Allocation of Legal Responsibilities Between Personal Data Controllers and Personal Data Processors
Outsourcing personal data processing services does not relieve a business of its legal compliance obligations. Accordingly, correctly identifying the roles of the parties and allocating their respective responsibilities under the Law on Personal Data Protection 2025, particularly through a Personal Data Processing Agreement (DPA), is essential to mitigating legal risks. Let us explore with CBI the key considerations for businesses.
Illustrative image
1. Legal Basis for the Roles of Parties Involved in Personal Data Processing
The current legal instruments governing the responsibilities of parties involved in personal data processing include:
– Law on Personal Data Protection No. 91/2025/QH15, effective from 1 January 2026;
– Decree No. 356/2025/ND-CP dated 31 December 2025 of the Government detailing certain provisions of and providing measures for the implementation of the Law on Personal Data Protection, effective from 1 January 2026;
– Decree No. 392/2026/ND-CP dated 20 October 2026 of the Government amending and supplementing certain provisions of Decree No. 356/2025/ND-CP, effective from 15 November 2026;
– Decree No. 330/2026/ND-CP dated 19 August 2026 of the Government prescribing administrative penalties for violations in the fields of cybersecurity and personal data protection, effective from 19 August 2026.
Pursuant to Clauses 7, 8 and 9, Article 2 of the Law on Personal Data Protection 2025, the relevant parties are distinguished as follows:
(i) Personal Data Controller (Data Controller): An agency, organisation or individual that determines the purposes and means of personal data processing.
(ii) Personal Data Processor (Data Processor): An agency, organisation or individual that processes personal data at the request of a Personal Data Controller or a Personal Data Controller and Processor pursuant to a contract.
(iii) Personal Data Controller and Processor (Data Controller and Processor): An agency, organisation or individual that determines the purposes and means of personal data processing and directly carries out such processing.
Accordingly, the key criterion for determining an organisation’s legal role is not merely whether it directly accesses or stores personal data, but rather who determines the purposes and means of processing and who carries out the processing at the request of another party.
In practice, a business may assume different roles across different personal data processing activities. Therefore, its role should be determined based on each specific processing activity and data flow, rather than solely on the title of the contract or the type of service provided.
2. Allocation of Legal Responsibilities Between Personal Data Controllers and Personal Data Processors
2.1. Responsibilities of a Personal Data Controller
A Personal Data Controller is the party that determines the purposes and means of personal data processing. In ordinary business operations, a business that collects personal data of its customers, employees or business partners and determines how such data is used for its own business purposes may be classified as a Personal Data Controller.
Pursuant to Clause 1, Article 37 of the Law on Personal Data Protection 2025, a Personal Data Controller has the following principal responsibilities:
– Clearly specifying the responsibilities, rights and obligations of the parties in agreements and contracts relating to personal data processing, in accordance with this Law and other relevant laws and regulations;
– Determining the purposes and means of personal data processing in documents and agreements with data subjects, ensuring compliance with the principles and requirements prescribed by personal data protection laws;
– Implementing appropriate organisational and technical measures to protect personal data in accordance with the law, and reviewing and updating such measures where necessary;
– Notifying violations of personal data protection regulations in accordance with Article 23 of the Law on Personal Data Protection;
– Selecting an appropriate Personal Data Processor to process personal data;
– Ensuring the exercise of data subjects’ rights as prescribed in Article 4 of the Law on Personal Data Protection;
– Being liable to data subjects for damages arising from the personal data processing activities;
– Preventing unauthorised personal data collection through its systems, equipment and services;
– Cooperating with the Ministry of Public Security and competent state authorities in personal data protection, and providing information for the investigation and handling of violations of personal data protection laws; and
– Fulfilling other responsibilities prescribed by personal data protection laws and other relevant laws and regulations.
Notably, outsourcing personal data processing activities to an external service provider does not automatically exempt a business from its responsibilities towards data subjects. The Personal Data Controller remains responsible for ensuring that processing activities are conducted for legitimate purposes, on an appropriate legal basis and with corresponding data protection measures in place.
2.2. Responsibilities of a Personal Data Processor
Unlike a Personal Data Controller, a Personal Data Processor carries out personal data processing activities at the request of a Personal Data Controller or a Personal Data Controller and Processor pursuant to a contract.
Common examples may include:
– Providers of Human Resource Management (HRM) or Customer Relationship Management (CRM) software that process data at the business’s request;
– Cloud computing service providers that store personal data;
– Outsourced payroll service providers or human resource data management providers;
– Information technology service providers that are authorised to access and process personal data within the scope assigned by the business.
