Article · June 17, 2026
Segment, RudderStack and CDPs under the PDPL: What to do?
Segment, RudderStack and CDPs under PDPL: data collection, consent, purpose control, and reducing tracker risk.
Quick answer
What are Segment, CDP (customer data platform), and the PDPL?
This question often comes up when a business wants to use Segment, RudderStack or a CDP to unify customer data from multiple sources. For practical compliance, the important point is not the tool’s name but the data flows: what you collect, from where, for which purposes, who you share it with, and how long you retain it.
With a CDP model, data typically flows from sign-up forms, web/app events, CRM, call center, email marketing, advertising, and support systems. Each source may bring its own obligations under the regulations, especially if you use trackers to measure behavior, personalize, or sync to third parties.
Do Segment, RudderStack and CDPs require consent?
Yes. In many cases you must design an appropriate consent mechanism under the regulations, especially when collecting data for advertising, behavioral analytics, personalization, or sharing to other systems. Do not assume “a cookie banner is enough,” because consent for cookies, for marketing email, and for data sharing can be separate layers.
Real-world example: an e-commerce marketplace uses Segment to send “view_product,” “add_to_cart,” and “purchase” events to analytics, ads, and CRM. If this flow fires before the user consents, the business may have to explain why it collected and forwarded data without an appropriate legal basis.
What PDPL obligations can a CDP create?
Below is a practical view for SMEs and dev teams:
| Scenario | Obligations to prepare | Practical notes |
|---|---|---|
| Installing trackers on web/app | Provide clear notice of purposes, data types, recipients | A cookie banner is only one part |
| Syncing events to ads/CRM | Manage consent per purpose | Separate analytics, marketing, personalization |
| Merging email, phone number, device ID | Minimize data, limit internal access | Set access controls and keep access logs |
| Sending data to foreign providers | Check cross-border transfer basis and documentation | Review carefully before enabling default sync |
| Users request deletion/rectification/export | Have a DSAR process and internal SLA | CDP must support traceability, deletion, export |
How to design Segment/CDP for easier PDPL compliance?
Use a layered implementation instead of “turn everything on and sort it out later.” The goal is to control data from the frontend, through the pipeline, to destination systems.
Classify purposes before installing trackers:
Specify which events serve operations, analytics, personalization, or marketing. Do not lump all consents into one.
Block non-essential flows by default:
Only enable SDKs/forwarding after the appropriate consent, or send only the minimum data needed for operations.
Separate consent by channel and purpose:
Cookies, email marketing, SMS, push, and sharing to ads should have their own statuses to make proof easier.
Store proof of consent:
Save timestamp, notice version, source of collection, opt-in/opt-out status, and changes over time.
Set up deletion and anonymization:
When a user withdraws consent or requests deletion, the CDP must propagate the action to downstream systems.
Review vendors and data flows:
Check who receives the data, where it goes, whether it is transferred overseas, and who is responsible.
How should RudderStack, Segment and a CDP manage purposes?
Treat “purpose” as the primary control unit. An event may be valid for order operations but not automatically valid for retargeting. So instead of only asking “where should this event be sent,” ask “for which purposes is this event permitted.”
Practical approach:
- Attach metadata to each event: purpose, lawful basis/internal approval, retention.
- Use consent state to decide routing.
- Separate namespaces for analytics and marketing.
- Apply suppression lists for people who have opted out of marketing.
- Have a kill switch when misconfigured sends are detected.
If you use a CDP to consolidate customer profiles, remember: the more touchpoints, the easier it is to drift from the intended purpose. Establish clear ownership across legal, marketing, product, and engineering.
What should we do if a data leak from the CDP occurs?
If you detect a security incident involving personal data, activate your incident response procedure immediately. Under the regulations, a data breach notification must be made within 72 hours of discovery. At the same time, revoke tokens, rotate API keys, stop syncs, determine the impact scope, and preserve logs for investigation.
The enforcement authority is the Ministry of Public Security — Department of Cybersecurity and High-Tech Crime Prevention (A05). Specific penalties will be provided by the Government’s guiding decree; serious violations may be subject to criminal liability.
When should you seek a lawyer or a PDPL review?
Seek advice when you:
- Use trackers/CDPs for large-scale personalization or retargeting.
- Sync data to platforms located overseas.
- Merge multiple identifiers such as email, phone number, device ID, loyalty ID.
- Are unsure whether your current cookie banner, consent forms, and policies are sufficient.
- Want to build DSAR, retention, and deletion workflows for your product.
For SMEs, the safest path is to design consent and logging directly into the product instead of writing policies first and “fitting them in” later. consent.vn can help standardize your cookie banner, store proof of consent, and set up DSAR flows so the dev team can implement faster.
- They may, depending on the data type and processing purposes. If used for analytics, marketing, personalization, or sharing with third parties, you should have a consent mechanism and clear notices in line with the rules.
- Yes. You still need to define the purpose, provide transparent notice, check data recipients, and design appropriate blocking/enabling before collection.
- It can if the system is designed correctly. However, you must propagate deletion/anonymization to downstream systems and keep logs to prove it was processed.
- You may need to assess cross-border transfers, storage, and contracts with the provider. Check carefully against the regulations and consult a lawyer if data flows are complex.
Source: the Personal Data Protection Law (Law 91/2025/QH15): https://thuvienphapluat.vn; Decree 13/2023/ND-CP: https://thuvienphapluat.vn; Ministry of Public Security (A05): https://bocongan.gov.vn
Get started — no account needed.
Ready to comply with PDPL?