10 responsibilities of personal data controllers

The Lao Dong Newspaper Legal Consulting Office replied:

Clause 1, Article 37 of the Law on Personal Data Protection 2025 (effective from January 1, 2026) stipulates the responsibilities of personal data controllers as follows:

a) Clearly state the responsibilities, rights and obligations of the parties in the agreement or contract related to personal data processing as prescribed in this Law and other relevant legal provisions;

b) Decide on the purpose and means of processing personal data in documents, negotiate with personal data subjects, ensure compliance with the principles and contents of this Law;

c) Implement appropriate management and technical measures to protect personal data in accordance with the provisions of law, review and update these measures when necessary;

d) Notice of violation of regulations on personal data protection as prescribed in Article 23 of this Law;

d) Select a suitable personal data processing party to process personal data;

e) Ensure the rights of personal data subjects as prescribed in Article 4 of this Law;

g) Responsible before personal data subjects for damages caused by the processing of personal data;

h) Preventing the illegal collection of personal data from its system, equipment, and services;

i) Coordinate with the Ministry of Public Security and competent state agencies in protecting personal data, providing information to serve the investigation and handling of violations of the law on personal data protection;

k) Perform other responsibilities as prescribed in this Law and other relevant legal provisions.

Thus, from January 1, 2026, the personal data controller will have the above responsibilities.

See the original here