Rights and Obligation of Personal data processing party

In personal data processing activities, Personal data processing party plays an important role in carrying out technical and operational tasks under the direction of the Personal data Controlling party. Under the 2025 Law on Personal Data Protection, specific and detailed provisions have been established regarding the responsibilities that the Data Processing party must comply with. Although the Data Processing party does not determine the purposes of processing, it bears direct responsibility for implementing technical and organizational measures to protect the entrusted data

Accordingly, what rights and obligations must the Personal Data Processing party fully understand in order to ensure strict compliance with the law? This article, VDPC, will provide an in-depth analysis and clarification of these issues in accordance with the provisions of the current law.

Legal Basis:

Article 2, 18, 19, 37 Law on Personal data protection 2025
Article 14 Draft Decree detailing the implementation of a number of provisions of the Law Personal Data Protection.

1. Who is the Personal data processing party?

Under the provisions of the 2025 Law Personal Data Protection, Personal data processing party is defined as an agency, organization, or individual processing personal data as requested by the personal data processing party or personal data processing and controlling party under a contract..

2. Rights of Personal data processing party

Currently, the 2025 Law Personal Data Protection does not provide specific provisions on the rights of the Personal Data Processing party. However, the rights of the Personal Data Processing party may be understood as follows

(1) The Personal Data Processing party has the right to carry out personal data processing, which refers to activities that affect personal data, including one or more operations such as collecting, analyzing, aggregating, encrypting, decrypting, editing, deleting, destroying, anonymizing, providing, disclosing, transferring personal data, and other activities that impact personal data.”

Other activities in personal data processing are defined as activities such as storing, accessing, retrieving, connecting, coordinating, verifying, authenticating personal data, and other activities that affect personal data.

(2) The Personal Data Processing party may also process personal data without the personal data subject matter’s consent in the following cases:

To protect the life, health, honor, dignity, and legitimate rights and benefits of the personal data subject matter or others in urgent cases; or to protect one’s own or others’ legitimate rights or benefits, or benefits of the State or agencies/organizations in a necessary manner against infringement on such rights or benefits.
To respond to emergencies or threats to national security that have yet to escalate to the level of a declared emergency; to prevent and combat riots, terrorism, crimes, and law violations.
To serve the operations of state agencies and the state management according to the law.
To carry out the agreement between the personal data subject matter and a relevant agency, organization, or individual according to the law.
Other cases according to the law.

(3) Additionally, although it has not yet been officially promulgated, reference may also be made to the Draft Decree detailing the implementation of a number of provisions of the Law Personal Data Protection. This draft makes reference to the duties of personal data protection officers and personal data protection units within agencies and organizations.

3. Obligations of Personal Data processing party

Under the provisions of the 2025 Law on Personal Data Protection, the obligations of the Personal Data Processing party are reflected in the regulations on the responsibilities of the Personal Data Processing party, including:

Only receive personal data after concluding an agreement or contract on personal data processing with the personal data controlling party or personal data processing and controlling party
Process personal data in compliance with the agreement or contract concluded with the personal data controlling party
Adequately adopt measures to protect personal data in compliance with this Law and other relevant laws
Assume responsibility before the personal data controlling party or personal data processing and controlling party for any damage arising from personal data processing
Prevent unauthorized collection of personal data from its system, equipment, and service
Cooperate with the Ministry of Public Security of Vietnam and competent state authorities in protecting personal data, providing information serving the investigation, and handling violations against personal data protection laws
Implement other responsibilities pursuant to regulations.

CONCLUSION

By proactively developing and implementing compliance policies, the Personal Data Processing party not only helps minimize legal risks but also enhances trust from the Data Controlling party and strengthens its competitive position in the digital services market.

The above outlines the Rights and Obligations of Personal data processing party. Should you have any further questions regarding this matter, please contact VDPC for accurate consultation and support.

Sincerely!

Zalo: 098.159.5243

The above is a summary and analysis of legal regulations based on the Advisor’s perspective for reference purposes only. This content does not apply to any specific real-world case, and VDPC shall not be held liable for any application by readers based on the aforementioned information without obtaining professional consultation from experts. Readers are kindly requested to contact us for precise advice tailored to your specific case of interest. Sincerely!

See more: