The problem: Canada’s privacy law is old, Vietnam’s is brand new — and both apply to you
A Vietnamese company serving Canadian customers, or a Canadian company operating in Vietnam, sits under two regimes moving in opposite directions. Canada still runs on PIPEDA, a federal law from 2000 whose reform bills keep dying in Parliament. Vietnam just switched on a brand-new Personal Data Protection Law on 1 January 2026. Designing one privacy program for both requires knowing exactly where they overlap and where they pull apart.
The two frameworks side by side
- Canada — PIPEDA (Personal Information Protection and Electronic Documents Act): in force since 2001, built on ten fair information principles (accountability, identifying purposes, consent, limiting collection/use/disclosure/retention, accuracy, safeguards, openness, individual access, challenging compliance). The Privacy Commissioner investigates and publishes findings but has no order-making or fining power — enforcement runs on publicity. Breach notification: report to the Commissioner and notify affected individuals where there is a real risk of significant harm. Still the governing federal law as of 19 October 2026: Bill C-27 (which would have replaced it) died when Parliament was prorogued in January 2025, and Bill C-36 (Protecting Privacy and Consumer Data Act), tabled June 2026, is not in force.
- Quebec overlay: Quebec’s Law 25 is in full force since 22 September 2024 and is Canada’s strictest regime — privacy impact assessments before transfers outside Quebec, and penalties up to CAD 10 million or 2% of worldwide turnover (administrative) and CAD 25 million or 4% (penal). Any business touching Quebec residents designs to Law 25, not just PIPEDA.
- Vietnam — PDPL 91/2025/QH15 (effective 1 January 2026) and Decree 356/2025/ND-CP (fully replacing Decree 13/2023): consent-centred lawful bases, defined data-subject rights timelines, cross-border transfer impact assessments with filing procedures, authority power to suspend outbound transfers (Article 20), and fines up to 5% of prior-year revenue for transfer violations (Decree 330/2026 sanctions).
Where they pull apart
Enforcement philosophy: PIPEDA’s Commissioner names and shames; Vietnam’s framework fines — up to 5% of revenue — and can halt your data flows. The Vietnamese side demands the heavier compliance investment. Consent: both are consent-centred, but Vietnam’s validity conditions and documentation duties (Decree 356’s standardised forms) are more prescriptive than PIPEDA’s reasonableness-based approach. Cross-border transfers: PIPEDA is comparatively permissive for transfers to processors with contractual safeguards; Vietnam requires a formal impact assessment and filing, with suspension risk. Provincial overlay vs unitary state: in Canada you must check Quebec (and note Alberta/BC’s own acts); in Vietnam one national framework applies — simpler jurisdictionally, stricter substantively.
A dual-market privacy design
(1) Build to the stricter substantive bar — Vietnam’s consent documentation and transfer assessments — and you will generally satisfy PIPEDA’s principles too. (2) Add the Quebec layer wherever Quebec residents’ data is involved: impact assessment before moving it out of Quebec. (3) Keep breach playbooks with two clocks: PIPEDA’s “real risk of significant harm” analysis for Canada, Vietnam’s notification duties and 72-hour sanction line (Decree 330/2026) for Vietnam. (4) Do not design against Bill C-36’s draft provisions — track the bill, build to the law in force.
Frequently asked questions
We only sell online to Canadians from Vietnam. Does PIPEDA apply?
Yes, if you collect personal information from Canadians in the course of commercial activity — PIPEDA has no revenue threshold and applies to the activity, with the Quebec overlay where Quebec residents are involved. And Vietnam’s PDPL applies to your processing in Vietnam regardless.
Should we wait for Bill C-36 before updating our Canadian program?
No. The bill is before Parliament and its provisions may change in committee. Build to PIPEDA and Law 25 now; track C-36 as a future delta, not a current design input.
Which side carries the bigger fine risk today?
Vietnam, by a wide margin: up to 5% of prior-year revenue for transfer violations, versus PIPEDA’s publicity-based enforcement (with Quebec’s heavy penalties as the Canadian exception).
This article has been quality-reviewed by the FLAW AI Legal Council