Professional data processing agreement (DPA) drafting services in Vietnam assist enterprises in clearly defining legal rights, obligations, and liabilities with partners and service providers during personal data processing activities. Under the Law on Personal Data Protection 2025 and Decree No. 356/2025/ND-CP, contracting parties are required to explicitly clarify the scope of processing, intended purposes, data protection measures, and liabilities in the event of a breach. Viet An Law provides comprehensive legal advisory, drafting, review, and negotiation services for DPAs, personal data processing contracts, and data protection addenda, tailored for Vietnamese enterprises, FDI companies, and multinational corporations to ensure strict compliance and mitigate operational risks in commercial relations.
What is a data processing agreement in Vietnam?
A Data Processing Agreement (DPA) is a document that establishes the rights, obligations, and responsibilities of the parties involved in the processing of personal data – particularly when one organization processes data under the instructions of another.
A DPA may take various forms, including:
- A standalone data processing agreement;
- A data processing addendum to a service contract;
- Specific data processing terms incorporated into technology, human resources, or outsourcing contracts;
- An intra-group data processing agreement between companies within the same corporate group, tailored to the legal role of each party.
The core purpose of a DPA is to define which party determines the purposes and means of processing, which party carries out the processing activities, the scope of data usage, the security measures to be implemented, and the responsibilities of each party throughout their collaboration.
Unlike a Non-Disclosure Agreement (NDA), which focuses primarily on restricting the disclosure of information, a DPA governs the actual processing of personal data and the legal liabilities of the parties involved.
When does an enterprise need to sign a DPA in Vietnam?
Under points a and b, Clause 2, Article 37 of the Law on Personal data protection No. 91/2025/QH15, a personal data processor may only receive personal data after establishing an agreement or contract on personal data processing with the data controller or the data controller-cum-processor; furthermore, the processor must handle data strictly in accordance with the agreed terms. Consequently, enterprises must clearly determine the legal roles of all parties involved before transferring personal data to another organization for processing. Alongside broader compliance needs like privacy policy drafting services for businesses in Vietnam, common scenarios where drafting a DPA becomes imperative include:
Businesses engaging software and cloud service providers
Providers of Customer Relationship Management (CRM), Human Resource Management (HRM), and Enterprise Resource Planning (ERP) systems, as well as cloud computing or Software as a Service (SaaS) solutions, may access and process a business’s personal data.
A DPA should define the scope of access, processing instructions, confidentiality obligations, the use of subcontractors, and the handling of data upon the termination of the contract.
However, not all technology providers hold the same legal role. Businesses must evaluate how a provider receives, uses, and controls the data.
Outsourcing of HR, accounting, and payroll services
When outsourcing, a business may provide its partner with employee information, payroll data, bank account details, insurance-related information, or personnel records.
The agreement should specify the permitted purposes for data use, authorized personnel, confidentiality obligations, data retention periods, and requirements for the return or deletion of data.
For sensitive personal data, additional assessment is required to ensure compliance with specific legal protection requirements.
FDI enterprises utilizing a corporate-wide management system
Foreign-invested enterprises often share human resources, customer management, or information technology systems with their parent companies and overseas affiliates.
In cases where a parent company processes data under the instructions of a Vietnamese legal entity, the parties should consider establishing an appropriate DPA.
If each party independently determines the purposes and means of processing, the contractual structure should be evaluated accordingly, rather than defaulting to a DPA between a data controller and a data processor.
Furthermore, sharing data within the same corporate group does not grant an exemption from legal obligations regarding the protection of personal data.
Businesses engaging partners for marketing and customer service
Service providers – such as those offering advertising, call center operations, customer support, marketing, or data analytics – may gain access to a business’ customer lists and transaction information.
A DPA should define the purpose of data usage, restrict access rights, outline terms for sharing data with third parties, and establish responsibilities upon the completion of services.
If a partner intends to use the data for their own commercial purposes, the business must re-evaluate the roles of each party and the legal basis for such data processing.
