A practical scenario: a Dutch company with a Vietnamese branch — Vietnamese customer data syncs nightly to servers in Amsterdam. “Parent and subsidiary — why worry?” — then it discovers: Vietnam → Netherlands must satisfy Vietnam’s Law 91/2025; Netherlands → Vietnam (remote access) must satisfy GDPR. Two-direction transfers mean two procedure sets — no single door.
1. Vietnam → Netherlands: Law 91/2025 and Decree 356/2025
Personal Data Protection Law 91/2025/QH15 (effective 1 January 2026) with Decree 356/2025/ND-CP (replacing Decree 13/2023/ND-CP) governs outbound personal-data transfers: companies must prepare transfer impact assessments, maintain protection mechanisms (contracts, technical measures), and complete authority procedures as regulated. Intra-group (parent–subsidiary) transfers get no exemption — “same company” is no excuse. Sensitive data (health, biometrics…) faces higher requirements.
2. Netherlands → Vietnam: GDPR and the SCC door
The EU’s GDPR bans personal-data transfers outside the EEA without a valid mechanism: an adequacy decision (Vietnam has none), SCCs (EC standard contractual clauses), BCRs (binding corporate rules), or narrow derogations. For Dutch–Vietnamese groups, the practical combo is SCCs + transfer impact assessment (TIA) — SCCs between parent and branch, assessing whether Vietnamese law “undermines” protection. GDPR breach fines reach 4% of global turnover — a figure every board must heed.
3. A two-direction transfer checklist
- Map the data: what data, which direction, stored where — no map, no compliance.
- Vietnam → EU: impact assessment + procedures under Decree 356/2025.
- EU → Vietnam: SCCs/BCRs + TIA under GDPR.
- Intra-group agreements: parent–subsidiary processing agreements, confidentiality, access controls.
- Data-subject rights: mechanisms for erasure/rectification/access requests — both systems require them.
Data transfers: two directions, two procedure sets — complete both
This article is general information. Each data model needs individual assessment. FLAT Law Firm helps companies comply with Vietnamese data law. Contact us for advice.
This article is general information only and does not replace legal advice for any specific case. Regulations may change; please check the current texts.
Frequently asked questions
1. Do intra-group transfers need compliance?
Yes — neither Law 91/2025 nor GDPR exempts parent–subsidiary transfers.
2. What are SCCs?
Standard Contractual Clauses — the EC’s model clauses for transfers outside the EEA.
3. Does Vietnam have an adequacy decision?
No — so EU-to-Vietnam transfers need SCCs/BCRs or derogations.
4. What does Decree 356/2025 cover?
It implements Law 91/2025 — replacing Decree 13/2023; regulating outbound transfers.
5. What are GDPR fines?
Up to 4% of global turnover — the highest among data laws.
This article is pending review by the QA Council.
Related articles
- Which Sectors Bar Foreign Investors from 100% Ownership?
- Pros and Cons of a 100% Foreign-Owned Company in Vietnam: The Risk Ledger
- When Should You Choose a 100% Foreign-Owned Company Over a Joint Venture?
- Supplier Screening under EUDR: How EU Buyers Assess Vietnamese Farms
- Australian Public Procurement under CPTPP: Opportunities for Vietnamese Bidders
