EU Compliance · 6 min read
The Vietnamese PDPL and the GDPR are not the same law. Exporters often get stuck here.
Stijn Belmans · certified EADPPPublished · Last updated
Short answer
The Vietnamese PDPL, effective since January 1, 2026, is based on the GDPR but not identical. Key differences: Consent is the default in Vietnam and a last resort in Europe; rules on data transfer and reporting deadlines differ, and Europe grants broader rights to data subjects. Vietnamese exporters to the EU typically also need an EU representative.
The Vietnamese Personal Data Protection Law took effect on January 1, 2026. Law 91/2025/QH15 was approved in June 2025 by the National Assembly, and Decree 356/2025/ND-CP was issued on the last day of the year to clarify its practical application.
If you’ve followed the news, you’ve likely seen the same line repeatedly: the PDPL is based on the GDPR. That’s broadly true, and it’s exactly why many Vietnamese exporters will soon hit a wall.
"Based on" is not the same as "equal to." And for those selling to the European Union — with nearly $74 billion in trade in both directions in 2025 — operating under two laws simultaneously is now a reality. Passing one audit does not mean you’ll pass the other.
These are the seven key differences we encounter most often.
1. In Vietnam, consent is the standard. In Europe, it is the last resort.
The Vietnamese PDPL heavily relies on consent. Request explicit, specific, and informed consent, keep the evidence, and you’re largely compliant.
European regulators look at this very differently. Under GDPR, consent is one of six lawful bases, and regulators have been pushing companies away from it for years — because consent can be withdrawn at any time and is rarely freely given in an employment or B2B context. A European lawyer reading your privacy statement and seeing ‘we process your data based on your consent’ everywhere won’t see that as thorough. They’ll see it as untrained.
What you do: link each processing activity to the correct GDPR legal basis — contract, legal obligation, or legitimate interest — and keep consent for what it truly needs, such as marketing. Then document why.
2. Cross-border data transfers: that’s where the money is
The PDPL imposes fines of up to 5% of the annual revenue from the previous year for breaches in cross-border data transfers. This is no rounding error, and it tells you exactly where Vietnamese enforcement is headed.
The GDPR has its own regime for the same issue, but in reverse: transferring European personal data outside the EU requires an adequacy decision, standard contractual clauses, or another mechanism from Chapter V, plus a transfer impact assessment. Vietnam does not have an EU adequacy decision.
A Vietnamese manufacturer with a European sales office, a European CRM, and a Vietnamese support team thus operates two transfer regimes in opposite directions. And usually lacks documentation for both.
What you do: map the actual data flows. Not the organigram — the flows. Which system holds what, hosted where, accessible to whom, in which country. Nine out of ten times, there’s at least one transfer no one noticed, usually a support tool or a shared drive.
3. You probably need an EU representative, and you probably don’t have one.
This is the requirement we most often see being overlooked.
Article 27 of the GDPR requires organizations outside the EU that offer goods or services to people in the EU, or monitor their behavior, to appoint a representative established in the Union. In writing. Mentioned in your privacy policy. Accessible to data subjects and supervisory authorities.
This applies to a Vietnamese company with an online store targeting Europe. It applies if you use analytics or advertising pixels tracking European visitors. It is not covered by a European distributor, a European lawyer, or a European trade agent.
Market prices for this service range from approximately €490 per year for automated solutions to €1,500–5,000 for a standard service, and €5,000–15,000 when DPIA support and audits are included. The cost of *not* having it is a red flag on the first serious questionnaire a European buyer sends you.
What you do: check if Article 27 applies to you. If it does: hire someone and update your privacy statement. It’s a small, cheap, and fully solvable shortcoming — precisely why it looks so bad when it’s out in the open.
4. The DPO question has two different answers
The PDPL and its implementing decree determine when a Vietnamese organization must have a data protection function and register. The GDPR, in Article 37, uses a different test based on core activities, scale, and whether you process special categories of data.
You can easily fall into the ‘not required’ category in Vietnam and the ‘required’ category in Europe. The two tests don’t align.
What you do: conduct both assessments separately and document the reasoning in both directions. ‘We have evaluated and concluded that no DPO is required, for these reasons’ is a defensible position. Silence is not.
5. Notification deadlines don’t align
The 72-hour window the GDPR gives to report a data breach to the supervisory authority is infamous, and 72 hours is much shorter than it sounds when the incident starts on a Friday evening.
Vietnam has its own reporting requirements with its own deadlines. If your incident plan is built for one, it will fail for the other — and an incident is exactly when no one has time to figure out which rule applies.
What you do: One playbook, built on the strictest timeline, with contact routes for both regulators included. Test it once with the team. A tabletop exercise takes an afternoon.
6. Data subjects’ rights are broader in Europe
Access, rectification, erasure, restriction, objection, and portability. Especially the latter — the right to receive your data in a structured, machine-readable format and transfer it to another controller — freezes companies whose systems were never designed to export neatly.
This isn’t something you solve in your policy. It’s a systemic issue, and if the answer is ‘we’d have to do this manually,’ you have a month to build something better.
What you do: Take your three most data-intensive systems and ask one simple question: If a European customer requested everything we have on them today in a machine-readable format, how long would that take? If the answer is more than a day, you have your project.
7. Your privacy statement is now a sales document
This section is not about law and fully about revenue.
European buyers increasingly conduct supplier due diligence before signing. A European retailer’s or distributor’s procurement team will review your privacy policy, ask for your data flow map, inquire about your EU representative, and how you handle sub-processors—not because they enjoy it, but because their own obligations cascade through the chain.
Businesses that can answer these questions within a week win contracts from those that take three months. We’ve seen it happen. The compliance dossier is no longer just a defensive document—it’s sales material.
What this concretely means
The Vietnamese PDPL is a serious law with real fines, and applying it correctly is not optional. But treating it as the privacy project of 2026 is a mistake for any company with European customers, as the two frameworks overlap by roughly seventy percent — and it’s the remaining thirty that will surface in a buyer’s questionnaire.
The good news: most of the work is shared. One data inventory serves both. One set of properly drafted processor agreements serves both. One incident playbook, built on the strictest terms, serves both. The double burden is smaller than it seems — but only if you design for both from the start instead of adding the second later on.
Where we come in
Chuyenso is based in Belgium. Our founder is certified EADPP under the European GDPR framework, and we’ve worked with data, hosting, and privacy infrastructure for over fifteen years. We guide businesses outside Europe that want to sell to Europe without letting compliance delay the deal.
Our Europe-scan spans three weeks. In week one, we map your current status. In week two, we rank gaps by risk and revenue at stake. In week three, you’ll receive a 90-day plan and a compliance summary to immediately forward to a European buyer.
Prefer to talk first? Book a free 25-minute introduction. We’ll honestly tell you whether this is an issue you have or not.
Chuyenso — literally: digital transformation. We help businesses outside Europe become Europe-ready: legally, technically, and commercially.
Sources: Vietnam’s New Personal Data Protection Law: A Closer Look (Tilleke & Gibbins)
· New Decree Provides Guidance for Vietnam’s Personal Data Protection Law (Tilleke & Gibbins)
· GDPR Article 27: The Complete Guide for Non-EU Businesses · EU Representative Providers Compared (2026)