Subjects required to conduct personal data compliance audits In accordance with regulations on personal data protection, agencies, organizations, and individuals that engage in the collection, storage, use, sharing, or processing of personal data are responsible for ensuring that such processing is carried out for proper purposes, based on lawful grounds, and in compliance with personal data protection obligations.
According to the law on personal data protection, agencies, organizations, and individuals that collect, store, use, share, or process personal data are responsible for ensuring that the data is processed for the correct purpose, on the correct legal basis, and in accordance with the obligation to protect personal data.
In practice, many enterprises:
- Have implemented personal data processing activities but have not fully reviewed their level of compliance;
- Have internal policies and procedures in place, but these are not synchronized across legal, operational, and system aspects;
- Have carried out certain compliance measures but lack periodic inspections and reviews to assess the alignment between the data held, the enterprise’s scale of operations, and the applicable legal regulations;
- Have not conducted periodic reviews of agreements and documents with employees, customers, and partners to clearly determine each party’s responsibilities in complying with personal data protection regulations.
CDLAF’s Personal Data Compliance Audit Service is designed to assist enterprises in comprehensively assessing their level of compliance with personal data protection laws, promptly identifying potential risks, and developing a remediation roadmap that is suitable for their actual operational model.
| IMPLEMENTATION CONTENT | SERVICE DETAILS AT CDLAF |
| Comprehensive review of data processing activities | Lawyers and data protection experts work directly with relevant departments (IT, HR, Marketing, Sales, etc.) to identify the scope, purposes, and methods of personal data processing within enterprises. |
| Data Mapping | We assist in clarifying contact information and the roles of the Data Controller, Data Processor, and Third Parties in accordance with applicable regulations. |
| Legal identification of data-related parties | Our Lawyers identify detailed information regarding data exporters, data importers, data processors, and third parties involved in cross-border data transfers. |
| Data classification and legality assessment | Clearly distinguish between basic/sensitive personal data; review and assess the legal grounds for each data processing activity in accordance with the Personal Data Protection Law and Decree 256. |
| Data Flow Diagramming | Our data protection experts describe the purposes of processing, types of data, and prepare data flow diagrams; system diagrams and functional descriptions of systems used to store and process personal data after receiving personal data transferred across borders. |
| Audit of internal policies and documentation | Review internal policies, regulations, procedures, and templates related to personal data protection (including privacy policies, data retention policies, data breach response procedures, etc.). |
| Audit of contracts and agreements | Review personal data–related clauses in contracts and agreements with employees, clients, partners, suppliers, and data processors. |
| Assessment of data protection measures | Assess organizational, governance, and technical measures to ensure the security of personal data in accordance with legal requirements. |
| Risk assessment and compliance level evaluation | Identify compliance gaps, the level of legal risk, and potential consequences that may arise in the event of a personal data breach. |
| Data protection compliance audit report | Prepare a detailed audit report specifying the level of compliance, non-conformities, and recommended remedial measures. |
| Proposed remediation roadmap | Develop a roadmap for adjustment and improvement of the personal data compliance framework in line with the scale and operations of enterprises. |
WHY CHOOSE PERSONAL DATA SERVICES AT CDLAF?
The difference of CDLAF lies in our mission: “Understand to Protect”. We do not just provide legal advice; we provide implementation solutions from the mindset of an In-house Counsel:
- Multidisciplinary Understanding: CDLAF provides internal consulting for many enterprises across diverse fields such as manufacturing, e-commerce, labor sub-leasing, healthcare, education… therefore, we deeply understand the specific data issues of each business.
- Insight into Cross-departmental Operations: We understand the data characteristics of each department, from the technical infrastructure of IT and Marketing to the security of sensitive records in Human Resources (HR), accounting, etc
- Practical Experience: By performing various personal data services such as consulting, building internal data governance documents, and conducting impact assessment and cross-border data transfer procedures, our experts have diverse experience and in-depth knowledge of domestic personal data laws and the provisions of the EU General Data Protection Regulation (GDPR).
CDLAF LAW FIRM – Protecting data with insight from within
