{"id":13370,"date":"2026-07-20T10:12:13","date_gmt":"2026-07-20T03:12:13","guid":{"rendered":"https:\/\/democft.az9s.com\/?p=13370"},"modified":"2026-07-20T10:14:11","modified_gmt":"2026-07-20T03:14:11","slug":"what-should-advertising-enterprises-prepare-to-comply-with-the-personal-data-protection-law","status":"publish","type":"post","link":"https:\/\/democft.az9s.com\/en\/what-should-advertising-enterprises-prepare-to-comply-with-the-personal-data-protection-law\/","title":{"rendered":"What Should Advertising Enterprises Prepare To Comply With The Personal Data Protection Law?"},"content":{"rendered":"<p><span data-text-color=\"primary\"><strong><em>Author: CDLAF Law Firm (Strategic legal partner of CFT)<\/em><\/strong><\/span><\/p>\n<p><em>In the context of the Law on Personal Data Protection 2025 and Decree No. 356\/2025\/ND-CP<strong>,<\/strong> tightening the requirements for the collection, use, and transfer of personal data, advertising and media enterprises are becoming one of the sectors most directly affected. From running advertisements and multi-platform marketing to collaborating with technical partners, suppliers, or employees, most activities involve the processing of personal data. Therefore, enterprises do not only require standard service contracts but must establish comprehensive contractual terms, agreements, and data control mechanisms in accordance with legal regulations to mitigate legal risks and protect brand reputation.<\/em><\/p>\n<figure id=\"attachment_13371\" aria-describedby=\"caption-attachment-13371\" style=\"width: 600px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-13371\" src=\"http:\/\/democft.az9s.com\/wp-content\/uploads\/2026\/07\/pexels-merlin-14314635-600x400-1.jpg\" alt=\"\" width=\"600\" height=\"400\" \/><figcaption id=\"caption-attachment-13371\" class=\"wp-caption-text\">Source: pexels-merlin-14314635<\/figcaption><\/figure>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_85 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of contents:<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #fe8500;color:#fe8500\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #fe8500;color:#fe8500\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/democft.az9s.com\/en\/what-should-advertising-enterprises-prepare-to-comply-with-the-personal-data-protection-law\/#1_Agreements_Between_Advertising_Service_Clients_and_Advertising_Companies\" >1. Agreements Between Advertising Service Clients and Advertising Companies<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/democft.az9s.com\/en\/what-should-advertising-enterprises-prepare-to-comply-with-the-personal-data-protection-law\/#2_Agreements_between_third-party_service_providers_suppliers_and_advertising_companies\" >2. Agreements between third-party service providers (suppliers) and advertising companies<\/a><\/li><\/ul><\/nav><\/div>\n<h2><span class=\"ez-toc-section\" id=\"1_Agreements_Between_Advertising_Service_Clients_and_Advertising_Companies\"><\/span>1. Agreements Between Advertising Service Clients and Advertising Companies<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>According to clause 1, Article 28 of the Law on Personal Data Protection 2025, an enterprise providing advertising services (\u201cadvertising company\u201d) is only permitted to: <em>\u201cuse personal data of customers transferred by <strong>the personal data controller or the personal data controller and processor under an agreement,<\/strong> or collected through its own business activities,<strong> to conduct advertising services.<\/strong> The collection, use, and transfer of personal data must ensure the rights of data subjects as prescribed in Article 4 of this Law\u201d.<\/em> Concurrently, clause 2, Article 28 of the Law on Personal Data Protection 2025 also stipulates that the personal data controller or the personal data controller and processor may only transfer personal data to an advertising company in accordance with the law.<\/p>\n<p>In the relationship between the advertising company, the client, and the recipient of advertising information, where the client provides the recipients\u2019 personal data to the advertising company for advertising purposes, the use of such data may only be conducted based on the valid consent of the data subject, consistent with point a, clause 1, Article 17 of the Law on Personal Data Protection 2025.<\/p>\n<p>Furthermore, the provisions regarding the transfer of personal data must be clearly specified in the service contract between the client and the advertising company, ensuring full compliance with the requirements under point a, clause 1, Article 7 of Decree No. 356\/2025\/ND-CP, specifically:<\/p>\n<ul>\n<li>The purpose of the personal data transfer;<\/li>\n<li>The categories of data subjects and the types of personal data being transferred, appropriate to the purpose of the transfer;<\/li>\n<li>The duration for processing personal data and requirements for data deletion or destruction upon completion of the transfer purpose;<\/li>\n<li>The legal basis for the transfer of personal data;<\/li>\n<li>Responsibilities for personal data protection during the transfer and processing stages;<\/li>\n<li>Responsibilities for implementing the rights of the data subjects;<\/li>\n<li>Responsibilities for coordination and compliance between parties in the event of a detected violation of personal data protection regulations.<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"2_Agreements_between_third-party_service_providers_suppliers_and_advertising_companies\"><\/span>2. Agreements between third-party service providers (suppliers) and advertising companies<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Pursuant to clause 6, Article 18 of the Law on Personal Data Protection, an advertising company is prohibited from subcontracting or agreeing to let another organization or individual perform the entire advertising service involving the use of personal data on its behalf.<\/p>\n<p>Accordingly, where an advertising company enters into contracts with service providers to support the implementation of advertising activities, the contract should clearly specify that such parties are only engaged to perform partial auxiliary work under the control and supervision of the advertising company, and do not replace the advertising company\u2019s role in carrying out the entire advertising service involving the personal data of data subjects.<\/p>\n<p>3. Agreements between advertising companies and employees<\/p>\n<p>Under clause 2, Article 25 of the Law on Personal Data Protection 2025, advertising companies bear responsibility for the management and use of employees&#8217; personal data, including:<\/p>\n<ul>\n<li>Complying with the provisions of this Law, labor and employment laws, data protection laws, and other relevant legal regulations;<\/li>\n<li>Storing employees&#8217; personal data for the duration prescribed by law or as agreed upon;<\/li>\n<li>Deleting or destroying employees&#8217; personal data upon termination of the labor contract, except where otherwise agreed or prescribed by law.<\/li>\n<\/ul>\n<p>Although clause 2, Article 25 requires the deletion or destruction of data upon contract termination, enterprises must pay special attention to record-keeping obligations under tax, accounting, and social insurance laws for post-clearance audits and inspections. To harmonize data protection obligations with specialized legal compliance, enterprises should specify in agreements with employees: <em>&#8220;Personal data shall be stored and only deleted or destroyed after the enterprise has fulfilled all legal obligations and mandatory retention periods related to taxes, insurance, and labor as prescribed by current law.&#8221;<\/em><\/p>\n<p>Additionally, according to clause 3, Article 25 of the Law on Personal Data Protection, the processing of employee personal data collected via technological or technical measures for management purposes must satisfy the following:<\/p>\n<ul>\n<li>Only appropriate technological and technical measures consistent with the law shall be applied, ensuring the rights and interests of the data subject, provided that the employee is fully aware of such measures;<\/li>\n<li>Processing or using personal data collected from technological or technical measures in violation of the law is strictly prohibited.<\/li>\n<\/ul>\n<p>In personnel management, applying monitoring measures such as camera systems or productivity management software does not stop at signing a consent agreement. By law, the enterprise must ensure the employee &#8220;clearly knows&#8221; about these activities. Consequently, enterprises must issue and publicly post a <strong>personal data processing notice<\/strong> at workplaces or send direct notifications via internal management systems. This notice must clarify the scope of monitoring, the purpose of data use, and the corresponding security measures to ensure transparency and the rights of the data subject.<\/p>\n<p>To ensure compliance with the Law on Personal Data Protection regarding the processing of employee personal data, advertising companies should draft a personal data protection agreement and require employees to sign it before or concurrently with the execution of the labor contract. This agreement may be a separate document or integrated into the labor contract, clearly expressing the employee&#8217;s consent to the collection and processing of personal data, including the application of technological measures such as video recording, timekeeping, and monitoring employees\u2019 use of work devices.