Personal Data Protection Law No. 91/2025/QH15 requires data controllers and processors to designate a personal data protection unit and personnel proportionate to the scale and sensitivity of their processing, and Decree 356/2025/ND-CP guides the capability conditions and responsibilities of that personnel. The law writes no clause banning outsourcing of the data protection function, but neither does it declare an outsourced DPO service automatically satisfies the designation duty; before the regulator the duty remains the business’s, so an outsourcing model only stands where the business still designates an accountable internal focal point and the service provider acts as expert capability behind that focal point.
The duty to designate data protection personnel and the outsourcing gap
An outsourced DPO does three things well: maintaining the living compliance file of data map, impact assessments and processing logs; coordinating responses to incidents and data subject rights requests within statutory deadlines; and training and periodically reminding data-handling departments. But three things outsourcing cannot replace as internal decisions: accepting compliance risk on management’s behalf, signing undertakings to the regulator in the business’s name, and business decisions on whether to process a data type at all. The service contract must draw this line expressly, or the business discovers on incident day that the provider only ever took an advisory role while decisions and liability remained entirely its own.
What an outsourced DPO can and cannot do
A proper DPOaaS contract locks six clauses: the systems and processing activities covered with an exclusion list; the named individuals supplied with a customer-approval condition on substitutions; committed response times for data incidents and data subject requests, measured in hours rather than vague business days; confidentiality and the provider’s own data-processing role when accessing compliance files containing sensitive data; the business’s right to receive back the full compliance file in usable format on exit, avoiding lock-in; and a conflicts clause, because an outsourced DPO simultaneously serving a competitor or selling the business its compliance tooling is a conflict that must be declared.
Clauses a DPO-as-a-service contract must lock
For small and mid-size businesses the hybrid model is usually the right answer: one internal staff member formally designated as the data protection focal point, trained and backed by the outsourced DPO on a fixed-hours package, with the whole compliance file owned by the business. This model satisfies the designation duty, keeps compliance knowledge inside the organisation when providers change, and costs far less than hiring a full-time data protection specialist in a scarce labour market.
Frequently Asked Questions
May a small company outsource its data protection officer?
The law does not ban buying in expert capability, but the business must still designate an accountable internal data protection focal point under Law 91/2025/QH15; the safe model is a designated internal person backed by an outsourced DPO’s expertise.
What clauses does an outsourced DPO contract need?
Coverage scope and exclusions, named assigned personnel with substitution approval, incident response times in hours, confidentiality over compliance files, full file hand-back on exit, and provider conflict-of-interest declarations.
Who is liable if the outsourced DPO makes a mistake?
Before the regulator the business still answers for its own data protection duties; the outsourced DPO is liable contractually to the business, including proven damages where the error falls within the committed service scope.
This article has been quality-reviewed by the FLAW AI Legal Council