GDPR Takes Effect 25/5/2018: What Vietnamese Business Websites Need to Know

From 25/5/2018, the European Union's General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) officially applies. This regulation is not only for companies based in Europe: some organizations abroad, including Vietnamese businesses, may also fall within its scope. This article reviews what to check on your website, for reference only and not legal advice.

Are Vietnamese businesses within GDPR's scope?

Article 3 of GDPR sets out two main grounds. First, the organization has an establishment in the EU. Second, for organizations outside the EU, when data processing relates to offering goods or services to people in the EU, or monitoring their behavior taking place in the EU.

Some signs often cited when assessing whether you "target" EU customers:

• The website offers the languages or currencies of EU countries.
• You deliver goods, or take tour or room bookings, for customers in the EU.
• You run ads targeting users in EU countries.
• You use behavior-tracking tools (cookies, pixels) on visitors from the EU.

Your website merely being accessible from Europe doesn't necessarily bring you into scope. A specific assessment needs to rely on the official text and the opinion of a legal expert.

What to review on your website

1. The personal data you collect. List where you collect it: contact forms, newsletter sign-ups, orders, comments, account registration, analytics tools. For each type, state what it's collected for, where it's stored and how long it's kept.

2. Privacy notice (privacy policy). It must be clear and easy to understand: who controls the data, what is collected, the purpose, who it's shared with (for example email, payment and advertising services), user rights and how to get in touch.

3. Consent. When relying on consent, GDPR requires it to be freely given, specific and clear. Pre-ticked boxes don't fit this spirit. Forms should separate the checkbox for agreeing to marketing emails from submitting a contact request.

4. Cookies and tracking tools. Review the cookies of the website itself, plugins, Google Analytics, advertising pixels and embedded social media buttons. Many sites show a cookie banner letting users accept or decline before non-essential tools run.

5. User rights. Users have rights such as access, correction, deletion, restriction of processing or objection. Businesses should have a process for receiving requests, for example a dedicated email address and a person in charge.

6. Information security. Use HTTPS, update WordPress, plugins and PHP, set strong passwords, assign admin permissions carefully and back up regularly. GDPR also has rules requiring data breach notification to authorities within 72 hours in certain cases.

7. Third parties. Email marketing, hosting, payment and CRM services also process data. Review their data processing terms.

Fines and sensible preparation

GDPR sets administrative fines of up to 20 million euros or 4% of global turnover, whichever is higher, for the most serious violations. This figure mainly applies to serious breaches; small businesses needn't panic but should proceed step by step: list your data, update policies, add consent, review cookies and upgrade security.

Some organizations outside the EU may also need to consider appointing a representative in the EU under Article 27, with some exceptions. This should be checked with a lawyer or the competent authority.

2026 update: After this article was published, the European Data Protection Board (EDPB) issued Guidelines 3/2018 on the territorial scope of GDPR, clarifying how "targeting" EU customers is understood. Vietnam also now has its own regulations on personal data protection; check the latest official information on the government portals.

FAQ

Does a Vietnamese-only online shop have to comply with GDPR?

If there is no sign of targeting EU customers and you don't monitor the behavior of people in the EU, the likelihood of being in scope is lower, but each case needs assessing. Check with a legal expert.

If I only use Google Analytics, do I need a cookie banner?

Analyzing the behavior of visitors from the EU may be linked to notice and consent requirements. State it clearly in your privacy policy and consider an appropriate consent mechanism.

Where should I start?

Start by listing the data collected on your website, then update your privacy policy and forms. If you need technical support, you can contact HVSC's Technology team.

Reference sources

• EUR-Lex — Regulation (EU) 2016/679 (GDPR): https://eur-lex.europa.eu/eli/reg/2016/679/oj
• GDPR-info.eu — Article 3 Territorial scope: https://gdpr-info.eu/art-3-gdpr/
• European Commission — Data protection explained: https://commission.europa.eu/law/law-topic/data-protection/data-protection-explained_en
• EDPB — Guidelines 3/2018 on territorial scope: https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-32018-territorial-scope-gdpr-article-3-version_en