On January 1, 2026, the Vietnamese Personal Data Protection Law came into effect. Law 91\/2025\/QH15 was approved by the National Assembly in June 2025, and Decree 356\/2025\/ND-CP was issued on the last day of the year to explain its practical implementation.<\/p>\n\n\n\n
If you've followed the reporting, you've probably seen the same sentence over and over: The PDPL is based on the GDPR<\/em>. That's broadly correct, and it's precisely why many Vietnamese exporters will soon hit a wall.<\/p>\n\n\n\n \u201cBased on\u201d is not \u201cequal to.\u201d And whoever sells to the European Union \u2014 and with almost $74 billion in two-way trade in 2025, that's a lot \u2014 now lives under two laws at once. Passing one audit doesn't mean you'll pass the other.<\/p>\n\n\n\n These are the seven differences we most often encounter.<\/p>\n\n\n\n The Vietnamese PDPL relies heavily on consent. Obtain explicit, specific, and informed consent, keep records of it, and you'll be largely compliant.<\/p>\n\n\n\n European regulators view that very differently. Under the GDPR, consent is one of six legal bases, and regulators have been pushing companies for years way<\/em> Because consent can be withdrawn at any time and because it is rarely freely given in an employment or B2B context. A European lawyer reading your privacy statement and seeing \u201cwe process your data with your consent\u201d everywhere will not see that as thorough. They will see that as untrained.<\/p>\n\n\n\n What you do:<\/strong> Link each processing activity to the correct GDPR legal basis \u2013 contract, legal obligation, or legitimate interest \u2013 and reserve consent for what it's truly needed for, like marketing. Then, write down why.<\/p>\n\n\n\n The PDPL provides for fines up to 5% of the previous year's annual revenue<\/strong> in breaches of cross-border data transfers. That's not a rounding error, and it tells you exactly where Vietnamese enforcement is going.<\/p>\n\n\n\n The GDPR has its own regime for the same problem, but in the opposite direction: transferring personal data from Europe outside of Europe requires an adequacy decision, standard contractual clauses, or another mechanism from Chapter V, plus a transfer impact assessment. Vietnam does not have a European adequacy decision.<\/p>\n\n\n\n So, a Vietnamese producer with a European sales office, a European CRM, and a Vietnamese support team operates two<\/strong> transfer regimes in opposite directions. And usually has no documentation for either.<\/p>\n\n\n\n What you do:<\/strong> Draw the actual data flows. Not the org chart\u2014the flows. Which system contains what, hosted where, accessible to whom, in which country. Nine times out of ten, that will lead to at least one transfer nobody had on their radar, usually a support tool or a shared drive.<\/p>\n\n\n\n This is the obligation we most often see missed.<\/p>\n\n\n\n Article 27 of the GDPR requires organizations outside the EU that offer goods or services to people in the EU, or monitor their behavior, to have a Representative established in the Union<\/strong> to be appointed. In writing. Mention in your privacy statement. Accessible to data subjects and supervisory authorities.<\/p>\n\n\n\n It applies to a Vietnamese company with a webshop targeting Europe. It applies if you run analytics or ad pixels that track European visitors. It is NOT covered by a European distributor, a European lawyer, or a European commercial agent.<\/p>\n\n\n\n Market prices for that service range from approximately \u20ac490 per year for automated solutions to \u20ac1,500\u20135,000 for standard services, and \u20ac5,000\u201315,000 when DPIA support and audits are included. The cost of not having it is a finding on the first serious questionnaire a European buyer sends you.<\/p>\n\n\n\n What you do:<\/strong> Does article 27 apply to you? If so: appoint someone and include their details in your privacy statement. It is a small, inexpensive, and fully solvable shortcoming\u2014which is precisely why it looks so bad when it's left exposed.<\/p>\n\n\n\n The PDPL and its implementing decree stipulate when a Vietnamese organization must have a data protection function and register. The GDPR, in Article 37, uses a different test based on core activities, scale, and whether you process special categories of data.<\/p>\n\n\n\n You can easily fall on the \u201cnot mandatory\u201d side in Vietnam and on the \u201cmandatory\u201d side in Europe. The two systems don't align.<\/p>\n\n\n\n What you do:<\/strong> Conduct both tests separately and write down the reasoning, in both directions. \u201cWe have assessed this and concluded that no DPO is required, for these reasons\u201d is a defensible position. Do not remain silent.<\/p>\n\n\n\n The 72 hours the GDPR gives to report a data breach to the supervisor is notorious, and 72 hours is significantly shorter than it sounds when the incident starts on a Friday evening.<\/p>\n\n\n\n Vietnam has its own reporting requirements with its own deadlines. If your incident plan is built on one, it will fail on the other\u2014and an incident is precisely when no one has time to figure out which rule applies.<\/p>\n\n\n\n What you do:<\/strong> one script, built on the strictest timetable, with the contact details of both supervisors included. Test it once with the team. A tabletop exercise takes an afternoon.