The problem: the Vietnamese framework you learned in 2023 expired on 1 January 2026
Multinationals operating in Vietnam often still run on Decree 13/2023 playbooks for the lawful bases of data processing. That decree is gone — replaced on 1 January 2026 by the Personal Data Protection Law 91/2025/QH15 and Decree 356/2025/ND-CP. Comparing GDPR with the current Vietnamese framework, not the expired one, is now the starting point for any dual-compliance design.
The two frameworks side by side
- EU — GDPR, Article 6(1): six lawful bases — consent, contract performance, legal obligation, vital interests, public task/official authority, and legitimate interests. Well-litigated, with extensive guidance on balancing tests for legitimate interests.
- Vietnam — Personal Data Protection Law 91/2025/QH15 (passed 26 June 2025, effective 1 January 2026; 5 chapters, 39 articles) and Decree 356/2025/ND-CP (31 December 2025, detailing the Law; fully replacing Decree 13/2023). Core logic: processing needs a lawful basis anchored in the data subject’s consent (with tightened validity conditions), contract performance, legal obligations and other statutory grounds; purpose limitation and data minimisation are explicit principles; data-subject rights come with defined handling timelines; cross-border transfers require an impact assessment and statutory conditions, and the authorities may order suspension of outbound transfers threatening national defence or security (Law, Article 20). Administrative fines reach 5% of prior-year revenue for cross-border violations; Decree 330/2026/ND-CP sets the sanction schedule.
Where the two regimes diverge in practice
Consent is heavier in Vietnam. Under GDPR, legitimate interests carry enormous weight in B2B and employment contexts; under the Vietnamese framework, consent is the default anchor and the validity bar (informed, specific, freely given, demonstrable) is enforced strictly — design consent flows first, fallbacks second. Cross-border transfer is the sharpest divergence. GDPR offers adequacy, SCCs and BCRs as scalable tools; Vietnam requires a transfer impact assessment filed under Decree 356 procedures, with the background risk of a suspension order. Documentation culture differs: Decree 356 standardised forms and dossiers (ten official templates) — Vietnamese compliance is form-driven in a way GDPR practice, with its accountability principle, is not. Build the Vietnamese dossier in the prescribed forms; do not assume a GDPR records-of-processing file satisfies a Vietnamese inspector.
A dual-compliance architecture
(1) Map every processing activity twice — once against GDPR Article 6, once against the PDPL bases — and flag where the bases differ (marketing and HR analytics diverge most). (2) Run one consent-management platform but with Vietnam-specific consent texts and withdrawal mechanics. (3) Treat Vietnam-to-abroad transfers as a separate workstream with their own impact assessments and filing calendar. (4) Keep two document sets: GDPR accountability records and Decree 356 statutory dossiers. The overlap is real but partial — designing for GDPR alone leaves the Vietnamese consent and transfer requirements uncovered.
Frequently asked questions
Can we rely on legitimate interests in Vietnam like we do under GDPR?
Not as a general substitute for consent. The Vietnamese framework centres consent; other bases exist but are narrower and less tested in practice. Structure Vietnamese processing around valid consent first.
Do we need to redo consents collected under Decree 13/2023?
No — consents lawfully obtained under Decree 13/2023 remain valid and do not need to be re-collected. But new processing and new purposes must meet the Law 91/2025 and Decree 356 standards.
What is the biggest fine risk?
Cross-border transfers: up to 5% of prior-year revenue for organisations breaching transfer rules, plus the operational nightmare of a suspension order. Get the transfer impact assessments right before moving data.
This article has been quality-reviewed by the FLAW AI Legal Council