The Personal Data Protection Law (PDPL) lists providing (cung cấp) and transferring (chuyển giao) as two forms of processing personal data, but defines neither.

Based on the ordinary meaning of those two terms, they mean much the same thing, and either can describe the same act: a business handing a data subject's personal data to another party. The context in which the PDPL uses those two terms does not help separate them either. Article 15.2(b) of the PDPL allows a business to provide data to another organization "when the data subject consents", and Article 17.1(a) of the PDPL also allows a transfer "when the data subject consents".

Article 7.6 of Decree 356/2025 detailing the PDPL (Decree 356/2025) addresses the distinction, but leaves more confusion than clarity. It says that providing data under Article 15.2 of the PDPL "on each specific request of the data subject" (dựa trên từng yêu cầu cụ thể của chủ thể dữ liệu) is not regarded as a transfer, so none of the transfer requirements in Article 7 of Decree 356/2025 applies to it. The problem is what this means for providing without such a request. Although Article 7.6 of Decree 356/2025 does not explicitly say that it is a transfer, a rule that providing on request "is not regarded as" (không được coi là) a transfer would hardly be needed if the two could not be confused, so Article 7.6 itself appears to accept that they overlap in some respect. One could therefore argue that providing without such a request is a transfer. A business that shares data with a partner on a single consent given in advance, without a request from the data subject each time, could then be transferring the data, and would have to meet the transfer requirements.

The label matters, because the requirements differ:

- Providing. The business needs the data subject's consent, unless the law provides otherwise. A consent for a stated purpose continues until the data subject changes it, unless the law provides otherwise, so one consent can cover repeated provision within its scope. Article 15.2 itself does not require an agreement with the recipient.

- Transferring with consent, free of charge. A transfer based on consent (Article 17.1(a) of the PDPL) also needs consent, and one consent can likewise cover repeated transfers within its scope. But the business must also make an agreement with the recipient covering seven matters listed in Article 7.1 of Decree 356/2025, including the purpose, the data, the processing period and each party's responsibilities.

- Transferring with consent, for a fee. Where the business charges a fee for a transfer made to provide a service to, or serve the lawful interests of, the data subject, it must, in addition, set up a technical system and transparent mechanism for the data subject to consent to each transfer, and meet other conditions, such as limiting the data and its use to the consented purpose. Decree 330/2026 on administrative sanctions treats a transfer for a fee or other material benefit without that mechanism as an unlawful sale of personal data; where there are receipts, organization fines are two to ten times their amount.

This post is written by Ha Thanh Phuc.

Vietnam Business Law