, that will lead to at least one transfer nobody had on their radar, usually a support tool or a shared drive.
3. You'll likely need an EU representative, and you probably don't have one
This is the obligation we most often see missed.
Article 27 of the GDPR requires organizations outside the EU that offer goods or services to people in the EU, or monitor their behavior, to have a Representative established in the Union to be appointed. In writing. Mention in your privacy statement. Accessible to data subjects and supervisory authorities.
It applies to a Vietnamese company with a webshop targeting Europe. It applies if you run analytics or ad pixels that track European visitors. It is NOT covered by a European distributor, a European lawyer, or a European commercial agent.
Market prices for that service range from approximately €490 per year for automated solutions to €1,500–5,000 for standard services, and €5,000–15,000 when DPIA support and audits are included. The cost of not having it is a finding on the first serious questionnaire a European buyer sends you.
What you do: Does article 27 apply to you? If so: appoint someone and include their details in your privacy statement. It is a small, inexpensive, and fully solvable shortcoming—which is precisely why it looks so bad when it's left exposed.
2. The DPO question has two different answers
The PDPL and its implementing decree stipulate when a Vietnamese organization must have a data protection function and register. The GDPR, in Article 37, uses a different test based on core activities, scale, and whether you process special categories of data.
You can easily fall on the “not mandatory” side in Vietnam and on the “mandatory” side in Europe. The two systems don't align.
What you do: Conduct both tests separately and write down the reasoning, in both directions. “We have assessed this and concluded that no DPO is required, for these reasons” is a defensible position. Do not remain silent.
5. The notification periods do not run concurrently
The 72 hours the GDPR gives to report a data breach to the supervisor is notorious, and 72 hours is significantly shorter than it sounds when the incident starts on a Friday evening.
Vietnam has its own reporting requirements with its own deadlines. If your incident plan is built on one, it will fail on the other—and an incident is precisely when no one has time to figure out which rule applies.
What you do: one script, built on the strictest timetable, with the contact details of both supervisors included. Test it once with the team. A tabletop exercise takes an afternoon.
6. Data subject rights are more extensive in Europe
Access, rectification, erasure, restriction, objection.
You won't solve this in your policy. It is a systemic issue, and if the answer is “we'd have to do that manually,” you have a month to build something better.
What you do: Take your three most data-intensive systems and ask one simple question: if a European customer requests everything we have on them today in a machine-readable file, how long will that take? If the answer is more than a day, then you have your project.
7. Your privacy policy is now a sales document
This section is not about law and is entirely about revenue.
European buyers are increasingly conducting supplier research before signing. A European retailer or distributor's procurement team will look at your privacy policy, ask for your data flow map, inquire about your EU representative, and how you handle sub-processors. Not because they enjoy it - but because their own obligations flow down the chain.
Companies that can answer that within a week win contracts from companies that take three months. We have seen it happen. The compliance file is no longer a defense document. It's sales material.
What this means in concrete terms
The Vietnamese PDPL is a real, serious law with real penalties, and applying it correctly is not optional. But treating it as hat The privacy project of 2026 is a mistake for any company with European customers, because the two frameworks overlap for perhaps seventy percent — and it is the remaining thirty that appears in a buyer's questionnaire.
The good news: most of the work is shared. One data inventory serves both. One set of correctly drafted processor agreements serves both. One incident playbook, built on the strictest deadline, serves both. The double burden is smaller than it seems—but only if you design for both from the start, rather than building the second on later.
Where we come in handy
Chuyenso is based in Belgium. Our founder is EADPP certified under the European GDPR framework, we have over fifteen years of experience with data, hosting, and privacy infrastructure, and we guide companies outside of Europe who wish to sell into Europe without compliance being a deal bottleneck.
Eleven Europe scan The process spans three weeks. The first week will map out your current position. The second week will rank the gaps by risk and potential revenue. The third week will provide you with a 90-day plan and a compliance summary that you can immediately forward to a European buyer.
Would you prefer to just talk first: book a free 25-minute introduction. We'll tell you honestly if this is a problem you have, or not.
Chuyenso — literally: digital transformation. We help companies outside of Europe to become Europe-ready: legally, technically, and commercially.
Sources: Vietnam's New Personal Data Protection Law: A Closer Look (Tilleke & Gibbins)
· New Decree Provides Guidance for Vietnam’s Personal Data Protection Law (Tilleke & Gibbins)
· GDPR Article 27: The Complete Guide for Non-EU Businesses · EU Representative Providers Compared (2026)