Vietnam PDPD 40-41: Responsibilities of the controlling and processing entity and the third party

What does 40-41 require?

An organization or individual that both decides the purposes and means and directly carries out the processing must fully implement the responsibilities of both the controller and the processor (40); a third party authorised to process personal data must fully implement the Decree's regulations on responsibility for processing personal data (41).