Đơn vị cung cấp dịch vụ quảng cáo, tổng đài, chăm sóc khách hàng, tiếp thị hoặc phân
Key Differences: DPA, NDA, and personal data protection policy in Vietnam
A DPA is often confused with a confidentiality agreement, a privacy policy, or other data protection documents.
| Document | Purpose | Applicable subject |
| Data Processing Agreement (DPA) | Delineate rights, obligations, and liabilities within data processing relationships | Parties involved in the data processing relationship |
| Non-Disclosure Agreement (NDA) | Restrict unauthorized disclosure and use of confidential information | Parties subject to confidentiality obligations |
| Personal data protection policy | Establish data governance principles and internal regulations | Enterprises, personnel, and relevant stakeholders |
| Personal data processing notice | Provide operational information regarding data processing activities | Individual data subjects |
| Data processing consent form | Record valid data subject consent as required by statutory law | Data subjects and relevant entities |
Signing an NDA does not automatically replace a DPA if the relationship between the parties falls under circumstances where the law requires an agreement or contract for the processing of personal data.
Similarly, a DPA does not replace a personal data protection policy, nor does it supersede obligations regarding notification, obtaining consent, or conducting impact assessments as required by law.
Businesses may wish to consult the personal data protection policy drafting services offered by Viet An Law to develop an appropriate internal governance documentation system.
Key provisions to consider when drafting a data processing agreement Vietnam
A DPA should be tailored to the contractual relationship, the specific data processing activities, and the capacity of each party to fulfill its obligations. Viet An Law focuses on advising on and negotiating the following categories of clauses:
Determine the roles and legal responsibilities of the parties
It is necessary to distinguish between a personal data controller, a personal data processor, an entity that acts as both a controller and processor, and a third party.
Correctly identifying these legal roles helps establish responsibilities that align with the actual authority to make decisions regarding, and the ability to exercise control over, the data.
Purpose, scope, and instructions for data processing
A DPA must specify the types of data, categories of data subjects, the purposes and duration of processing, and the specific processing activities permitted.
Businesses should pay particular attention to any clauses that allow a service provider to use customer data for purposes such as product development, commercial analysis, or marketing activities that fall outside the scope of the provided services.
Data security, subcontractors, and audit rights
The contract should define data protection measures, access restrictions, conditions for the use of subcontractors, and mechanisms for providing evidence of compliance.
Audit and inspection rights should be structured in a manner commensurate with the level of risk and the operational capabilities of the parties involved.
Incident notification and coordination for legal obligations
The parties should agree upon designated points of contact, timelines for incident notification, responsibilities for providing documentation, and procedures for coordinating remediation efforts.
Pursuant to Article 23 of the Law on Personal Data Protection 2025, a data processor that discovers a breach must promptly notify the data controller (or the entity acting as both controller and processor). Consequently, the internal notification timelines stipulated in a DPA must ensure that the obligated party is able to meet the statutory deadlines for notifying the competent authorities, as required by law.
Liability for compensation and data handling upon contract termination
A DPA must distinguish between damages arising from a breach of contract, a violation of data protection obligations, and the specific fault of each party.
Provisions concerning the limitation of liability, indemnification, or exemptions may not invalidate mandatory legal obligations.
Upon the termination of a contract, the parties must establish mechanisms for the return, export, deletion, or destruction of data – or for its continued storage based on a lawful legal basis – including backup data and information subject to mandatory retention requirements.
For a detailed analysis of individual clauses, clients may refer to the article “Data Processing Agreement with Vendors in Vietnam: Key Clauses” published by Viet An Law.
Legal Scenario: DPA Negotiation between an FDI Enterprise and an International SaaS Provider
A hypothetical example illustrating a legal advisory approach.
An FDI enterprise based in Hanoi enters into a contract for a customer management software solution with an international SaaS provider. While the service agreement – covering pricing, duration, and features – has been finalized, the provider requires the enterprise to sign a DPA based on their global template, which is aligned with the European Union’s General Data Protection Regulation (GDPR).