<\/p>\n<p><em>The article contains general information which is of reference value, in case you want to receive legal opinions on issues you need clarification on, please get in touch with our Experts at <a href=\"https:\/\/mail.google.com\/mail\" target=\"_blank\" rel=\"noopener\"><strong>info@democft.az9s.com<\/strong><\/a><\/em><\/p>\n<div class=\"content-post-nd\">\n<p><strong>Why choose CFT\u2019s service?<\/strong><\/p>\n<ul class=\"li-content\">\n<li>We provide effective and comprehensive legal solutions that help you save money and maintain compliance in your business;<\/li>\n<li>We continue to monitor your legal matters even after the service is completed and update you when there are any changes in the Vietnamese legal system;<\/li>\n<li>Our system of forms and processes related to labor and personnel is continuously built and updated and will be provided as soon as the customer requests it;<\/li>\n<li>We have a thorough understanding of Vietnam&#8217;s legal regulations, and grasp the psychology of employees, employers, and working methods at competent authorities;<\/li>\n<li>CFT&#8217;s team of lawyers and experts has many years of experience in the field of labor and enterprises, as well as human resources and financial advisory.<\/li>\n<li>Strict information security procedures throughout the service performance and even after the service is completed.<\/li>\n<\/ul>\n<\/div>\n<p><strong style=\"color: #a32411;\">You can refer for more information:<\/strong><\/p>\n<ul>\n<li><a href=\"https:\/\/democft.az9s.com\/en\/responsibilities-of-enterprises-when-employing-foreign-workers\/\">Responsibilities of Enterprises when employing Foreign Workers<\/a><\/li>\n<li><a href=\"https:\/\/democft.az9s.com\/en\/is-it-mandatory-for-enterprises-to-appoint-personal-data-protection-personnel\/\">Is it Mandatory for Enterprises to Appoint Personal Data Protection Personnel?<\/a><\/li>\n<li><a href=\"https:\/\/democft.az9s.com\/en\/when-can-an-employer-temporarily-suspend-an-employee-from-work\/\">When Can an Employer Temporarily Suspend an Employee from Work?<\/a><\/li>\n<li><a href=\"https:\/\/democft.az9s.com\/en\/applying-the-force-majeure-clause-to-exempt-liability-under-the-contract\/\">Applying the force majeure clause to exempt liability under the contract<\/a><\/li>\n<li><a href=\"https:\/\/democft.az9s.com\/en\/conditions-for-granting-a-license-for-establishment-of-a-representative-office-of-foreign-traders-in-vietnam\/\">Conditions for Granting a License for Establishment of a Representative Office of Foreign Traders in Vietnam<\/a><\/li>\n<li><a href=\"https:\/\/democft.az9s.com\/en\/closure-of-a-representative-office-of-a-foreign-trader-in-vietnam\/\">Closure of a Representative Office of a Foreign Trader in Vietnam<\/a><\/li>\n<li><a href=\"https:\/\/democft.az9s.com\/en\/new-regulations-on-foreign-e-commerce-platforms-operating-in-vietnam\/\">New regulations on foreign e-commerce platforms operating in Vietnam<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Author: CDLAF Law Firm (Strategic legal partner of CFT) In the context of the Law on Personal Data Protection 2025 and Decree No. 356\/2025\/ND-CP, tightening the requirements for the collection, use, and transfer of personal data, advertising and media enterprises are becoming one of the sectors most directly affected. From running advertisements and multi-platform marketing&#8230;<\/p>\n","protected":false},"author":2,"featured_media":13371,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[64],"tags":[],"class_list":["post-13370","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-articles"],"acf":[],"_links":{"self":[{"href":"https:\/\/democft.az9s.com\/en\/wp-json\/wp\/v2\/posts\/13370","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/democft.az9s.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/democft.az9s.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/democft.az9s.com\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/democft.az9s.com\/en\/wp-json\/wp\/v2\/comments?post=13370"}],"version-history":[{"count":3,"href":"https:\/\/democft.az9s.com\/en\/wp-json\/wp\/v2\/posts\/13370\/revisions"}],"predecessor-version":[{"id":13374,"href":"https:\/\/democft.az9s.com\/en\/wp-json\/wp\/v2\/posts\/13370\/revisions\/13374"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/democft.az9s.com\/en\/wp-json\/wp\/v2\/media\/13371"}],"wp:attachment":[{"href":"https:\/\/democft.az9s.com\/en\/wp-json\/wp\/v2\/media?parent=13370"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/democft.az9s.com\/en\/wp-json\/wp\/v2\/categories?post=13370"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/democft.az9s.com\/en\/wp-json\/wp\/v2\/tags?post=13370"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}