Guide · June 17, 2026
Do email-for-discount forms need marketing consent under the PDPL?
Guide to email-for-discount forms under the PDPL: no forced marketing consent, clear purposes, evidence logs, and DSAR.
Quick answer
What is a PDPL email-for-discount offer form?
A PDPL email-for-discount offer form collects an email/phone number in exchange for a coupon, discount code, ebook, or gift, but it must be transparent about the purposes of personal data processing. The key point is: users can receive the offer without being forced to agree to receive advertising later.
For SMEs selling online, this is very common: a pop-up “sign up to get -10%”, a landing page offering a discount code, or a webinar sign-up form that includes a voucher. These forms typically pull in personal data such as email, name, phone number, click behavior, and cookies. Under the Personal Data Protection Law (Law 91/2025/QH15), expected to take effect 01/01/2026, businesses must collect for the proper purpose, provide clear notice, and retain evidence of users’ choices.
Can you require users to consent to marketing to receive the offer?
You should not force users to consent to marketing as a mandatory condition to receive the offer. If the form has only one button “I agree to receive promotions and marketing emails,” it mixes two different things: receiving the offer and receiving marketing. Under the regulations, businesses should separate these choices.
A real-world example: a cosmetics shop runs Facebook ads with a landing page promising “VND 50,000 off your first order.” If the form requires ticking “agree to receive promotional emails and messages” to get the code, this creates risk because users do not have a genuine choice. A safer approach is to let users download the code after entering their email, while marketing is a separate checkbox that is not pre-selected.
How should you design the form to be transparent?
Design the form based on separating purposes, being easy to understand, and being able to prove consent across layers of information. This is especially important if you use CRM, email automation, CDP, ad pixels, or conversion trackers.
Separate the 2 purposes:
One purpose is to send the offer/discount code; another purpose is to send marketing later. Do not merge them into a vague sentence.
Use separate checkboxes:
For example: “I want to receive the discount code” and “I agree to receive promotional emails later.” The marketing checkbox must not be pre-selected.
Show a short notice right on the form:
State what you collect, for what purposes, how long you store it, and any sharing with third parties if applicable.
Log evidence of consent:
Record timestamps, notice text, form version, IP/device, and each checkbox choice to support internal audits or disputes.
Allow easy withdrawal:
Every marketing email should include an unsubscribe link; if using Zalo/SMS, provide an opt-out mechanism per regulations.
Review cookies and trackers:
If the form includes pixels/analytics, check your cookie banner, classify tools, and avoid enabling marketing tracking before you have an appropriate legal basis.
How should you write a PDPL email-for-discount offer form?
You can use a short, easy-to-understand template like this:
Form title: Get 10% off your first order
Description: Enter your email to receive the discount code by email within 5 minutes. We will use your email to send the code and update your order if you place a purchase.
Checkbox 1: I agree to receive the discount code and information related to this offer.
Checkbox 2 (optional): I agree to receive promotional emails, new products, and marketing content from consent.vn/your company.
Policy link: See the Personal Data Processing Notice
Technical notes: The submit button should only enable when required fields are present; the marketing checkbox must be optional, not auto-checked; if using double opt-in, record the confirmation email as evidence.
What should businesses watch out for regarding cookies, pixels, and tracking?
If the offer form includes cookies, Meta Pixel, Google Ads tag, heatmaps, or conversion tools, the business incurs additional notice and governance obligations under personal data rules. You should not assume these tools are “illegal” by default; the issue is how you implement them and the legal basis for collecting, sharing, and tracking behavior.
For Vietnamese SMEs, a common mistake is pushing all trackers onto the landing page and having only one “consent” checkbox. This is both non-transparent and makes it hard to prove users understood what they agreed to. It is better to segment trackers for internal measurement, trackers for advertising, and third-party trackers; and reflect these clearly in your cookie banner and policy.
If a business is suspected of a data breach, the notification deadline is 72 hours from discovery. The enforcement authority is the Ministry of Public Security — Department of Cybersecurity and Hi-tech Crime Prevention (A05). Specific penalties will follow the Government’s guiding decree; serious violations may be subject to criminal liability.
Quick checklist for marketing and dev teams
- The form must include a clear purpose description.
- Do not lock the offer behind a requirement to consent to marketing.
- Marketing checkbox is separate and not pre-selected.
- Keep logs of consent evidence and content versions.
- Include an unsubscribe link/journey in emails.
- Review your cookie banner, pixels, CRM, and email systems.
- Prepare a process for handling access/deletion requests (DSAR).
- Not required if you only use the email to send the promised offer code. Marketing consent is a different purpose and should be separated under the regulations.
- Yes. You should clearly inform users of the collection purpose, how it is used, retention period, and how to contact you to delete or correct data.
- Not recommended. As a compliance best practice, the marketing checkbox should be an active, affirmative choice by the user, not pre-selected.
- You need to review the cookie banner, data processing policy, and store evidence of consent/appropriate settings. For complex cases, consult a lawyer.
If you are building lead forms for SMEs, consent.vn can help standardize the cookie banner, store consent evidence, and DSAR workflows so marketing/dev teams can deploy faster.
Source: the Personal Data Protection Law (Law 91/2025/QH15); Decree 13/2023/ND-CP — thuvienphapluat.vn; Enforcement authority — Ministry of Public Security (A05) — bocongan.gov.vn
Get started — set up in 5 minutes.
Need help with PDPL compliance?