Upon reviewing the draft, the enterprise identifies several issues requiring negotiation:
- The provider is permitted to use customer data for service improvement, yet the scope and limitations of this use are not clearly defined;
- The provider retains the right to engage sub-processors without a clear mechanism for notification or objection by the enterprise;
- The enterprise’s right to request proof of compliance or conduct audits is overly restricted;
- Provisions regarding incident notification do not ensure the enterprise receives sufficient information to fulfill its obligations under Vietnamese law;
- Indemnification clauses fail to clearly delineate the respective responsibilities of each party;
- Procedures for the export, return, or deletion of data upon contract termination are not adequately addressed.
In this situation, Viet An Law can assist the enterprise by reviewing the DPA, preparing a summary of high-risk clauses, and proposing a negotiation strategy.
The solution does not necessarily require replacing the entire international DPA. Depending on the review findings, the parties may choose to amend key terms, incorporate a “Vietnam Data Protection Addendum”, or establish an order of precedence among the various contractual documents.
Beyond the DPA, the enterprise must also determine its obligations regarding the cross-border transfer of personal data, should its actual operations fall under the scope of such requirements under Vietnamese law.
Legal considerations when negotiating a DPA in Vietnam
When negotiating a DPA, businesses should not focus solely on confidentiality clauses; rather, they must evaluate the alignment between the DPA and the primary commercial contract.
In particular, it is essential to clarify the order of precedence among the documents, the service provider’s rights to use the data, liabilities in the event of a breach, dispute resolution mechanisms, and obligations that cannot be waived or excluded by agreement.
Regarding DPAs provided by foreign partners, legal counsel must distinguish between negotiable terms and obligations that are mandatory under Vietnamese law. Furthermore, the execution of a DPA does not automatically legitimize all processing or transfer activities involving personal data.
Viet An Law assists businesses in identifying key terms for negotiation, proposing amendments, and establishing a framework for the allocation of responsibilities that corresponds to the actual level of control exercised by each party.
Personal data processing legal advisory services in Vietnam of Viet An Law
Viet An Law provides specialized legal services regarding personal data processing agreements and their addenda, focusing on the rights and responsibilities of businesses within commercial relationships.
Drafting new personal data processing agreement
A service for businesses that need to develop a DPA tailored to specific commercial contracts or data processing relationships.
The scope of work may include:
- Defining the legal roles and responsibilities of the parties;
- Determining the appropriate contractual structure (e.g., a standalone agreement or an addendum);
- Drafting provisions regarding the scope, purpose, and instructions for data processing;
- Establishing mechanisms for security, the use of sub-processors, data incident management, and liability;
- Drafting an annex describing the specific data processing activities;
- Finalizing the draft for the purposes of negotiation and execution.
Data processing agreement review provided by partners
Viet An Law provides support in reviewing DPAs proposed by suppliers, partners, or foreign parent companies.
Our service focuses on identifying unfavorable terms, content that does not comply with Vietnamese law, and risks related to the allocation of liabilities.
Depending on the agreed scope of work, businesses will receive a legal commentary, a table of proposed amendments, or a version of the agreement with tracked changes.
Negotiation of DPA terms with partners
Viet An Law assists in developing negotiation strategies, proposing alternative terms, engaging in legal discussions with partners, and finalizing the agreement.
This service is well-suited for transactions involving multiple parties, high-value contracts, or cross-border data processing relationships.
Drafting a DPA as an addendum to commercial contracts
Not every DPA needs to be structured as a standalone contract.
Depending on the transaction structure, Viet An Law can draft a data protection and processing addendum for contracts involving software, human resources, accounting, marketing, customer service, or other outsourced services.
International DPA review and drafting addendums for jurisdiction compliance in Vietnam
For FDI enterprises and multinational corporations, Viet An Law provides support in reconciling global DPAs with Vietnamese law, drafting specific addenda, and adjusting provisions that are not in compliance.
This review may also encompass contractual language, governing law, the liabilities of the Vietnamese legal entity, and the relationship between the DPA and the primary contract.
