GDPR vs Vietnam PDPL: what the GDPR is and how Law 91/2025 differs

What is the GDPR?

The GDPR is the European Union's general rulebook on processing personal data. Its full name is Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016. It is directly applicable in every Member State and has applied since 25 May 2018 (Article 99). Because it is a regulation, not a directive, businesses and individuals in the EU rely on its text directly, although Member State law fills in some points.

In substance, the GDPR covers: processing principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability (Article 5); six lawful bases (Article 6); conditions for consent (Article 7); a prohibition on processing special categories of data unless an exception applies (Article 9); data subject rights (Articles 12 to 22); organisational duties such as processor contracts (Article 28), breach notification (Articles 33 and 34), impact assessments (Article 35) and data protection officers (Article 37); and rules on transfers outside the EU (Articles 44 to 49). Each Member State must have at least one independent supervisory authority (Clause 1, Article 51).

The text used for this entry is the English version published in the Official Journal of the European Union (EUR-Lex). This entry compares against the original 2016 text; check the current EU text before relying on a specific article.

Does the GDPR apply to a company in Vietnam?

The GDPR does not apply in Vietnam merely because it exists. Article 3 defines its reach, and for a business outside the EU there are two routes in.

Two practical points. First, Clause 2 of Article 3 GDPR looks at people who are in the EU, not at their nationality, whereas Law 91 defines its scope by the regulated persons and by data of Vietnamese citizens (Clause 2, Article 1 of Law 91). Second, a business within Clause 2 of Article 3 must usually designate in writing a representative in the EU, established in a Member State where the people offered goods or services, or monitored, are located, subject to the exceptions in Clause 2, Article 27. Designating a representative does not remove the business's own liability (Clause 5, Article 27).

A common confusion is a Vietnamese vendor processing data on behalf of an EU customer. The EU customer is the controller and is bound by the GDPR under Clause 1, Article 3; the Vietnamese vendor is usually bound through the processor contract under Clause 3, Article 28 and the transfer conditions in Chapter V. Whether the vendor is also directly caught by Clause 2, Article 3 depends on what it actually does. This is LexData's practical view: we have not found any Vietnamese text or official guidance, among the sources checked for this entry, that addresses the Vietnamese vendor scenario, and the European Data Protection Board guidance on territorial scope has not been checked for this entry, so each activity needs its own analysis.

GDPR vs Vietnam PDPL: side-by-side comparison

The tables below set the two frameworks side by side. The Vietnamese column follows the text of Law 91/2025/QH15, Decree 356/2025/ND-CP and Decree 330/2026/ND-CP. It is a descriptive comparison by text, not an assessment of how similar or different the two policies are.

GDPR vs Vietnam PDPL: where the differences matter most

Five differences most often cause surprises in Vietnam. For a Vietnamese business preparing to sell into the EU, the reverse also holds.

1. No general legitimate-interests basis. In the EU, activities such as marketing emails to existing customers often rely on point (f), Clause 1, Article 6 GDPR. In Vietnam consent is the default and the no-consent cases are listed in Clause 1, Article 19. The closest provision to legitimate interests is point (a) of that clause (necessary protection of legitimate rights or interests against infringement, with the burden of proof on the party relying on it); some activities such as fraud prevention may fall under point (a) or (b), but each case must be assessed on its own. See what is consent.
2. Dossiers filed with the authority. The GDPR puts accountability on the controller (Clause 2, Article 5); an impact assessment leads to consulting the supervisory authority only if high risk remains after mitigation (Clause 1, Article 36), so not every file is submitted. Law 91 requires the impact assessment dossier and the transfer dossier to be sent to the specialised authority within 60 days; see what is a DPIA and cross-border data transfers.
3. Response times for data subjects. A process built around the GDPR's one month may be too slow for the basic 10, 15 or 20 days of Decree 356, with an initial reply within 2 working days. Where a processor or third party must act, the periods are longer (15, 20 or 30 days) and one extension is possible, so the total can exceed one month; the shortest period is still the sensible internal standard (Clauses 2 to 4, Article 5).
4. Different breach triggers. The GDPR allows no notification where risk is unlikely; Article 23 of Law 91 ties the 72-hour duty to specified kinds of harm, with no mechanism for explaining delay. An incident that need not be notified in the EU may still need assessment under Clauses 1 and 3 of Article 23 in Vietnam. In addition, location or biometric data and sensitive data in finance, banking and credit carry their own 72-hour duty to notify data subjects; see the 72-hour data breach rule.
5. No risk-based trigger for a DPO-type role. A small EU company may need no DPO (unless Member State law requires one); in Vietnam the duty to designate a department, personnel or a service provider applies to organisations generally, except the exempt or opt-out groups in Article 38. See what is a DPO.

The similarities are real too. Both distinguish controller and processor (Clauses 7 and 8, Article 2 of Law 91; Clauses 7 and 8, Article 4 GDPR), both require a contract with the processor (Clause 3, Article 28 GDPR; Clauses 1 and 2, Article 37 of Law 91), both have a 72-hour breach notification to the authority, and both write purpose, accuracy and proportionate retention into law (Article 5 GDPR; Article 3 of Law 91, see data protection principles). Law 91 also has a "controller-processor" role (Clause 9, Article 2) that the GDPR lacks, while the GDPR has joint controllers (Article 26) that Law 91 does not provide for.

How can a business comply in both the EU and Vietnam?

This part is practice, not law.

