🔷 SERIES: 30 PERSONAL DATA PROTECTION COMPLIANCE SCENARIOS IN EVERYDAY BUSINESS OPERATIONS - #8: SHARING PERSONAL DATA WITH VENDORS: WHAT NEEDS TO BE CONTROLLED IN THE CONTRACT?

loanlelawlinkvn
Apr 8
2 min read

In day-to-day operations, businesses often need to share personal data with service providers—from cloud storage providers, HR or CRM software vendors, and call centers to various operational support partners. However, transferring data to a vendor does not mean transferring compliance responsibility.

A common mistake is to treat an NDA as sufficient to address the risks. In reality, confidentiality is only one part of the equation. What businesses need to control in the contract includes: what types of data the vendor can access, for what purposes, within what scope, whether sub-processing is allowed, how incidents must be reported, and how data is returned or deleted upon termination.

Contracts that do not clearly address these points may seem “fine” during normal operations. But when incidents, audits, or disputes arise, businesses often realize that generic confidentiality clauses are not enough to demonstrate that proper personal data control mechanisms were in place.

A practical tip for in-house teams:

Contracts with vendors should not be reviewed solely from a commercial and confidentiality perspective. A privacy rider or a vendor data checklist should be consistently applied to agreements involving personal data processing.

Mini-checklist:

• Clearly define the types of data and purposes of processing;

• Restrict access rights based on actual need;

• Include incident notification obligations;

• Control the use of sub-processors or third parties;

• Specify mechanisms for data return, deletion, or deletion confirmation upon termination.

In the context of a formalized legal framework on personal data protection, standardizing privacy clauses in vendor contracts should be treated as an upfront control measure—not a post-risk fix.

Legal reference:

Law on Personal Data Protection No. 91/2025/QH15 and its implementing regulations, including provisions on roles of parties in data processing, data security responsibilities, and control over third-party data sharing.

CTA:

A practical vendor data-sharing checklist is available in the comments.

https://drive.google.com/file/d/1ysoz6UE3ySEto62O9NXrhvqZ0JFDkdhe/view?usp=sharing

💌 Next Article: Terminating a Vendor Contract: Should Personal Data Be Returned, Deleted, or Retained?

-------------------------------

Article: Prepared by LLVN.

Image: LLVN

-------------------------------

𝐂𝐨𝐧𝐭𝐚𝐜𝐭 𝐮𝐬

Website: www.lawlink.com

Instagram: lawlink.vietnam

Facebook: Lawlink Vietnam