Controller vs processor in Vietnam under Law 91/2025/QH15

Controller vs processor in Vietnam: what each role is and how to tell them apart

Telling controller vs processor in Vietnam apart is the first step of any PDPL compliance project: the controller and the processor are two key legal roles that must be clearly distinguished from the outset. A business can act as the controller (data controller) for its own customer and employee data while also being a processor (data processor) when it provides software services to other business customers.

When several departments and vendors are involved in processing, a business can use an outsourced DPO to help coordinate and monitor compliance. This support role does not by itself shift the controller's or the processor's responsibilities to the service provider.

The four roles defined in Article 2 of Law 91/2025

Law No. 91/2025/QH15 on Personal Data Protection defines the parties involved in processing in Clauses 7 to 10 of Article 2. The wording matters, because each role carries a different set of obligations under Article 37.

• Controller (Clause 7): an agency, organisation or individual that decides the purposes and means of processing personal data.
• Processor (Clause 8): an agency, organisation or individual that processes personal data at the request of the controller or the controller-processor through a contract. The contract is part of the definition, not an optional extra.
• Controller-processor (Clause 9): an agency, organisation or individual that decides the purposes and means and directly processes the personal data. Most businesses handling their own customer or employee data in-house fall into this category.
• Third party (Clause 10): an organisation or individual, other than the data subject, the controller, the controller-processor and the processor, that takes part in processing as provided by law.

How this differs from GDPR. GDPR only has controllers, processors and joint controllers (Article 26 GDPR). Law 91 names a separate "controller-processor" role, which under GDPR would simply be a controller, and it has no separate category for joint controllers. Where two companies decide the purposes together, each should be analysed as a controller or controller-processor, and the split of responsibilities should be written into their agreement (Point a, Clause 1, Article 37). Group policies drafted for GDPR therefore need a Vietnam-specific role mapping.

How to determine controller vs processor in Vietnam: a four-question test

The law gives the definitions but no step-by-step test. In our advisory work, we use four questions that follow the wording of Article 2 and draw on international practice. Record the answers for each vendor or group entity so that the classification can be explained if the A05 Department (Ministry of Public Security) asks.

1. Who decides why the data is processed? The party that sets the purpose, such as payroll, marketing or credit scoring, is the controller or controller-processor.
2. Who decides the essential means? This covers which data fields are collected, whose data, how long it is kept and who receives it. A vendor can choose technical details such as its hardware or software stack and still be a processor, but not these essential elements.
3. Does the vendor use the data for any purpose of its own? Contract terms that allow "service improvement", benchmarking, advertising or AI model training on client data usually make the vendor a controller for that use. That use then needs its own legal basis, such as the data subject's consent.
4. Is there a contract to process on the other party's behalf? Under Clause 8, Article 2, processor status rests on a contract. Without a DPA, the vendor may not receive the data at all (Point a, Clause 2, Article 37).

Sector-specific examples are covered in our guides for banks and payment companies, insurers and manufacturers with large workforces.

Controller obligations under Clause 1, Article 37

Once a business knows it is a controller, Clause 1, Article 37 of Law 91/2025 sets out what it must do:

• State the responsibilities, rights and obligations of the parties in agreements and contracts related to processing (Point a).
• Decide the purposes and means of processing in documents and agreements with the data subject, in line with the principles of the Law (Point b).
• Apply appropriate management and technical measures, and review and update them when necessary (Point c).
• Notify violations under Article 23, including the 72-hour notification where it applies (Point d).
• Select a suitable processor (Point dd).
• Ensure the data subject's rights under Article 4 (Point e).
• Be responsible to the data subject for damage caused by the processing (Point g).
• Prevent unlawful collection of personal data from its own systems, equipment and services (Point h).
• Cooperate with the Ministry of Public Security and competent authorities, and provide information for investigations (Point i).

Processor obligations under Clause 2, Article 37

The processor's duties are narrower but strict:

• Receive personal data only after an agreement or contract on processing is in place (Point a).
• Process the data strictly in line with that agreement or contract (Point b).
• Fully implement the data protection measures required by law (Point c).
• Be responsible to the controller for damage caused by the processing (Point d).
• Prevent unlawful collection of personal data from its own systems (Point dd) and cooperate with the authorities (Point e).

Two other provisions apply to processors specifically. A processor that detects a violation must promptly notify the controller or controller-processor (Clause 1, Article 23). It must also prepare and keep a DPIA dossier as agreed with the controller (Clause 3, Article 21). A controller-processor must meet all the obligations in both Clause 1 and Clause 2 of Article 37 (Clause 3, Article 37). If the vendor provides one of the nine personal data processing services listed in Article 21 of Decree 356/2025/ND-CP, it also needs a certificate of eligibility from the Ministry of Public Security.

Liability and penalties: why controller vs processor in Vietnam matters

Getting the roles wrong has civil and administrative consequences. On the civil side, the controller answers to the data subject for damage, while the processor answers to the controller (Point g, Clause 1 and Point d, Clause 2, Article 37). Without a clear DPA, the controller will find it harder to recover what it has paid from a vendor at fault.

On the administrative side, Decree 330/2026/ND-CP contains provisions aimed at each role. Examples of fines for organisations:

• A processor or third party that fails to meet the deadline set by the controller for handling a data subject request: VND 20–30 million (Clause 2, Article 44).
• A processor that detects a violation but does not promptly notify the controller: VND 10–20 million (Clause 1, Article 54).
• A transfer of personal data for a fee that does not clearly identify the controller, processor or third party roles: VND 30–50 million (Clause 2, Article 52).
• A processor that does not delete or return all personal data to the controller when the processing contract ends: VND 30–50 million (Point c, Clause 2, Article 51).

For the full range of fines, see the handbook entry on data protection fines in Vietnam.

Checklist: getting controller vs processor in Vietnam right in practice

1. Record the role for each activity in your record of processing activities, because the same company can hold different roles for different data sets.
2. Apply the four-question test to each vendor and group entity, and keep a short written rationale.
3. Sign the DPA before any data is handed over, with clear limits on purpose, security measures, sub-processors and deletion at the end of the contract. See what a data processing agreement should contain.
4. Remove or limit "own use" clauses in vendor standard terms, or treat the vendor as a controller for that use and make sure a legal basis exists.
5. Check where the processor operates. A processor or group entity that stores or accesses the data from abroad triggers the cross-border rules in Article 20.
6. Align incident timelines so that the processor's notice reaches you early enough to meet the 72-hour deadline.
7. Review the classification whenever a service changes, for example when a vendor adds AI features or a new sub-processor.

The most common gaps we see in vendor contracts are standard terms that let the vendor reuse client data "to improve its services", group data flows with no intra-group agreement at all, and the assumption that the vendor will handle the DPIA filing on the client's behalf. Under Law 91, each of these leaves the controller exposed.