Rights and Obligation of Third party in the Processing of Personal Data

In the digital era, personal data is not only processed by Personal data controlling party or Personal data processing party, the processing of personal data also involves various other Third parties. The transfer, receipt, and processing of personal data by third party are essential activities, yet they entail significant legal and data security risks.

In this article, VDPC provides an in-depth analysis of the regulations governing the rights and obligations of third party in personal data processing activities, helping readers gain a clear understanding and mitigate related legal risks..

Legal basis:

• Article 2, 19 Law on Personal data protection 2025
• Article 39, 41 Decree No. 13/2023/ND-CP

1. Who is the Third party?

Pursuant to the Law Personal Data Protection 2025, a third party is defined as an organization or individual other than the personal data subject matter, personal data controlling party, personal data processing and controlling party, and personal data processing party participating in the personal data processing according to the law;

2. Rights of Third party in the Processing of Personal Data

(1) At present, the Law on Personal Data Protection 2025 does not expressly provide for the rights of third parties in relation to personal data processing. However, based on the definition of a third party such rights may be understood as the right to participate in personal data processing activities, Specifically, this includes the right to engage in activities such as the collection, analysis, summary, encryption, decryption, modification, deletion, destruction, de-identification, provision, disclosure, transfer of personal data, and other activities that have an impact on personal data.

(2) In addition, the Third party be processed without the personal data subject matter’s consent in the following cases:

• To protect the life, health, honor, dignity, and legitimate rights and benefits of the personal data subject matter or others in urgent cases; or to protect one’s own or others’ legitimate rights or benefits, or benefits of the State or agencies/organizations in a necessary manner against infringement on such rights or benefits. The third party shall prove the necessity of such processing
• To respond to emergencies or threats to national security that have yet to escalate to the level of a declared emergency; to prevent and combat riots, terrorism, crimes, and law violations
• To serve the operations of state agencies and the state management according to the law
• To carry out the agreement between the personal data subject matter and a relevant agency, organization, or individual 
• Other cases according to the law

3. Obligations of Third Parties in the Processing of Personal Data

The Law on Personal Data Protection 2025 has not yet provided specific provisions regarding the obligations of third parties in personal data processing activities. However, Decree No. 13/2023/NĐ-CP, which remains in effect, stipulates that Third party are responsible for fully complying with the provisions on personal data processing responsibilities as set out in this Decree.

Responsibilities related to personal data processing are reflected in the provisions governing the responsibilities of personal data processors, such as:

• Only receive personal data after concluding an agreement or contract on personal data processing with the personal data controlling party or personal data processing and controlling party.
• Process personal data in compliance with the agreement or contract concluded with the personal data controlling party.
• Adequately adopt measures to protect personal data in compliance with this Law and other relevant laws.
• Be responsible to the data subject for damage caused by the processing of personal data.
• Delete or return all personal data to the Personal Data Controller after completing the processing.
• Cooperate with the Ministry of Public Security of Vietnam and competent state authorities in protecting personal data, providing information serving the investigation, and handling violations against personal data protection laws.

CONCLUSION

In summary, the role of Third party in the personal data processing ecosystem is indispensable; however, this role is accompanied by very clear and stringent legal obligations under the provisions of the law.

The above outlines the Rights and Obligations of Third party. Should you have any further questions regarding this matter, please contact VDPC for accurate consultation and support.

Sincerely!

Zalo: 098.159.5243

The above is a summary and analysis of legal regulations based on the Advisor’s perspective for reference purposes only. This content does not apply to any specific real-world case, and VDPC shall not be held liable for any application by readers based on the aforementioned information without obtaining professional consultation from experts. Readers are kindly requested to contact us for precise advice tailored to your specific case of interest. Sincerely!

See more: