Scenario: a French retail group runs a centralised CRM in Paris, syncing customer and HR data nightly from its Vietnamese subsidiary. The CISO asks: “We have transferred like this for 3 years — is it lawful?” The answer requires viewing two separate directions: France→Vietnam under the GDPR, Vietnam→France under Vietnamese law — two different mechanism sets.
1. France → Vietnam: GDPR Chapter V and three main mechanisms
GDPR Chapter V (Articles 44–50) bans personal-data transfers out of the EU/EEA without a valid mechanism. Three practical mechanisms for French groups: (a) adequacy decisions — the European Commission recognising equivalent protection in the receiving country; Vietnam has none, so this is unavailable; (b) standard contractual clauses (SCCs) — Commission Decision 2021/914, modules per transfer relationship (controller-to-controller, controller-to-processor…), plus a transfer impact assessment (TIA) on the receiving country’s law; (c) binding corporate rules (BCRs) — DPA-approved internal rules, suited to large groups with frequent intra-group transfers. In practice: French groups typically use BCRs (if in place) or SCCs + TIA for EU→Vietnam flows.
2. Vietnam → France: Law 91/2025 and Decree 356/2025
The reverse — the Vietnamese subsidiary sending customer/HR data to Paris — is governed by the Law on Personal Data Protection No. 91/2025/QH15 and Decree No. 356/2025/ND-CP (effective 01/01/2026). Outbound-transfer conditions: a data-processing impact assessment, data subjects’ consent (especially for sensitive data — VIP customer data, employee health…), and safeguards (contracts, protection standards). Special note: Article 20 of Decree 356/2025 allows suspension of transfers on national defence/security grounds — groups need a fallback (local storage, on-site processing) if flows are halted.
3. The practical bottleneck: “two-headed” TIAs and impact assessments
The heaviest lift is not signing SCCs but the two-headed impact assessment: EU→VN needs a TIA on Vietnamese law (when may state authorities access data? what supplementary measures?); VN→EU needs an impact assessment under Vietnamese law. The two do not substitute for each other — doing one direction and “reusing” it is wrong. Another bottleneck: consent — for HR data (power imbalance) and legacy customer data (collected before Law 91/2025), obtaining valid consent for onward transfer is a project of its own, not a notification email.
4. Compliance architecture: four layers for French groups
Layer 1 — data-flow mapping: what data, whose, which direction, stored where (Paris, Vietnam, third-country cloud?). Layer 2 — per-direction legal mechanisms: EU→VN (SCCs/BCRs + TIA), VN→EU (impact assessment + consent + safeguards under Decree 356/2025). Layer 3 — intra-group contracts: data-processing agreements between parent and subsidiary, terms with vendors (CRM, cloud, payroll providers). Layer 4 — operations: data-subject rights workflows (access, erasure, objection) in both countries, breach-response plans (72-hour notification under GDPR), and the transfer-suspension playbook under Article 20, Decree 356/2025.
5. Review checklist for groups already transferring as in the opening scenario
One, stop and assess: does the current nightly sync have any legal mechanism — if it “transfers because it always has”, that is the risk. Two, deploy SCCs/BCRs + TIA for EU→VN. Three, run impact assessments + consent review for VN→EU under Decree 356/2025. Four, sign intra-group and vendor data-processing agreements. Five, build the suspension playbook (local storage). Six, train IT and legal teams in both countries — cross-border data compliance usually fails because IT does not know what legal requires, not for lack of law.
Frequently Asked Questions
Does Vietnam hold an EU adequacy decision?
No. The European Commission has issued no adequacy decision for Vietnam, so French groups cannot rely on it — SCCs or BCRs (with a transfer impact assessment) are needed for EU→Vietnam flows.
What are SCCs and which module applies?
Standard contractual clauses issued by the European Commission (Decision 2021/914), with modules per relationship: controller-to-controller, controller-to-processor… Match the module to the parent’s and subsidiary’s actual roles in the flow, plus a transfer impact assessment (TIA).
What is needed to transfer data from Vietnam to France?
Under Law 91/2025 + Decree 356/2025 (effective 01/01/2026): a data-processing impact assessment, data subjects’ consent (especially sensitive data), and safeguards. Note Article 20 of Decree 356/2025 allows transfer suspension on defence/security grounds.
What is the risk of the current nightly CRM sync?
Without legal mechanisms (SCCs/BCRs for EU→VN; impact assessment + consent for VN→EU), the flow violates both frameworks — with GDPR fines up to 4% of global turnover and sanctions under Vietnamese law. Stop and assess before continuing.
This article has been quality-reviewed by the FLAW AI Legal Council