Data Processing Agreement in Vietnam: Template, Key Clauses and Local Law (2026)

What a data processing agreement is A data processing agreement (DPA) is the contract that governs what happens when one party hands personal data to another to handle on its behalf. In Vietnamese terms, it binds a data controller and a data processor so the processor only does what the controller allows, keeps the data secure, and helps the controller meet its legal duties. If you take one thing from this page: in Vietnam a DPA is now part of a serious, law-level privacy regime, not a formality. Treat it as a compliance document. This is a general guide, not legal advice. See the note at the end. ## The law changed in 2026: the PDP Law Vietnam moved its privacy rules up from a government decree to a full national law. The Law on Personal Data Protection, Law No. 91/2025/QH15, was passed on 26 June 2025 and took effect on 1 January 2026. It consolidates rules that were previously spread across several instruments, most importantly Decree 13/2023/ND-CP (the PDPD), which the new regime replaced. Implementing guidance came through Decree 356/2025/ND-CP. Two earlier rules from the decree era are worth knowing, because the law carries their logic forward: - Vietnam uses a controller, processor, and controller-processor model, and these parties carry compliance duties.

• There is an impact-assessment dossier obligation. Under the decree regime, controllers, processors, and controller-processors had to prepare and submit a data-processing impact assessment to the Ministry of Public Security (unit A05), and cross-border transfers needed their own transfer impact-assessment dossier. Confirm the current form and deadlines under the 2025 Law and Decree 356/2025. Penalty figures circulating before the law passed (for example, a percentage of prior-year revenue for cross-border violations) came from a draft, so verify the final sanctions against the enacted text and any sanctions decree before relying on a number. ## Do you need a DPA in Vietnam? Yes, in practice, whenever a controller lets a processor handle personal data. The law's accountability and security duties, and the impact-assessment regime, all assume a defined, documented relationship between controller and processor. A written DPA is how you evidence it. ## Key clauses in a Vietnamese DPA ### 1. Roles and definitions State who is controller, processor, or controller-processor, aligned with the PDP Law's definitions, and the categories of data and data subjects. ### 2. Scope and purpose Limit processing to the controller's documented purposes and instructions. ### 3. Consent and lawful basis support Vietnam's regime leans heavily on consent and on clear notice to data subjects. The processor must support the controller in honouring the basis on which data was collected. ### 4. Security measures Require technical and organisational security appropriate to the data, in line with the PDP Law and Decree 356/2025. ### 5. Impact assessment cooperation The processor cooperates with the controller's data-processing impact assessment and, where data leaves Vietnam, the cross-border transfer impact assessment and any filing with the authority. ### 6. Cross-border transfers Address transfers of Vietnamese personal data abroad, including the documentation the law requires. This is one of the most sensitive areas, so make the clause specific. ### 7. Sub-processors Control whether sub-processors are allowed and flow the same duties down, with a list in a schedule. ### 8. Breach notification The processor notifies the controller promptly so the controller can meet its own notification duties to the authority and to data subjects. ### 9. Data subject rights The processor assists with access, correction, deletion, and withdrawal-of-consent requests. ### 10. Return or deletion and audit On termination, return or delete personal data, and give the controller audit or evidence rights. ### 11. Liability and governing law Allocate liability for breaches and choose Vietnamese law where appropriate. ## A simple DPA structure you can reuse 1. Parties and roles

2. Definitions (aligned with the PDP Law)
3. Scope and purpose of processing
4. Processor obligations (instructions, security, confidentiality)
5. Consent and data-subject notice support
6. Impact assessment cooperation
7. Cross-border transfer terms
8. Sub-processors
9. Breach notification
10. Data subject rights assistance
11. Return or deletion and audit
12. Liability, term, governing law
13. Schedules: data categories, security measures, sub-processors ## Common mistakes - Relying on an old Decree 13 DPA without updating it to the 2025 Law and Decree 356/2025.

• Treating cross-border transfer as an afterthought, when it carries its own dossier obligations.
• Forgetting the impact-assessment duty, which falls on processors as well as controllers.
• Copying an EU GDPR DPA unchanged; the concepts overlap but the Vietnamese filings, authority, and consent emphasis are distinct. ## Keeping every DPA consistent across your suppliers Most companies sign many DPAs, each with its own security schedule, sub-processor list, transfer terms, and breach-notice window, and the risk is the supplier contract that never got updated for the 2025 Law. The work of drafting from a house template, checking each DPA against the PDP Law and Decree 356/2025, spotting the clause that drifted, and tracking the impact-assessment and audit commitments can live in one AI contract workspace rather than a folder of near-identical documents. Adira is an AI legal operating system that drafts, reads, and tracks contracts in one place, tuned to how your company contracts and built on frontier AI; its deepest jurisdiction support today is India, with other jurisdictions including Vietnam on the roadmap, so confirm local-law depth before relying on it. ## Not legal advice This page is a general explanation of data processing agreements under Vietnamese law in 2026. It is not legal advice, and the PDP Law and Decree 356/2025 are new, with practice still settling. Confirm the current impact-assessment, transfer, and sanctions position with the Ministry of Public Security's guidance or a qualified Vietnamese lawyer before you sign.