Key deliverables included in Viet An Law’s data processing agreement drafting services in Vietnam
Depending on the agreed scope of services, the business may receive the following documents:
| Deliverables | Content & value of application |
| Finalized DPA | Agreement formulated for negotiation or final execution |
| Data Processing Schedule | Supplementary legal instrument attached to commercial contracts |
| Risk assessment matrix / review report | Identification of unfavorable, non-compliant, or high-risk clauses |
| Track-changes agreement | Clear visual representation of proposed amendments to counterparties’ DPAs |
| Processing operations schedule | Specification of data categories, processing purposes, retention periods, operations, and relevant stakeholders |
| Bilingual Vietnamese – English version | Tailored for commercial transactions with foreign entities and cross-border partners |
| Negotiation term sheet | Prioritization of key legal and commercial terms for negotiation |
| Post-execution implementation guide | Operational guidelines on key post-execution obligations and coordination contacts |
Additional documentation regarding data protection policies, impact assessment records, and procedures for cross-border data transfers shall be provided only when falling within the scope of the agreed-upon services.
Enterprise dossier required when requesting DPA drafting services in Vietnam
To facilitate the service, the business should prepare the following:
- Legal information regarding the signing parties;
- The main contract or a draft of the commercial agreement;
- Any existing DPA or a DPA template provided by a counterparty, if applicable;
- A description of the scope of services and data processing activities;
- A list of the categories of data and the groups of data subjects involved;
- Information concerning storage systems, parties with access, and any subcontractors;
- Requirements regarding language, governing law, and the scope of negotiations;
- The expected timeline for signing the agreement.
The business may provide descriptive documentation or appropriately anonymized materials. Drafting a DPA generally does not require the disclosure of actual personal data belonging to customers or employees.
Consulting and drafting procedure for personal data processing agreements in Vietnam
Step 1. Receipt of documentation and analysis of data protection and processing relationships
Viet An Law reviews the primary contract, determines the legal roles of the parties, defines the scope of data processing, and identifies issues that require adjustment within the DPA.
Step 2. Drafting or reviewing the DPA
Lawyers draft a new DPA or review a DPA provided by a counterparty, proposing amendments to terms that are non-compliant with the law or pose a risk of future disputes.
Step 3. Negotiation support and contract finalization
Depending on the agreed scope of services, Viet An Law assists in discussions with the counterparty, adjusts key terms, and finalizes the DPA for the parties to review and sign.
Step 4. Handover and implementation guidance
The contract, its annexes, and relevant documents are handed over as agreed; guidance is provided regarding obligations to be observed during the term of the contract and upon its termination.
Privacy policy drafting services for businesses in Vietnam
Service costs depend on the scope of the transaction, the level of complexity, and the client’s requirements.
Factors influencing the quoted fees include:
- Drafting a new DPA or reviewing an existing agreement;
- The number of parties involved and the legal role of each party;
- The type of data and the scope of processing;
- Whether the agreement is domestic or involves international transactions;
- Requirements for bilingual drafting;
- The number of revision rounds and the level of support required for negotiations;
- The need to develop specialized addenda or adapt a global DPA.
For businesses that engage multiple service providers, Viet An Law can provide guidance on developing a standardized DPA template, along with specific addenda tailored to different types of services, to ensure consistency in contract management.
Clients may submit a draft DPA or a description of the transaction, allowing Viet An Law to assess the requirements and provide an appropriate price quote.
Why choose Viet An Law for DPA drafting services in Vietnam?
Drafting a DPA requires an integration of personal data protection laws, contract law, and commercial transaction practices.
Viet An Law focuses on the following legal priorities:
- Protecting contractual interests: Reviewing rights, obligations, and terms that may pose adverse risks to the client.
- Ensuring compliance with Vietnamese law: Aligning contractual obligations with applicable local regulations.
- Tailoring to operational realities: Structuring the DPA based on the specific service model, data processing systems, and the scope of control held by each party.
- Facilitating international transactions: Reviewing foreign-drafted DPAs and developing addenda tailored to operations within Vietnam.
- Prioritizing enforceability: Proposing clear mechanisms for coordination, notification, handling of breaches, and contractual liability.
The objective of this service is to assist businesses in entering into and executing personal data processing agreements that feature clear, actionable legal frameworks, while remaining aligned with their legitimate commercial interests.
