French companies in Vietnam (or Vietnamese companies with French customers) move personal data back and forth daily: staff, customers, marketing. Two laws bite at once: the EU’s GDPR and Vietnam’s Law 91/2025 — and they are not the same.
Two laws, two logics
- GDPR (EU) 2016/679: applies to any organisation processing EU residents’ data — including Vietnamese companies selling to French customers (extraterritorial effect). Principles: lawfulness, fairness, transparency; purpose limitation; minimisation; strong data-subject rights (erasure, objection, portability).
- Law 91/2025 (Vietnam): effective 1/1/2026 + Decrees 356/2025, 330/2026 — requiring consent (ending “silence is consent” — fines of VND 50–70 million), impact assessments, and filing/assessment for cross-border transfers.
- Common ground: both punish hard — GDPR up to 4% of global revenue, Vietnam up to 5% of revenue (unlawful transfers) + VND 20m–3bn.
France → Vietnam transfers (under GDPR)
EU residents’ data moved to Vietnam (servers, outsourcing, parent companies):
- No adequacy for Vietnam: the EU has not recognised Vietnam as adequate — no free transfers.
- SCCs: the EU’s standard contractual clauses — the most common tool; signed between the exporter (France) and importer (Vietnam) + a transfer impact assessment of the importer’s law.
- BCRs: binding corporate rules — for intra-group French–Vietnamese transfers; approved by data authorities (taking 1–2 years).
- Exceptions: explicit consent, contract performance — only for specific cases, not routine flows.
Vietnam → France transfers (under Law 91/2025)
Vietnam residents’ data moved to France:
- Legal basis: data subjects’ consent (or other Law 91/2025 bases) — “silence is consent” is fined VND 50–70m.
- Impact assessment: prepare the transfer impact-assessment file before transferring.
- Recipient: the French company must commit to protection (DPA contract) — and the transferor (Vietnam) is liable if the recipient breaches.
- Fines: unlawful transfers — up to 5% of revenue (Decree 330/2026).
CNIL: France’s biting authority
The CNIL (France’s data commission) is among the EU’s toughest data authorities — having fined hundreds of millions of euros (Google, Meta…). Vietnamese businesses with French customers/staff:
- Appoint a DPO: a data protection officer for large-scale processing.
- Processing records: maintain records of processing activities.
- Breach notification: notify the CNIL within 72 hours, subjects when high risk.
- Cookies: websites targeting French customers need CNIL-compliant consent banners (no pre-ticked “accept”).
The parallel-compliance checklist
- Data mapping: list every Vietnam ↔ France flow (staff, customers, marketing, outsourcing).
- Two contract layers: SCCs (EU→VN direction, GDPR) + DPA/impact assessment (VN→EU direction, Law 91/2025).
- Consent: audit every collection form — drop pre-ticked boxes and “silence is consent” (both GDPR and Law 91/2025 ban them).
- Subject rights: processes to answer erasure/access/objection requests on time (GDPR: 1 month).
- People: train both countries’ teams — breaches usually come from employees, not hackers.
Risks and notes
‘One-law’ risk: complying only with GDPR while forgetting Law 91/2025 (or vice versa) — both laws apply together; satisfy both. Hidden-transfer risk: emails, cloud and outsourcing all count as cross-border transfers — not just “database exports”. CNIL risk: a French customer complaint → CNIL investigation → tens-of-millions-euro fines — handle complaints fast. 5% risk: Vietnam→France transfers without impact assessment = up to 5% of revenue — file first.
Frequently asked questions
How do GDPR and Law 91/2025 differ?
GDPR applies extraterritorially — Vietnamese firms processing EU residents’ data are covered; Law 91/2025 (effective 1/1/2026) requires consent (banning ‘silence is consent’), impact assessments and transfer procedures; both fine hard (GDPR 4%, Vietnam 5% of revenue).
What do France → Vietnam transfers need?
Vietnam lacks EU adequacy — use SCCs + transfer impact assessments; or BCRs for intra-group (1–2 year approval).
What do Vietnam → France transfers need?
Under Law 91/2025: data-subject consent (‘silence is consent’ fined VND 50–70m), pre-transfer impact-assessment files, DPA contracts with recipients; unlawful transfers fined up to 5% of revenue.
What is the CNIL?
France’s data commission — among the EU’s toughest (hundreds of millions in fines); requires DPOs, processing records, 72-hour breach notices, compliant cookie banners.
Contact FLAT Law Firm
FLAT Law Firm advises on Vietnamese–French data compliance: GDPR, Law 91/2025, SCCs/BCRs and two-way transfers. Contact us when cross-border data flows exist.
This article has been quality-reviewed by the FLAW AI Legal Council