It should be noted that the above examples do not mean that all providers within these service categories automatically qualify as Personal Data Processors. Their legal roles must be determined based on their actual processing activities. Where a service provider independently determines the purposes of processing personal data for its own activities, it may be required to assume the responsibilities of an independent data processing entity in accordance with applicable laws.
Pursuant to Clause 2, Article 37 of the Law on Personal Data Protection 2025, a Personal Data Processor has the following principal responsibilities:
– Only receiving personal data after entering into a personal data processing agreement or contract with the Personal Data Controller or the Personal Data Controller and Processor;
– Processing personal data strictly in accordance with the agreement or contract entered into with the Personal Data Controller or the Personal Data Controller and Processor;
– Fully implementing personal data protection measures as prescribed by this Law and other relevant laws and regulations;
– Being liable to the Personal Data Controller or the Personal Data Controller and Processor for damages arising from the personal data processing activities;
– Preventing unauthorised personal data collection through its systems, equipment and services;
– Cooperating with the Ministry of Public Security and competent state authorities in personal data protection, and providing information for the investigation and handling of violations of personal data protection laws; and
– Fulfilling other responsibilities prescribed by personal data protection laws and other relevant laws and regulations.
Accordingly, a Personal Data Processor is not merely required to follow the instructions of the Personal Data Controller but must also proactively ensure data security within the scope of its own systems and processing activities. Contractual compliance does not replace the obligation to directly comply with applicable personal data protection laws.
2.3. Where a Business Acts as Both a Personal Data Controller and Processor
In addition to the two roles mentioned above, the Law on Personal Data Protection 2025 also recognises the role of a Personal Data Controller and Processor, being an entity that both determines the purposes and means of processing and directly carries out personal data processing activities.
Pursuant to Clause 3, Article 37 of the Law on Personal Data Protection 2025, such an entity is required to fully discharge both the responsibilities of a Personal Data Controller and those of a Personal Data Processor.
For example, a business that directly collects customer information, determines the purposes of using such data to provide its services, and independently operates its own data storage and management systems may be classified as a Personal Data Controller and Processor in respect of the relevant processing activities.
Correctly identifying this role is important in determining the applicable compliance obligations, particularly in relation to Personal Data Processing Impact Assessment dossiers and procedures for ensuring data subjects’ rights.
3. Legal Risks Arising from Failure to Clearly Allocate Responsibilities in Personal Data Processing Agreements
In practice, many businesses enter into information technology service agreements, software service agreements or outsourcing agreements containing general confidentiality clauses but failing to adequately specify the parties’ respective responsibilities regarding personal data.
The absence of a clear mechanism for allocating responsibilities may give rise to several notable legal risks:
First, the risk of processing personal data beyond the permitted scope.
Where an agreement fails to clearly specify the purposes, categories of personal data, scope of access and permitted processing activities, the Personal Data Processor may use personal data beyond the original instructions or carry out processing activities that have not been authorised by the Personal Data Controller. This may result in violations of personal data processing principles and give rise to legal liabilities for the relevant parties.
Second, the risk of personal data breaches or loss of personal data.
Where an agreement does not clearly establish procedures for incident notification, internal notification deadlines, investigation cooperation responsibilities and remediation obligations, the Personal Data Controller may be unable to fulfil its statutory notification obligations in a timely manner.
In particular, Article 23 of the Law on Personal Data Protection 2025 requires a Personal Data Processor, upon detecting a violation, to promptly notify the Personal Data Controller or the Personal Data Controller and Processor. Meanwhile, where a violation falls within the scope of incidents subject to mandatory notification under the law, the responsible entity must notify the specialised authority within the statutory timeframe.
Third, the risk of failing to adequately respond to data subjects’ requests to exercise their rights.
Requests from data subjects, such as withdrawing consent, restricting processing, correcting or deleting personal data, may require direct cooperation from the service provider responsible for storing or operating the relevant data systems. If the agreement does not specify the Personal Data Processor’s support obligations and response deadlines, the business may encounter difficulties in meeting the statutory deadlines for responding to data subjects’ requests under the Law on Personal Data Protection and Decree No. 356/2025/ND-CP.
Fourth, the risk of insufficient grounds for allocating liability and claiming compensation.
Where a Personal Data Processor causes personal data to be disclosed, lost or processed in breach of the agreed terms, the absence of specific contractual provisions on liability, remediation obligations and compensation mechanisms may lead to disputes between the parties regarding the cause, degree of fault and extent of damages.
Notably, Article 37 of the Law on Personal Data Protection 2025 establishes the Personal Data Controller’s liability to data subjects for damages arising from personal data processing, while also stipulating the Personal Data Processor’s liability to the Personal Data Controller or the Personal Data Controller and Processor for such damages. Therefore, businesses should not assume that merely allocating responsibility to the Personal Data Processor under a contract will fully exempt them from their own legal liabilities.
In addition to civil liability and remediation obligations, violations may also be subject to administrative penalties under Decree No. 330/2026/ND-CP. Depending on the nature and severity of the violation, businesses may face monetary fines, remedial measures and additional sanctions prescribed for specific violations.
4. CBI’s Recommendations: Strengthening DPAs and Personal Data Protection Compliance
To manage legal risks, businesses should establish or review Personal Data Processing Agreements (DPAs) with service providers involved in personal data processing activities. Pursuant to Article 37 of the Law on Personal Data Protection 2025, a Personal Data Processor may only receive personal data after entering into a personal data processing agreement or contract with the Personal Data Controller or the Personal Data Controller and Processor. In addition, Article 19 of Decree No. 356/2025/ND-CP stipulates that a copy of such agreement forms part of the dossier for Personal Data Processing Impact Assessment.
CBI recommends that businesses pay particular attention to the following matters when preparing DPAs and implementing compliance mechanisms:
– Identifying roles and processing scope: Clearly defining each party’s role, the categories of personal data, purposes, processing methods and processing periods.
– Controlling processing activities: Stipulating that the Personal Data Processor may only process personal data for the agreed purposes and in accordance with lawful instructions, while also controlling the engagement of sub-processors and transfers of data to third parties.
– Ensuring data security: Specifying appropriate security measures, such as encryption, access control and mechanisms for monitoring compliance.
– Coordinating responses to requests and incidents: Defining responsibilities, points of contact and coordination deadlines when responding to data subjects’ requests or personal data incidents.
– Allocating liability and addressing violations: Clearly agreeing on remediation obligations, compensation for damages and dispute resolution mechanisms between the parties.
– Handling personal data upon contract termination: Specifying procedures for returning, deleting or destroying personal data, as well as circumstances in which continued retention is permitted or required by law.
In addition, businesses should review all existing service agreements, outsourcing agreements and confidentiality agreements; map their data flows; complete Personal Data Processing Impact Assessment dossiers; establish incident response procedures; and periodically monitor the compliance of their service providers.
Combining robust contractual arrangements with appropriate internal governance mechanisms will help businesses clearly allocate responsibilities among the parties, maintain control over personal data processing activities and mitigate legal risks arising in practice.
5. CBI’s Personal Data Protection Compliance Advisory Services
Against the backdrop of the Law on Personal Data Protection 2025 and its implementing regulations imposing specific requirements on each party involved in personal data processing, businesses need to establish appropriate governance arrangements to ensure legal compliance while minimising risks arising from relationships with service providers and business partners.
Drawing on its experience in providing legal advice to businesses in the field of personal data protection, CBI offers a range of services, including:
– Reviewing and assessing personal data processing activities and identifying the legal roles and responsibilities of each relevant party;
– Advising on the development and completion of personal data protection policies, procedures and compliance documentation;
– Drafting, reviewing and negotiating Personal Data Processing Agreements (DPAs), confidentiality provisions and data protection clauses in agreements with business partners and service providers;
– Advising on the preparation and completion of Personal Data Processing Impact Assessment (DPIA) dossiers and Cross-Border Personal Data Transfer Impact Assessment (CTIA) dossiers;
– Advising on procedures for handling data subjects’ requests, responding to personal data incidents and coordinating with competent state authorities.
CBI aims to support businesses in establishing a systematic compliance framework that integrates legal requirements, internal governance and actual operational processes.
This article was prepared by Legal Specialist Nguyen Truc Vy and reviewed by Lawyer Vu Pham Thu Huong.
This article is intended for general legal information purposes only and does not constitute legal advice in respect of any specific matter. The legal provisions cited herein are effective as of the date of publication; however, they may have been amended, supplemented, replaced or become invalid by the time readers refer to them. Accordingly, we recommend that readers seek advice from a qualified lawyer before applying any of the information contained herein.
