EU Representative for Vietnamese Companies

Does GDPR Apply to Vietnamese Companies?

Yes. Vietnam is a third country under EU GDPR. Vietnamese businesses that process personal data of individuals in the European Union — whether through exporting goods, operating digital services, or partnering with EU companies — are subject to GDPR and must appoint an EU Representative under Article 27.

Vietnam’s Data Protection Framework

Vietnam’s Decree 13/2023/ND-CP on Personal Data Protection (effective July 2023) represents Vietnam’s first comprehensive data protection regulation. It establishes consent requirements, data subject rights, and cross-border transfer rules. However, Decree 13 applies to data processing within Vietnam and focuses on protecting Vietnamese data subjects. Key differences from GDPR:

• Territorial scope: Decree 13 primarily covers data processing within Vietnamese territory or affecting Vietnamese citizens; GDPR covers processing of any EU resident’s data anywhere in the world
• EU Representative: Decree 13 does not require an EU-based representative; GDPR Article 27 makes this mandatory
• Cross-border transfers: Decree 13 requires impact assessment and approval for data transfers outside Vietnam; GDPR requires SCCs, adequacy decisions, or BCRs for EU data
• Enforcement: Vietnam’s data protection authority is still establishing enforcement capacity; EU DPAs have a proven enforcement track record

Vietnamese Businesses Most at Risk

Manufacturing & export: Vietnam’s role as a global manufacturing hub means thousands of Vietnamese factories and export companies process EU customer data. Garment manufacturers, electronics assemblers, and furniture exporters all maintain EU customer databases, order records, and shipping documentation containing personal data.

E-commerce: Vietnamese sellers on Amazon EU, Shopee, Lazada, and cross-border platforms serving EU customers process names, addresses, payment details, and purchase histories of EU data subjects.

Tech outsourcing: Vietnam’s booming IT outsourcing sector means Vietnamese developers, QA engineers, and support teams routinely access EU personal data on behalf of EU clients — making both the client (data controller) and the Vietnamese company (data processor) subject to GDPR obligations.

Agriculture & food: Vietnamese exporters of coffee, rice, seafood, spices, and fruit to European markets process EU buyer and distributor contact data.

What EU Shield Provides for Vietnamese Clients

• EU-established legal address for regulatory correspondence
• 24-hour correspondence forwarding guarantee
• Record keeping of processing activities (Article 30)
• Designation letter compliant with Article 27(3)
• Vietnamese and English support
• Cross-border data transfer guidance
• Support for both controller and processor roles under GDPR

← Read the Complete Guide · See Pricing →