A Vietnamese company storing UK customer data on servers in Viet Nam — a breach? Post-Brexit, the UK runs its own UK GDPR (similar but not identical to EU GDPR), while Viet Nam applies Decree 356/2025/ND-CP (replacing 13/2023, effective 01/01/2026) tightening outbound personal-data transfers. Viet Nam–UK data flows must satisfy both ends.
1. UK GDPR: like EU GDPR but separate law
The UK GDPR (with the Data Protection Act 2018) mirrors the EU GDPR’s frame but is standalone UK law — the UK decides its own adequacy findings, and ICO interpretations may diverge from the EU’s EDPB over time. Practical consequence: a compliance assessment done for the EU is not automatically valid for the UK; data-processing agreements (DPAs) with UK partners must cite the UK GDPR, not the EU GDPR. Vietnamese businesses receiving personal data from the UK (e.g. e-commerce customers, job applicants) become controllers/processors under the UK GDPR with full duties.
2. The Viet Nam end: Decree 356/2025 tightens outbound transfers
Decree 356/2025 (replacing 13/2023 from 01/01/2026) imposes duties on transferring Vietnamese citizens’ personal data abroad: transfer impact assessments, protection mechanisms, and transfer conditions. Viet Nam → UK flows (e.g. a UK parent accessing Vietnamese HR/customer data) must pass this “gate” — “intra-group” is no excuse. Reality: many UK–Vietnamese groups move data through global HR/CRM systems without ever assessing the transfer — a violation waiting to be found.
3. Designing Viet Nam–UK flows compliant at both ends
(a) Map the data: which personal data crosses borders, in which direction, who controls it; (b) UK → Viet Nam: sign UK-GDPR-based DPAs with appropriate safeguards; (c) Viet Nam → UK: run the transfer impact assessment and meet Decree 356/2025’s conditions; (d) apply data-subject rights (access, erasure, objection) uniformly — the higher standard is usually the one to follow. Cross-border data is not an IT matter — it is a two-ended legal duty; fail one end and there is a breach.
Conclusion
Brexit split the data-protection map as it split the tariff map: one regime for the EU, one for the UK. Viet Nam–UK data flows are safe only through both gates — the UK GDPR and Decree 356/2025.
Frequently Asked Questions
Is the UK GDPR the same as EU GDPR?
Similar but not identical: the UK GDPR is standalone UK law (with the Data Protection Act 2018); the UK makes its own adequacy decisions and ICO interpretations may diverge from the EU’s EDPB over time.
Is Decree 13/2023 on personal data protection still in force?
No. Decree 13/2023 expired 01/01/2026, replaced by Decree 356/2025/ND-CP — tightening outbound personal-data transfers.
Must a UK parent accessing Vietnamese HR data assess the transfer?
Yes. Viet Nam → UK flows need a transfer impact assessment meeting Decree 356/2025’s conditions; intra-group reasons grant no exemption.
Which law should DPAs with UK partners cite?
The UK GDPR, not EU GDPR. An EU-done compliance assessment is not automatically valid for the UK.
