Article · June 17, 2026
ActiveCampaign marketing automation under the PDPL: what to do?
ActiveCampaign under the PDPL: site tracking, lead storage, consent and cross-border transfers. Practical checklist for Vietnamese businesses.
Quick answer
What is ActiveCampaign marketing automation under the PDPL?
This question is essentially: when you use ActiveCampaign for email automation, CRM, forms, site tracking, or lead scoring, what personal data is the system processing, for what purposes, and is any data going abroad? Under the PDPL, the focus is not on “which tool” but on how you collect, store, share, and evidence consent.
If your website embeds tracking scripts, pixels, forms, or syncs leads from landing pages into ActiveCampaign, the business needs to determine clearly: who is the data controller, what data is collected, when users are informed, and where evidence of consent is stored.
Do you need to obtain consent when using ActiveCampaign?
Yes. In many situations you need clear consent mechanisms under the rules, especially when you:
- collect leads via forms;
- track website behavior to score leads;
- send email marketing/SMS marketing;
- sync data from CRM, website, or app to ActiveCampaign;
- share data with third-party service providers.
In practice: not every processing operation requires the same level of consent, but for marketing automation you should design on the principle of “opt in first, evidence after.” If you are unsure how to apply this in each flow, have a lawyer review it under the rules.
List all data sources:
Record exactly where data enters ActiveCampaign: forms, chat widgets, cookies, file imports, API, webhooks, or e-commerce integrations.
Map each source to a processing purpose:
For example: “newsletter,” “lead nurturing,” “website behavior assessment,” “personalizing offers.” Each purpose should have its own basis and notice.
Design consent banners and forms:
Cookie banners should allow users to understand which tracking runs. Forms should separate the marketing checkbox from mandatory terms.
Store evidence of consent:
Keep timestamp, IP, consent content, collection source, policy version, and opt-in/opt-out status in the CRM.
Review sharing and transfers:
Check where ActiveCampaign stores/processes data, whether cross-border transfers occur, and what internal records you need to maintain under the rules.
Set up DSAR and deletion processes:
When users request access, correction, or deletion, marketing and engineering must know where to retrieve data and respond within an appropriate internal timeline.
Is storing leads in ActiveCampaign the processing of personal data?
Yes. When you store leads in ActiveCampaign, you are processing personal data if the lead is identifiable, for example: email, phone number, name, company, job title, email open behavior, link clicks, conversion source, purchase history.
For SMEs, a common risk is importing legacy customer lists into the CRM without re-checking the original purpose. A list “already on hand” does not automatically mean you can continue to use it for marketing automation. Standardize each data group by consent status and processing purpose.
What should you watch out for when using ActiveCampaign for site tracking?
Site tracking is often the easiest part to “slip through” because it runs in the background. If you install scripts to recognize visitors, tag them, track pages viewed, or trigger automations based on behavior, pay attention to three points:
- Advance notice: Users should know the website uses tracking/analytics/marketing automation.
- Clear purposes: Tracking for security, performance measurement, or remarketing are different purposes.
- On/off control: For tracking used for marketing, provide a suitable accept or reject mechanism.
Avoid generic statements like “we use cookies to improve your experience” if in reality the scripts are also used to personalize marketing or sync into the CRM. Internal documentation and the banner should match the actual configuration.
Does ActiveCampaign involve cross-border data transfers?
Possibly. If lead data, interaction history, mailing lists, behavioral logs, or metadata are sent to systems whose servers/providers are located overseas, treat this as a situation with cross-border data transfers under the rules.
For Vietnamese businesses, a safe approach is to:
- check the provider’s documentation on where data is stored/processed;
- identify which data actually leaves Vietnam;
- update the privacy notice and contracts with the provider;
- prepare internal records and a response process for requests from competent authorities.
If you are unsure where your ActiveCampaign instance processes data, ask the vendor directly and have counsel assess under the rules before expanding campaigns.
Practical checklist for Vietnamese businesses
Below is a short checklist for marketing + dev + legal:
| Hạng mục | Việc cần làm |
|---|---|
| Banner cookie | State marketing/CRM tracking clearly; do not lump it with strictly necessary cookies |
| Form lead | Separate the marketing checkbox; store timestamp and consent version |
| CRM sync | Log data source, purpose, uploader, and sync time |
| Automation | Review triggers based on website behavior, email opens, link clicks |
| Data export | Check whether data goes abroad |
| DSAR | Have a process to handle access/erasure/correction requests |
| Retention | Define the retention period for inactive leads |
How are violations handled?
Under the Personal Data Protection Law (Law 91/2025/QH15), expected to take effect from 01/01/2026 and replace Decree 13/2023/ND-CP, businesses may face administrative penalties under the Government’s guiding decree; serious violations may also entail criminal liability. When a data incident occurs, breach notification must be made within 72 hours of discovery.
With ActiveCampaign, incidents often result not from being “hacked,” but from misconfiguration: sending to the wrong list, activating automations for people who have not consented, or syncing data to third parties without controls.
- Yes. SMEs still must manage consent, processing purposes, store evidence of consent, and check cross-border data transfers if they use ActiveCampaign.
- If your website has tracking/site tracking or other marketing scripts, you should still have an appropriate banner and notice. For email marketing, also check the processing basis and consent status.
- Obligations may arise under the rules on cross-border data transfers. Check where data is processed and prepare internal records—ideally with legal advice.
- You need a DSAR process: verify identity, locate data in ActiveCampaign and related systems, then delete or restrict processing according to a valid request.
If you are setting up a cookie banner, consent evidence, or a DSAR process for ActiveCampaign, consent.vn can help standardize the flow so marketing and dev teams can implement with less risk.
Source: the Personal Data Protection Law (Law 91/2025/QH15), Decree 13/2023/ND-CP, Ministry of Public Security (A05) bocongan.gov.vn, thuvienphapluat.vn
Get started — no account needed.
Ready to comply with PDPL?