1. One data map and one record of processing. Record purposes, data types, recipients, storage location and retention. From one map you can draw the impact assessment dossier (Article 19 of Decree 356), the transfer dossier (Article 18 of Decree 356) and, where required, the record under Article 30 GDPR; see record of processing activities.
2. Apply the stricter rule issue by issue, not to the whole system. On consent: per purpose, with a stored log, no pre-ticked boxes, which satisfies both Article 7 GDPR and Article 9 of Law 91 with Article 6 of Decree 356. On data subject requests: use the shorter Vietnamese deadlines. On breaches: test each law's trigger separately but run one incident process and one 72-hour clock.
3. Keep two transfer mechanisms apart. Data from the EU to Vietnam needs a Chapter V GDPR tool, in practice usually standard data protection clauses (point (c), Clause 2, Article 46), since Vietnam has no adequacy decision. Data leaving Vietnam, including to an EU parent or a foreign cloud provider, needs the dossier filed under Article 20 of Law 91. One does not replace the other.
4. Vendor contracts. Use one processing agreement that meets both Clause 3, Article 28 GDPR and Article 37 of Law 91; see data processing agreements.
5. One lead, two sets of conditions. One person can be the lead for both systems if they meet Article 13 of Decree 356 and, where a DPO is required, the professional qualities in Clause 5, Article 37 GDPR. A group of undertakings may appoint a single DPO if that person is easily accessible from each establishment (Clause 2, Article 37 GDPR).
6. Review when the law changes. Law 91 applies from 1 January 2026 and the penalty Decree 330/2026/ND-CP from 19 August 2026; the European Commission has also proposed changes to the GDPR (the Digital Omnibus package of 19 November 2025, which touches the threshold and deadline for breach notification; its adoption status has not been checked as of the date of this entry). Schedule reviews of both.

GDPR vs Vietnam PDPL for FDI companies with an EU parent

For a foreign-invested company in Vietnam with an EU parent or partner, three situations are common:

• The Vietnamese subsidiary collects data of customers and employees in Vietnam. This processing is under Law 91, which covers Vietnamese organisations and foreign organisations in Vietnam (points (a) and (b), Clause 2, Article 1). The EU parent may be a controller or recipient and is bound by the GDPR under Clause 1, Article 3 for processing in the context of its EU activities. Conversely, a foreign organisation directly involved in or related to processing data of Vietnamese citizens, including an EU parent receiving Vietnamese employee data, also falls within Law 91 (point (c), Clause 2, Article 1).
• Sending data to the parent or using an HR system hosted in the EU. This is a cross-border transfer under point (b) or (c), Clause 1, Article 20 of Law 91. Employee data may be exempt from the dossier where the organisation stores its own employees' data on a cloud service (point b, Clause 6, Article 20) or transfers it for cross-border personnel management under labour rules and collective agreements (point d, Clause 3, Article 17 of Decree 356), but these are narrow exceptions to be tested case by case, not a blanket exemption for HR data.
• EU customers buying services from the Vietnamese company. Test Article 3 GDPR as in the table above, and the processing agreement the customer will require (Article 28 GDPR). On the Vietnam side, the company is a Vietnamese organisation, so on LexData's reading its processing of personal data on Vietnamese territory is under Law 91 (point (a), Clause 2, Article 1; Clause 1, Article 5), even where the data subjects are EU customers. There is no official guidance yet on how Article 20 applies to data of foreign persons that merely passes through a system in Vietnam.

See also what is an FDI company in Vietnam and the service on PDPL compliance consulting for data mapping and contract review.

GDPR vs Vietnam PDPL checklist

Steps 3 to 10 that concern the GDPR apply only if step 1 shows that Article 3 GDPR applies or an EU partner requires them by contract; the Law 91 steps apply to activities within Clause 2, Article 1 of Law 91.

1. Decide whether Article 3 GDPR applies: EU establishment, offering to people in the EU, monitoring behaviour in the EU; record the conclusion and reasons.
2. If Clause 2, Article 3 applies, consider designating an EU representative (Article 27) or document the exception relied on.
3. Build a data map: which data is sensitive under Article 4 of Decree 356 and which is special category under Article 9 GDPR.
4. Check the legal basis for each activity: consent or an Article 19 exception in Vietnam; the relevant Article 6 basis in the EU.
5. Standardise consent forms per purpose with a stored log.
6. Set the data subject request process to the shortest applicable deadline (Article 5 of Decree 356).
7. Prepare the impact assessment dossier as soon as processing starts and, if data goes abroad, the transfer dossier before or while the transfer begins (Clause 1, Article 55 and point a, Clause 1, Article 56 of Decree 330); file the original with the specialised authority within 60 days of the first day of processing or transfer.
8. Identify the tool for EU-to-Vietnam transfers under Article 46 GDPR.
9. Align the incident process with one 72-hour clock for both systems.
10. Designate a department or personnel and check Article 13 of Decree 356; consider a DPO under Article 37 GDPR if required.

Common mistakes

• Treating the GDPR as a default obligation in Vietnam, or the opposite: assuming it never matters to a Vietnamese business that sells into the EU.
• Assuming a DPA and EU standard clauses are enough to move data out of Vietnam, when Article 20 of Law 91 also requires a dossier filed with the specialised authority.
• Using the GDPR's one-month reply time for requests in Vietnam, when Decree 356 sets basic periods of 10 to 20 days (15 to 30 days where a processor or third party must act, with one extension).
• Treating Vietnamese "de-identification" and GDPR "pseudonymisation" as the same: pseudonymised data stays personal data under the GDPR (Clause 5, Article 4 and Recital 26), while de-identified data in Vietnam is no longer personal data (Clause 1, Article 2 of Law 91).
• Comparing the two fine regimes by one number, ignoring that the GDPR uses worldwide turnover, Law 91 uses the organisation's previous-year revenue (the text does not limit it to Vietnamese revenue) with a VND 3 billion cap for ordinary violations, and Decree 330 uses previous-financial-year revenue in the Vietnamese market for three serious transfer-related conducts; most dossier failures carry only tens of millions of dong.