9 Fundamental Steps In Responding To And Handling Personal Data Incidents
Under the current legal framework governing personal data protection, it is evident that compliance with the Law…
24
Jun
Personal data processing impact assessment (DPIA) services
Entities Required to Conduct Personal Data Processing Impact Assessment
According to the provisions of Article 21 of the Law on Personal Data Protection 2025, as guided by Clause 1, Article 19 of Decree 356/2025/ND-CP, the entities required to conduct a personal data processing impact assessment include: (1) Personal Data Controller; (2) Personal Data Controller and Processor; and (3) Personal Data Processor. In which:
Personal Data Controller is an agency, organization, or individual that decides the purposes and means of personal data processing
Personal Data Controller and Processor is an agency, organization, or individual that decides the purposes and means and directly processes personal data.
Personal Data Processor is an agency, organization, or individual that performs personal data processing on behalf of the Personal Data Controller or the Personal Data Controller and Processor through a contract.
According to Clause 1, Article 19 of Decree 356/2025/ND-CP, the aforementioned subjects must establish and maintain personal data processing impact assessment dossiers from the moment they begin processing personal data.
| Implementation content | SERVICE DETAILS AT CDLAF |
|---|---|
| Data Mapping | Data experts will work directly with departments (IT, Marketing, HR) to inventory data categories and map out how data “flows” within the enterprise. |
| Identifying Roles of Parties | We assist in clarifying contact information and the roles of the Controller, Processor, and Third Parties in accordance with regulations. |
| Classification and Legality Assessment | Clearly distinguishing between basic/sensitive data; reviewing the legal basis for each data processing activity according to the Law on Personal Data Protection and Decree 356. |
| Data Flow Mapping | Our data experts describe the processing purposes, types of data, and draw detailed data flow diagrams to identify the data stream and the data points being processed. |
| Drafting Impact Assessment Reports (Form No. 10) | Preparing the personal data processing impact assessment report with all mandatory contents, ensuring strictness in every argument and data point. |
| Instruction on Documentation with Data Subjects | CDLAF experts will guide you in establishing contracts or agreements on personal data processing, reflecting the binding duties and responsibilities between organizations and individuals in processing activities. |
| Instruction on Internal Data Governance Documentation | CDLAF data experts will advise you on how to build policies, processes, regulations, forms, and other relevant documents regarding personal data protection for the Controller, Controller and Processor, and Processor. |
| Official Dossier Submission | Representing the enterprise to complete the submission of original copies directly or online to the Department of Cybersecurity and High-Tech Crime Prevention (A05) within the statutory timeline. |
| Monitoring and Handling Feedback from the Ministry of Public Security | Monitoring the progress of report processing, directly receiving and handling additional requests from specialized authorities. |
| Dossier Revision upon Request (if any) | Performing in-depth adjustments and supplements to the dossier, providing explanations, and working directly with the Department of Cybersecurity (A05). |
| Legal Counsel in Post-inspection Activities | Providing consulting services, orienting explanation content, and guiding enterprises in preparing documents when there is a personal data inspection request from competent authorities. |
Instructions for Preparing Personal Data Processing Impact Assessment Reports
The Personal Data Processing Impact Assessment Report according to Form No. 10 in the Appendix of Decree 356/2025/ND-CP will include the following contents:
- Information and contact details of the personal data controller, personal data controller and processor, personal data processor, and third parties;
- Contact details of the personal data protection department or personnel; organizations or individuals providing personal data protection services (if any) for the controller, controller and processor, processor, and third parties;
- Description and justification of the purpose of personal data processing, types of personal data processed, details of personal data processing activities, and personal data flow diagrams;
- Description and justification for obtaining data subject consent, policies for storage, deletion, and destruction of personal data;
- Plans to ensure personal data safety, personal data protection measures, system design diagrams, and applied personal data protection standards;
- Results of the assessment of compliance with personal data protection regulations;
- Assessment of the impact level, risks of personal data processing activities; unwanted consequences or damages that may occur, and measures to mitigate or eliminate those threats and risks.
WHY CHOOSE PERSONAL DATA SERVICES AT CDLAF?
The difference of CDLAF lies in our mission: “Understand to Protect.” We do not just provide legal advice; we provide implementation solutions from the mindset of an In-house Counsel:
- Multidisciplinary Understanding: CDLAF provides internal consulting for many enterprises across diverse fields such as manufacturing, e-commerce, labor sub-leasing, healthcare, education… therefore, we deeply understand the specific data issues of each business.
- Insight into Cross-departmental Operations: We understand the data characteristics of each department, from the technical infrastructure of IT and Marketing to the security of sensitive records in Human Resources (HR), accounting, etc
- Practical Experience: By performing various personal data services such as consulting, building internal data governance documents, and conducting impact assessment and cross-border data transfer procedures, our experts have diverse experience and in-depth knowledge of domestic personal data laws and the provisions of the EU General Data Protection Regulation (GDPR).
CDLAF LAW FIRM – Protecting data with insight from within
VIDEO: How CDLAF protect your personal data
This video helps businesses comply with regulations while protecting the rights of individuals in the digital environment.