<\/p>\n\n\n\n Access, rectification, erasure, restriction, objection.<\/p>\n\n\n\n You won't solve this in your policy. It is a systemic issue, and if the answer is \u201cwe'd have to do that manually,\u201d you have a month to build something better.<\/p>\n\n\n\n What you do:<\/strong> Take your three most data-intensive systems and ask one simple question: if a European customer requests everything we have on them today in a machine-readable file, how long will that take? If the answer is more than a day, then you have your project.<\/p>\n\n\n\n This section is not about law and is entirely about revenue.<\/p>\n\n\n\n European buyers are increasingly conducting supplier research before signing. A European retailer or distributor's procurement team will look at your privacy policy, ask for your data flow map, inquire about your EU representative, and how you handle sub-processors. Not because they enjoy it - but because their own obligations flow down the chain.<\/p>\n\n\n\n Companies that can answer that within a week win contracts from companies that take three months. We have seen it happen. The compliance file is no longer a defense document. It's sales material.<\/p>\n\n\n\n The Vietnamese PDPL is a real, serious law with real penalties, and applying it correctly is not optional. But treating it as hat<\/em> The privacy project of 2026 is a mistake for any company with European customers, because the two frameworks overlap for perhaps seventy percent \u2014 and it is the remaining thirty that appears in a buyer's questionnaire.<\/p>\n\n\n\n The good news: most of the work is shared. One data inventory serves both. One set of correctly drafted processor agreements serves both. One incident playbook, built on the strictest deadline, serves both. The double burden is smaller than it seems\u2014but only if you design for both from the start, rather than building the second on later.<\/p>\n\n\n\n Chuyenso is based in Belgium. Our founder is EADPP certified under the European GDPR framework, we have over fifteen years of experience with data, hosting, and privacy infrastructure, and we guide companies outside of Europe who wish to sell into Europe without compliance being a deal bottleneck.<\/p>\n\n\n\n Eleven Europe scan<\/strong> The process spans three weeks. The first week will map out your current position. The second week will rank the gaps by risk and potential revenue. The third week will provide you with a 90-day plan and a compliance summary that you can immediately forward to a European buyer.<\/p>\n\n\n\n Would you prefer to just talk first: book a free 25-minute introduction. We'll tell you honestly if this is a problem you have, or not.<\/p>\n\n\n\n Book a session<\/a><\/strong><\/p>\n\n\n\n Chuyenso \u2014 literally: digital transformation. We help companies outside of Europe to become Europe-ready: legally, technically, and commercially.<\/em><\/p>\n\n\n\n Sources:<\/strong>\u00a0Vietnam's New Personal Data Protection Law: A Closer Look (Tilleke & Gibbins)<\/a>\u00a0 Op 1 januari 2026 trad de Vietnamese Personal Data Protection Law in werking. Wet 91\/2025\/QH15 werd in juni 2025 goedgekeurd door de Nationale Vergadering, en Decreet 356\/2025\/ND-CP kwam op de laatste dag van het jaar om uit te leggen hoe het in de praktijk werkt. Als je de berichtgeving hebt gevolgd, heb je waarschijnlijk telkens […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"set","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[8],"tags":[],"class_list":["post-2786","post","type-post","status-publish","format-standard","hentry","category-europa"],"_links":{"self":[{"href":"https:\/\/chuyenso.com\/en\/wp-json\/wp\/v2\/posts\/2786","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/chuyenso.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/chuyenso.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/chuyenso.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/chuyenso.com\/en\/wp-json\/wp\/v2\/comments?post=2786"}],"version-history":[{"count":0,"href":"https:\/\/chuyenso.com\/en\/wp-json\/wp\/v2\/posts\/2786\/revisions"}],"wp:attachment":[{"href":"https:\/\/chuyenso.com\/en\/wp-json\/wp\/v2\/media?parent=2786"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/chuyenso.com\/en\/wp-json\/wp\/v2\/categories?post=2786"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/chuyenso.com\/en\/wp-json\/wp\/v2\/tags?post=2786"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n\n\n\n1. Consent is the standard in Vietnam. In Europe, it is the last resort.<\/h2>\n\n\n\n
\n\n\n\n2. Cross-border transfers, that's where the money is<\/h2>\n\n\n\n
\n\n\n\n3. You'll likely need an EU representative, and you probably don't have one<\/h2>\n\n\n\n
\n\n\n\n2. The DPO question has two different answers<\/h2>\n\n\n\n
\n\n\n\n5. The notification periods do not run concurrently<\/h2>\n\n\n\n
\n\n\n\n6. Data subject rights are more extensive in Europe<\/h2>\n\n\n\n
\n\n\n\n7. Your privacy policy is now a sales document<\/h2>\n\n\n\n
\n\n\n\nWhat this means in concrete terms<\/h2>\n\n\n\n
\n\n\n\nWhere we come in handy<\/h2>\n\n\n\n
\n\n\n\n
\u00b7\u00a0New Decree Provides Guidance for Vietnam\u2019s Personal Data Protection Law (Tilleke & Gibbins)<\/a>\u00a0
\u00b7\u00a0GDPR Article 27: The Complete Guide for Non-EU Businesses<\/a>\u00a0\u00b7\u00a0EU Representative Providers Compared (2026)<\/a><\/p>","protected":false},"excerpt":{"rendered":"