Guide · June 17, 2026
Progressive profiling under the PDPL: what to watch out for
Guide to PDPL-compliant progressive profiling: transparent data buildup, purpose limits, evidence logging, and lower compliance risk.
Quick answer
What is progressive profiling for gradual data collection under the PDPL?
Progressive profiling is a technique where you ask for only part of the information the first time, then add more in subsequent interactions. Example: a webinar sign-up form only asks for email and company; next time it asks for team size, trial needs, budget. This approach fits SMEs well, but under the Personal Data Protection Law, “collecting gradually” does not mean “collect whenever you like.”
The core point is transparent accumulation of data: users must understand what pieces of data you are combining, from where, for what, and in which contexts that data will be used. If the first form says “receive materials” but later forms add questions to score leads, personalize ads, or share with partners, the purpose has changed and you need to reassess your obligations under the regulations.
Is progressive profiling compatible with the PDPL?
Yes, if you design it correctly from the start. The PDPL does not prohibit optimizing conversions or splitting forms; the law requires you to limit purposes, minimize data, and clearly inform the data subject.
Put simply: you may ask gradually, but not “ask gradually to dodge transparency.” Every field must have a specific business reason. For example:
- Email: to send materials and verify the account.
- Company/title: to segment B2B leads.
- Team size: to suggest a suitable product plan.
- Budget level: only collect if truly needed for advice/quoting.
If it’s not needed for the current purpose, don’t ask. This is the best way to reduce risk when doing progressive profiling.
| Scenario | Do it right | Pitfall to avoid | |
|---|---|---|---|
| First form collects email | State clearly it’s used to send materials and follow up | Vague catch-all “improve experience” | |
| Subsequent form asks for job title | Explain it’s to categorize B2B needs | Auto-merge data without updating the notice | |
| Subsequent form asks for budget | Only ask when used for quoting/advice | Ask “just because” | |
| Lead scoring | Inform about profiling/assessment as required | Use data for a new purpose without asking/notifying |
How do you make cumulative data across multiple forms transparent?
You should treat progressive profiling as a chain of notices, not as a standalone form. Each time the user moves one step further, they should see the missing pieces of the data picture.
Specifically, do four things:
Create a “data map” before building the form:
List each field, collection source, purpose, retention time, data recipients, and the consequences of not providing it.
Provide a short notice at the point of collection:
Under each form, briefly state “Used for…”, “Stored for…”, “We may contact via…”. Don’t bury it in a long, hard-to-read policy.
Attach context-based logic:
If the user downloaded a manufacturing ebook, the next form can ask plant size; if they registered for a demo, you can ask job role. Each question must fit the prior context.
Retain evidence of consent and the notice content:
Record the text version, timestamp, traffic source, checkbox status, IP/device if you need to prove it in a dispute.
Allow withdrawal or refusal at later steps:
If the user doesn’t want to answer more, still let them continue at a basic service level if compatible with your process.
Real-world example: a SaaS company in Vietnam runs 4 lead forms. Form 1 collects email to send a checklist. Form 2 asks for industry to categorize. Form 3 asks for user count to estimate the service plan. Form 4 asks about current systems to advise on integration. This question set is fine if, from form 1, you make it clear the business will collect additional information in subsequent interactions to provide more accurate advice.
How should purposes be limited when using progressive profiling?
Purpose limitation means data may only be used for the purpose you have notified. If you collect data to send materials, you cannot automatically use it for retargeting, creating lookalike audiences, or sharing with another vendor without assessing the corresponding legal obligations.
With progressive profiling, a common mistake is “one form, many goals”: marketing wants to nurture leads, sales wants to close deals, the data team wants to enrich the CRM, and product wants to research behavior. These goals cannot always be combined. When expanding purposes, you need to review the notice, the legal basis for processing, and related obligations under the regulations.
A practical rule: if a new question does not help accomplish the purpose previously stated, treat it as a new or expanded purpose. At that point, update your notice, consider a consent mechanism, and collect only what is truly necessary.
What should a progressive profiling form template include?
Below is a minimal framework you can apply to 4 lead forms:
- Form 1: Full name, email, company — purpose: send materials, confirm registration.
- Form 2: Title, industry — purpose: categorize needs.
- Form 3: Company size, number of users — purpose: advise a suitable plan.
- Form 4: Integration needs, implementation timeline — purpose: prioritize sales/demo.
Each form should include a short notice, for example:
“We collect the information you provide to send materials, contact you for advice, and personalize content to your needs. Some information may be collected gradually in subsequent interactions. Details about your rights and how we process data are set out in our data protection notice.”
If you have a cookie banner, align it with the form flow: the banner does not replace consent for the form, and the form should not silently pull in additional tracking without an appropriate mechanism. Consent.vn can help you standardize the cookie banner, store evidence of consent, and manage DSAR flows so you don’t have to patch multiple places by hand.
What PDPL risks come with progressive profiling?
The biggest risk is “silent data accumulation”: each form asks for a little, but when combined it creates a fairly deep profile of personal behavior and needs. In that case, the business must recheck the principles of data minimization, security, purpose limitation, and retention periods.
Some common mistakes:
- Not updating the notice when adding a new field.
- Using data from old forms for a new campaign without considering purpose.
- No record proving the user was informed.
- Keeping data too long in the CRM even when the lead has gone “cold.”
- Sharing lead data with an agency/vendor without controls.
If an incident results in a personal data breach, the business must respond immediately and notify of the data breach within 72 hours of detection as required.
- No. This approach can be appropriate if you clearly inform purposes, only collect what is necessary, and do not expand purposes arbitrarily.
- Only if the new question remains within the purpose previously notified. If the purpose changes or expands, you should update the notice and consider a consent mechanism as required.
- Possibly. When you combine data to categorize, score, or personalize, check transparency obligations, purpose limitation, and retain evidence of data processing.
- Control who accesses the data, align the notice content at each collection point, and have a process to delete/hide data when a lead no longer has a processing purpose.
In short, progressive profiling is a good tool to improve lead quality, but it is only safe when you manage purposes and notices as a single, unified chain. If you are designing 4 lead forms, review each data field, each descriptive line, and each evidence-logging step before going live. :::
Source: the Personal Data Protection Law (Law 91/2025/QH15), Decree 13/2023/ND-CP on thuvienphapluat.vn; enforcement authority Ministry of Public Security (A05) at bocongan.gov.vn.
Get started — set up in 5 minutes.
Need help with PDPL compliance?