Editorial · March 20, 2018
GDPR for Vietnam Websites: When the Rules Apply
GDPR for Vietnam websites matters if your site is aimed at people in the European Union, or if it tracks what those people do. The rules apply from 25 May 2018, which is about nine weeks away. A shop in Ho Chi Minh City or Hanoi does not need to be in Europe to be covered. Location of the server or the company is not the test. The test is who your site serves and watches.
This note explains when the rules apply and what to do first. It is general information, not legal advice.
What GDPR is and when it starts
GDPR is short for the General Data Protection Regulation. Its formal name is Regulation (EU) 2016/679. EU lawmakers adopted it on 27 April 2016. It replaces an older EU data protection directive from 1995.
It became law in 2016, but it does not apply until 25 May 2018. That gap gives businesses time to prepare. After that date, regulators in EU countries can enforce it.
The rules cover personal data. That means any information about an identifiable person, such as a name, an email address or an online identifier.
When a Vietnam business is covered
Article 3 sets the scope. It has two parts that matter to a Vietnamese site owner.
First, if you have an establishment in the EU, such as an office or a branch, the rules cover the processing done for that establishment. This is true even if the data is handled outside Europe.
Second, if you have no EU presence, the rules still apply in two cases. One is when you offer goods or services to people who are in the EU. The other is when you monitor the behaviour of people in the EU, as far as that behaviour happens in the EU. Offering can be free or paid.
The rules protect people who are in the Union when the data is processed. Their passport does not decide it.
Signs your website is in scope
A site is more likely to be covered if it shows clear intent to serve EU customers. Look for these signs on your own pages:
- Prices in euros or pounds, or a choice of EU currencies at checkout.
- Shipping to EU countries.
- A language version aimed at an EU country, such as German or French.
- Marketing that names EU customers or EU countries.
- Tools that track visitors from the EU, such as ad cookies that build profiles.
A plain English site that happens to be readable in Europe is a weaker case. The law looks at what you plan to do, so write down why your site is or is not aimed at the EU.
First steps to take now
If you think your site may be covered, start with a short list.
- Map your data. List what you collect, why, where it is stored and who can see it.
- Check your consent. Consent must be freely given, specific, informed and unambiguous. Pre-ticked boxes and silence do not count.
- Update your privacy notice. Say in plain words what you collect and what you use it for.
- Plan for requests. People in the EU can ask to see their data or to have it deleted. Decide who answers and how fast.
- Keep only what you need. Delete data you no longer have a reason to hold.
Small steps now are cheaper than a rushed fix in May.
Representatives, breaches and fines
A business outside the EU that is covered under Article 3(2) must usually name a representative in the Union, in writing. The rules list some exceptions, such as processing that is occasional and low risk.
If personal data is breached, the rules say to tell the supervisory authority without undue delay. Where feasible, that means within 72 hours of becoming aware of it.
Fines can be large. The top level is up to 20 million euros, or up to 4 percent of worldwide yearly turnover for a company, whichever is higher. That top level applies to the most serious breaches, such as ignoring the core principles or the rights of individuals.
Fines are set case by case, and many breaches fall under a lower tier.
What to do this month
Ask one question first: does my site aim at people in the EU? If the answer is no, record the reasons and review them when your plans change. If the answer is yes or maybe, begin the data map this week. Then fix consent and your privacy notice before 25 May 2018. For hard cases, ask a lawyer who knows EU data protection law.
Sources
A place on this register is not for sale.