Rights and Obligations of Personal data processing and controlling party

In the context of the Law Personal Data Protection having officially come into force, clearly identifying the roles and legal responsibilities of the relevant parties is a key factor in ensuring compliance.

This article, prepared by VDPC, provides an in-depth analysis and clarification of the fundamental differences in the rights and obligations of Personal data processing and controlling party under Vietnamese law, thereby assisting enterprises in establishing accurate and lawful data processing procedures.

Legal basis:

Article 2, 18, 19, 37 Law on Personal data protection 2025
Article 14 Draft Decree detailing the implementation of a number of provisions of the Law Personal Data Protection

1. Who is the Personal data processing and controlling party?

Pursuant to the Law Personal Data Protection 2025, Personal data processing and controlling party refers to an agency, organization, or individual that decides on the purposes and means of personal data processing and directly processes personal data.

2. Rights of Personal data processing and controlling party

At present, the Law Personal Data Protection 2025 does not provide specific provisions on the rights of Personal data processing and controlling party. However, the rights of such entities may be reflected as follows:

(1) Personal data processing and controlling party have the right to exercise control over personal data, which includes determining the purposes and means of personal data processing, and the right to carry out personal data processing, being activities that affect personal data. Such processing may involve one or more operations, including collection, analysis, summary, encryption, decryption, modification, deletion, destruction, de-identification, provision, disclosure, transfer of personal data, and other activities that impact personal data.

Other activities involving data processing are defined as operations such as storage, access, retrieval, connection, regulation, confirmation, authentication of personal data, and other activities that have an impact on personal data.

(2) Personal data processing and controlling party may also process personal data without personal data subject matters’ consent in the following cases:

To protect the life, health, honor, dignity, and legitimate rights and benefits of the personal data subject matter or others in urgent cases; or to protect one’s own or others’ legitimate rights or benefits, or benefits of the State or agencies/organizations in a necessary manner against infringement on such rights or benefits. The personal data controlling party, personal data processing party, personal data processing and controlling party, and the third party shall prove the necessity of such processing;
To respond to emergencies or threats to national security that have yet to escalate to the level of a declared emergency; to prevent and combat riots, terrorism, crimes, and law violations;
To serve the operations of state agencies and the state management
To carry out the agreement between the personal data subject matter and a relevant agency, organization, or individual.
Other cases according to the law

(3) In addition, although it has not yet been officially promulgated, reference may also be made to the Draft Decree detailing the implementation of certain provisions of the Law Personal Data Protection. This draft addresses the duties of personal data protection personnel and personal data protection units within agencies and organizations.

3. Obligations of Personal data processing and controlling party

The obligations of Personal data processing and controlling party may be reflected through the provisions on their responsibilities. Under the law, the Personal data processing and controlling party is required to fully perform all responsibilities applicable to both the Personal Data Controlling party and Personal Data Processing party, as prescribed by law.

Accordingly, the responsibilities of Personal data processing and controlling party include the following:

Specify the responsibilities, rights, and obligations to be complied with of concerned parties in agreements or contracts concerning personal data processing;
Only receive personal data after concluding an agreement or contract on personal data processing with the personal data controlling party or personal data processing and controlling party;
Decide on the purposes and means of personal data processing in documents and agreements with personal data subject matters, ensuring compliance with the principles and contents;
Process personal data in compliance with the agreement or contract concluded with the personal data controlling party
Adopt appropriate managerial and technical measures to protect personal data according to the law and review and update such measures if necessary;
Issue notices of violations against personal data protection regulations
Select an appropriate personal data processing party to process personal data;

In addition, other responsibilities include:

Ensure the rights of personal data subject matters
Assume responsibility before personal data subject matters for any damage arising from personal data processing;
Assume responsibility before the personal data controlling party or personal data processing and controlling party for any damage arising from personal data processing;
Prevent unauthorized collection of personal data from its system, equipment, and service;
Cooperate with the Ministry of Public Security of Vietnam and competent state authorities in protecting personal data, providing information serving the investigation, and handling violations against personal data protection laws;
Implement other responsibilities pursuant to regulations.

CONCLUSION

Having a clear understanding of and properly fulfilling their rights and obligations is a mandatory requirement for Personal data processing and controlling party. Strict compliance with these regulations is not only a legal obligation but also a fundamental basis for building trust with customers and partners in the digital business environment.

The above outlines the Rights and Obligations of Personal data processing and controlling party. Should you have any further questions regarding this matter, please contact VDPC for accurate consultation and support.

Sincerely!

Zalo: 098.159.5243

The above is a summary and analysis of legal regulations based on the Advisor’s perspective for reference purposes only. This content does not apply to any specific real-world case, and VDPC shall not be held liable for any application by readers based on the aforementioned information without obtaining professional consultation from experts. Readers are kindly requested to contact us for precise advice tailored to your specific case of interest. Sincerely!

See more: