When a European buyer asks a Vietnam-based development team "are you GDPR compliant," the honest answer is almost never a simple yes or no. It depends on who else touches the data.
A development team that processes personal data on your behalf is a GDPR processor, and under Article 28(4) that processor must flow down the same data protection obligations to every subprocessor it uses, whether that is a cloud hosting provider, a monitoring tool, or a QA vendor.
f your Vietnam partner cannot produce a current list of those subprocessors, with what each one does and where it sits, the compliance claim is not verifiable, and an unverifiable compliance claim is not a compliance claim at all.
TL;DR
GDPR Article 28(2) requires processors to get your written authorization before adding a subprocessor; Article 28(4) requires the same data protection terms to apply down the chain.
A subprocessor list should name the vendor, the processing activity, the data category touched, and the physical location of the data.
Ask for the notification mechanism and window (commonly 15 to 30 days) before a new subprocessor goes live, not after.
Vietnam's own Personal Data Protection Law and Decree 356/2025/ND-CP impose a parallel consent-before-subcontracting requirement, so a Vietnam-based processor has two overlapping obligations to satisfy, not one.
ISO 27001, under its Annex A supplier relationship controls, requires documented subprocessor risk management, so ask to see the control, not just the certificate logo.
About the Author: 724SOFTWARE is a Vietnam-based engineering partner delivering dedicated teams and offshore development centers for Fintech, healthcare, and SaaS clients across 10+ countries, with its own delivery organization aligned with ISO 27001:2022 and operating under GDPR compliance obligations as a processor for EU-facing clients. This article reflects how the company structures its own subprocessor documentation for clients in regulated industries.
What Counts as a Subprocessor, and Why Does the Distinction Matter?
A processor is the entity that handles personal data on the controller's instructions; a subprocessor is a third party the processor brings in to carry out part of that work. The distinction matters because liability and disclosure obligations attach differently depending on which role a vendor plays. A cloud hosting provider that only exists because your development team contracted it to store build artifacts and user data is a subprocessor. A payment gateway that processes transactions under its own compliance obligations, for its own fraud-prevention purposes, is usually treated as an independent controller rather than a subprocessor, because it is not simply following your processor's instructions.
This distinction is not academic. If your Vietnam-based team tells you "we don't have subprocessors," the next question is whether they are using any cloud infrastructure, any CI/CD pipeline tooling with telemetry, any error-monitoring service, or any outsourced QA or penetration-testing vendor. Nearly every modern software delivery setup has at least two or three subprocessors in the chain even on a lean project. A team that says it has zero is either unaware of its own stack or is not being precise with the term.
What Must a GDPR-Compliant Vendor Actually Disclose?
Building on the definition above, the disclosure obligation is specific and procedural, not a general promise of transparency. Under Article 28(2), a processor cannot engage a new subprocessor without the controller's prior written authorization, and the processor must inform the controller of any intended changes concerning the addition or replacement of subprocessors. Article 28(4) then requires that the same data protection obligations the processor accepted in its own Data Processing Agreement (DPA) with you be imposed, in writing, on every subprocessor down the chain.
What this means in practice for a buyer evaluating a Vietnam software team:
A subprocessor list, not a statement of intent. You should be able to see the vendor's name, what it does (hosting, logging, analytics, backup), and what category of data it touches.
A notification mechanism with a defined window. GDPR-compliant DPAs typically give the controller 15 to 30 days' advance notice before a new subprocessor goes live, delivered by email or a trust-center style update, with the right to object.
Flow-down contract language. The subprocessor's own contract with the processor should mirror the data protection terms in your DPA, not a generic NDA.
GDPR does not require the vendor to notify your end users directly about subprocessors. That transparency obligation toward data subjects sits with you, the controller, under Articles 13 and 14. Your processor's job is to keep you informed so you can meet that obligation, not to run it on your behalf.
How Does Vietnam's Own Data Protection Law Interact With GDPR Here?
A related but distinct question is what happens when the processor itself sits inside a second legal framework. A Vietnam-based engineering team is not just answering to GDPR when it serves EU clients; it also operates under Vietnam's domestic data protection regime. Vietnam's Personal Data Protection Law and Decree 356/2025/ND-CP require data processors to obtain the controller's consent before subcontracting personal data processing, and to impose equivalent obligations on any subprocessor they bring in. That is structurally the same mechanism as GDPR Article 28, consent before subcontracting, flow-down obligations after, even though the two laws come from different legislatures.
A Vietnam processor handling EU personal data must satisfy both regimes at once: a data transfer impact assessment addressing the legality and risk of moving data out of Vietnam, alongside the GDPR-standard subprocessor authorization trail. A separate but related compliance step some multinational-facing engagements require is a Data Protection Impact Assessment, submitted within a defined window of initial processing and kept current as processing activities change. If your vendor's legal or compliance team cannot speak to both frameworks fluently, that is a gap worth probing before contract signature, not after an incident.
How Does This Compare to CCPA, and Why Should a European Buyer Care?
The CCPA takes a parallel but not identical approach to GDPR: it requires service providers to notify the business of any sub-service providers and to bind those sub-service providers to the same written contract requirements the service provider accepted. The mechanism is nearly identical to GDPR's Article 28(4) flow-down requirement, consent or notice, then matching contractual terms. This pattern is becoming the baseline expectation across major privacy regimes, and a vendor that has only built the process for one jurisdiction is likely to be weaker on the others.
What Should Be in the Contract Before You Sign?
Your DPA with your Vietnam-based processor should specify concrete terms in writing, not verbal assurances in a sales call. At minimum, it should include:
Contract element | What to check for
|
|---|---|
Current subprocessor list | Named vendors, processing purpose, data location |
Notification window | 15-30 day advance notice before a new subprocessor is added |
Objection right | A defined process for you to object to a proposed subprocessor |
Flow-down clause | Confirmation that subprocessor contracts mirror your DPA terms |
Audit rights | Your ability to request evidence of subprocessor controls |
ISO 27001, under its Annex A supplier relationship controls, explicitly requires an organization to document, assess, and manage its subprocessors as part of the audit. A vendor aligned with ISO 27001:2022 should be able to produce the actual supplier-risk register the certification requires, not just cite the standard's name.
Frequently Asked Questions
Does GDPR require my vendor to tell my end users about subprocessors?
No. GDPR places that transparency obligation on the controller under Articles 13 and 14, not on the processor.
How much notice should I get before a new subprocessor is added?
There is no fixed statutory number, but 15 to 30 days is the common window built into GDPR-aligned DPAs, giving you time to review or object.
Is a cloud hosting provider automatically a subprocessor?
Usually yes, if it is handling data on the processor's instructions as part of delivering the service to you. If it processes data independently for its own regulatory purposes, as some payment processors do, it may instead be an independent controller.
Can I refuse a new subprocessor my vendor wants to add?
Under Article 28(2), the processor needs your written authorization before engaging a new subprocessor, which means you have a contractual basis to object.
Does working with a Vietnam-based team add a second layer of compliance?
Yes. Vietnam's PDPL and Decree 356/2025/ND-CP impose their own consent-before-subcontracting requirement on Vietnam-based processors, in addition to any GDPR obligations tied to the data itself.
Is ISO 27001 enough to prove subprocessor management is in place?
The certification's Annex A controls require a supplier-relationship process to exist, but ask to see the actual subprocessor register and risk assessment documentation to verify the controls are in place.
About 724SOFTWARE
724SOFTWARE is a Vietnam-based technology partner delivering dedicated teams, offshore development centers, and embedded staff augmentation for clients in Fintech, Digital Healthcare, and SaaS across 10+ countries. The company's delivery organization is aligned with ISO 9001 and ISO 27001:2022 standards and operates under GDPR compliance commitments when handling data on behalf of EU-facing clients, including documented subprocessor management as part of its own vendor governance. With 200+ engineers, 58% at senior level, and a follow-the-sun support model with sub-10-minute incident response, 724SOFTWARE works as a long-term partner on regulated, data-sensitive builds rather than as a one-off project vendor.
If your team is evaluating an offshore partner for a GDPR-sensitive build, ask for the subprocessor list and the DPA language before the kickoff call, not after. Get in touch with 724SOFTWARE at https://724software.com.vn to see how the documentation is structured.