Legal basis for personal data protection and processing agreements in Vietnam 2026
The primary legal bases include:
- The Law on Personal Data Protection No. 91/2025/QH15, effective from January 1, 2026. Notably, Article 37 outlines the responsibilities of personal data controllers, processors, and entities acting as both; Article 23 addresses the notification of breaches; and Article 39 sets out transitional provisions.
- Decree 356/2025/ND-CP, effective from January 1, 2026, which provides detailed regulations and implementation measures for the Law on Personal Data Protection.
- The Civil Code 2015, governing the formation, execution, amendment, and termination of contracts, as well as civil liability.
- The Law on Commercial 2005, insofar as it applies to commercial relationships.
- The Law on Electronic Transactions on 2023, regarding the conclusion and execution of contracts via electronic means.
- Sector-specific legal regulations concerning confidentiality, cybersecurity, and data processing within individual fields.
Note regarding contracts signed before 2026: Pursuant to Clause 1, Article 39 of the Law on Personal Data Protection 2025, ongoing personal data processing activities – for which consent has been obtained from the data subject or which are conducted under an agreement consistent with Decree 13/2023/ND-CP prior to the Law’s effective date – may continue without the automatic requirement to re-obtain consent or re-negotiate agreements.
However, these transitional provisions do not imply that every DPA signed before 2026 is automatically compliant with the law. Businesses still need to conduct reviews whenever there are changes to the purpose or scope of processing, the parties involved, or the emergence of new legal obligations.
Frequently asked questions about drafting DPAs in Vietnam
Are businesses required to sign a DPA?
Under Clause 2, Article 37 of the Law on Personal Data Protection 2025, a personal data processor must enter into an agreement or contract with the data controller (or the party acting as both controller and processor) before receiving any data. For other types of data-sharing arrangements, the legal role of each party must be accurately determined to select the appropriate documentation.
Must a DPA be a standalone contract?
There is no general requirement that every DPA must be a standalone contract. Depending on the specific transaction, a DPA may take the form of a separate agreement or an addendum to a service contract, provided that its content and form comply with the requirements of the applicable law.
Does a Personal Data Processing Agreement require notarization?
Generally, DPAs do not fall into the category of contracts that require notarization. However, the parties should consider any industry-specific regulations, the nature of the transaction, and the conditions required for the contract to be legally valid.
Can an FDI enterprise use a DPA from its parent company?
It may be used as a basis, provided that it is reviewed for compliance with Vietnamese law, the specific legal roles of each party, and the scope of data processing. If necessary, the enterprise may draft an addendum specifically for its operations in Vietnam.
Does a DPA replace a Personal Data Processing Impact Assessment (DPIA)?
No. A DPA governs the contractual relationship between the parties involved in data processing, whereas a personal data processing impact assessment serves a distinct legal function and fulfills a separate set of obligations. Enterprises must determine their obligation to prepare such an assessment in accordance with the relevant regulations.
Conclusion
The service of drafting DPAs assists businesses in establishing the rights and obligations of all parties involved in data processing, defining contractual responsibilities, and mitigating legal risks throughout the course of a partnership.
For FDI enterprises, multinational corporations, and businesses that engage third-party providers – such as those for technology, human resources, accounting, or marketing services – the drafting and review of a DPA must be aligned with Vietnamese law, the relevant commercial contracts, and the actual data processing activities.
Viet An Law provides services for the drafting, review, and negotiation of DPAs, personal data processing agreements, and data protection addenda. Should you require consultation or a price quote, please contact Viet An Law for assistance.
Compiled by: Lawyer Do Thi Hong Hanh
Supervising lawyer (Professional oversight and content review): Lawyer Trung Thi Lieu
Legal update: October 30, 2026
Hotline | Zalo | WhatsApp: (+84) 961 571 818
Email: info@vietanlaw.com
Hanoi Office: 3rd Floor, Hoang Ngan Plaza Building, 125 Hoang Ngan, Yen Hoa Ward, Hanoi.
Ho Chi Minh City Office: Units 2.26–2.27, Charmington La Pointe Building, 181 Cao Thang, Hoa Hung Ward, Ho Chi Minh City.
