What is a data processing agreement in Vietnam? Mandatory DPA clauses under the PDPL

What is a data processing agreement in Vietnam and why is it mandatory?

A data processing agreement (DPA) is a key legal tool that helps businesses control the risks arising from their technology supply chain. In today's digital economy, most businesses do not carry out every stage of information processing themselves but rely on a chain of outsourced service providers: from cloud computing platforms (AWS, Microsoft Azure, Google Cloud), customer relationship management software (Salesforce, HubSpot) and time-keeping and payroll software, to logistics and delivery partners (3PL) and online advertising companies. In all of these transactions, a huge volume of customer and employee information is transferred to external service providers.

To establish a legal framework that prevents the loss and misuse of personal data, the Personal Data Protection Law No. 91/2025/QH15 has formally codified the concept of, and the obligation to put in place, a Data Processing Agreement (DPA) through Clause 8, Article 2 and Article 37. The DPA is a foundational legal document that binds the parties' responsibilities and is the most important evidence of compliance when the specialised personal data protection authority (the A05 Department, Ministry of Public Security) carries out an inspection.

1. Allocating legal roles between the controller and the processor

To draft an accurate DPA, the parties must first correctly identify their legal status under Article 2 of Law 91/2025/QH15:

• Controller (Data Controller - Clause 7, Article 2): An agency, organisation or individual that decides the purposes and means of processing personal data. Example: a retailer collecting buyer information to complete transactions is the controller. The controller is responsible before the law for the lawfulness of obtaining consent and for protecting data subject rights.
• Processor (Data Processor - Clause 8, Article 2): An agency, organisation or individual that processes personal data at the request of the controller or the controller-processor under a contract. Examples: a SaaS software company hosting a customer database, a payroll services company or a freight delivery provider.
• A conditional mandate: The processor does not own the data and may not, on its own initiative, exploit the data for any purpose outside the scope of the controller's instructions.

2. Eight core clause groups for a data processing agreement in Vietnam

Under Article 37 of Law 91/2025/QH15, a data processing agreement or contract must clearly state the responsibilities, rights and obligations of the parties in processing personal data (Point a, Clause 1), and the processor may only receive and process data within the scope of that agreement (Clause 2). To give effect to this requirement, with reference to international practice (Article 28 GDPR), businesses should standardise the following 8 groups of clauses (clauses marked * are direct requirements of Law 91/2025):

1. Scope, nature and purpose of processing*: List in detail the permitted processing activities (collection, recording, storage, extraction, analysis), the categories of data subjects (customers, app users, employees) and the data fields (basic or sensitive).
2. Obligation to process in accordance with the agreement or contract*: The processor undertakes to process personal data only in accordance with the agreement or contract signed with the controller, unless the law mandatorily provides otherwise.
3. Technical and organisational security measures*: An undertaking to fully implement personal data protection measures under Law 91 and related legislation, including encryption of data in transit and at rest, multi-factor authentication (MFA), role-based access control (RBAC) and system audit logs.
4. Sub-processor clause — recommended: The processor may not, on its own initiative, transfer data or engage sub-contractors (for example, engaging another server infrastructure provider) without the controller's prior written approval; the main processor is responsible for the conduct of its sub-contractors as agreed.
5. Obligation to assist with data subject rights: When an individual submits a request to look up, correct, withdraw consent or delete data under Article 4 and the corresponding provisions of Law 91, the processor is responsible for providing technical tools and coordinating with the controller within the statutory time limit.
6. Data breach response procedure: The controller has an obligation to give a violation notice under Article 23 of Law 91 (72-hour time limit for violations covered by Clause 1, Article 23). The parties should clearly agree on the time limit within which the processor must notify the controller of an incident (common practice: 24–48 hours), so that the procedure with the A05 Department can be completed in time.
7. Audit rights — recommended: The controller has the right, periodically, to inspect the processor's IT infrastructure and operating procedures itself or to authorise an independent audit firm to do so.
8. Handling of data on termination: When the service agreement ends, the processor returns all personal data to the controller or securely and permanently destroys it. The transfer agreement must state the processing period and the requirements for deleting or destroying the data once the purpose is fulfilled (Point c, Clause 1, Article 7 of Decree 356/2025/ND-CP); a processor that fails to delete or return all the data after the contract ends faces a fine of VND 30–50 million (Point c, Clause 2, Article 51 of Decree 330/2026/ND-CP). A data destruction certificate is recommended practice.

3. A 4-step process for negotiating and issuing DPAs

Rolling out DPAs with dozens or even hundreds of service providers requires a structured process and cross-departmental coordination:

Step 1: Build a vendor inventory and carry out a vendor risk assessment

Procurement and IT work together to inventory all existing service contracts. Classify vendors into 3 levels of data risk:

• High risk: Providers storing sensitive personal data, CRM/HRM system providers, server data centres and online payment providers.
• Medium risk: Marketing agencies with access to customer email lists and phone numbers; express courier and postal companies.
• Low risk: Office supply vendors and facility maintenance providers with no access to IT systems.

Step 2: Standardise a DPA template (Standard DPA Template)

Businesses should proactively develop their own standardised Personal Data Processing Agreement Appendix template based on the provisions of Law 91/2025/QH15. This template will be attached by default to every future technology services procurement contract or outsourcing contract.

Step 3: Negotiate the commonly disputed clauses

When negotiating DPAs with large partners, especially international technology groups, disagreements typically arise over 3 clauses:

• Liability caps: The processor usually wants to cap compensation at the total value of the service contract over 12 months. The business should firmly insist on excluding the cap for violations of personal data protection law and for data leaks caused by the processor's intentional fault or gross negligence.
• Right to transfer data across borders: If the service provider stores data on servers located abroad (Singapore, the United States, Japan), the DPA should refer to, and the parties must comply with, the rules on cross-border data transfer under Article 20 of Law 91/2025/QH15.
• Deadline for deleting data after termination: Require the processor to complete deletion of all backup copies within a maximum of 30 days from the date the contract terminates.

Step 4: Store centrally and integrate into the DPIA dossier

All signed DPAs should be digitised and stored in the business's legal document repository. The DPA inventory should be compiled and kept together with the DPIA impact assessment dossier submitted to the A05 Department (Ministry of Public Security), because that dossier must describe the processing activities and the parties involved and must include copies of the data processing contracts and agreements (Point b, Clause 2, Article 19 of Decree 356/2025/ND-CP); it is also important evidence that the business's data processing supply chain is under control.

4. Sanction risks when a DPA is missing or implemented incorrectly under Decree 330/2026/ND-CP

Decree 330/2026/ND-CP has no penalty provision specifically named 'violation of a data processing agreement'; however, violations arising in the relationship between the controller and the processor will be penalised under the corresponding provisions, for example:

• Processing data without consent or outside the scope of the permitted legal basis: Article 43 (fine of VND 30–50 million for organisations, VND 50–70 million for treating silence as consent or intentionally continuing processing after a request to stop); where one of the cases not requiring consent under Article 19 of Law 91/2025 is relied on but no oversight mechanism or safeguards are put in place, or the permitted purpose or scope is exceeded: Article 47 (VND 10–50 million depending on the conduct).
• Violating the rules on transferring or providing data to third parties (including uncontrolled chains of sub-contractors): Article 52, range of VND 20–80 million.
• Failing to perform, or incorrectly performing, the obligation to notify data incidents: Article 54, range of VND 10–80 million.
• Missing impact assessment dossier, or a dossier that does not accurately reflect actual processing: Article 55, fine of VND 20–30 million; intentionally falsifying figures or providing false information in the dossier: VND 50–100 million.

In addition to administrative penalties, the controller is also responsible to data subjects for damage caused by the processing under Point g, Clause 1, Article 37 of Law 91/2025; the processor is responsible to the controller for damage caused by the processing (Point d, Clause 2, Article 37), but without a robust DPA the business will find it harder to prove the scope of the processor's obligations and the amount to be reimbursed when making a claim. For details of the penalty ranges, see the handbook entry Penalties for personal data protection violations.