SSO, NDA, and DPA: three layers of security that do not replace each other
Many businesses stop at the NDA and think it is sufficient, while the partner may be processing personal data without any legal constraints.
These three layers serve three different purposes. SSO (single sign-on) controls who can access the system. NDA (non-disclosure agreement) binds parties to keep strategic information confidential. DPA (data processing agreement) specifies what the partner can do with personal data and how to protect it. All three should be finalized at the contract signing stage, not patched later. Specifically for the DPA, when the partner accesses personal data of customers or end users, legal review or a lawyer's oversight is necessary, as the legal obligations extend beyond the scope of brand design or operations.
- Partners access users' personal data.
- businesses with a centralized login system (SSO)
- You only share strategic documents and unpublished assets.
- copying DPA templates from the internet without legal oversight
An external partner can be a design studio, content media company, or technical contractor. When they begin to access the system and documents of the business, you need three separate layers of control. Each layer protects something different. Mixing or omitting a layer leaves a gap that can only be detected after an incident occurs.
Three layers do not replace each other
The profession often distinguishes the three layers as follows:
- SSO (Single Sign-On): Controls who can access the system, how far they can go, and how to revoke access when they leave the project. SSO connects to the enterprise's centralized login system, assigns permissions based on roles, and logs who accessed what.
- NDA (Non-Disclosure Agreement): a legal obligation to keep strategic information, unpublished assets, and sensitive content confidential. The NDA covers both direct personnel and subcontractors who have access to the information.
- DPA (data processing agreement): specifies what the partner can do with personal data, where the data is stored, and how it is protected. DPA also stipulates when data must be deleted or returned, while clearly defining who is the data controller and who is the data processor.
NDA protects confidential information in a broad sense: strategy, plans, unreleased assets. DPA covers a narrower but stricter scope: personal data of real individuals, customers, end users, and employees. If the partner only views the design and brand positioning documents, the NDA is usually sufficient. If the partner accesses CRM (customer relationship management), email lists, or any data linked to real individuals, a DPA is required; the NDA cannot substitute for it.
When each layer becomes necessary
- SSO: A priority when the enterprise already has a centralized login system and multiple users or partners accessing resources. It is not necessary from the start if the scale is small, but there must be a manual revocation mechanism in place.
- NDA: is usually needed when sharing strategic documents, brand briefs, or unreleased product plans. It should be signed before sharing any sensitive information, not afterward.
- DPA: is needed as soon as an external partner accesses personal data. In Vietnam, the Law on Personal Data Protection 91/2025 and Decree 356/2025 impose obligations on the data controller and the data processor; a lawyer should compare this with each specific contract. According to GDPR Article 28 (referencing foreign law), the processor may only act according to written instructions and must commit to confidentiality, not subcontracting without the controller's consent.
The data processing party may only process personal data according to the documented instructions of the controlling party, unless otherwise required by law.
GDPR Article 28 (reference)
Common errors to avoid
- Stopping at the NDA, ignoring the DPA: this is the most common mistake. The NDA does not specify who can do what with personal data, nor does it mention the deletion or return of data when the work is completed.
- No revocation of access when personnel leave: Access rights remaining active after someone departs is a real risk, not just theoretical. SSO helps with centralized revocation; if SSO is not yet available, a clear manual process is needed.
- Using a downloaded DPA template without legal review or a lawyer: templates found online may not align with the applicable laws in Vietnam or may lack provisions suitable for the actual contract. An incorrect DPA can create a false sense of security.
- No clear regulations on data deletion and return: when the contract ends, personal data needs to be deleted or returned. If not stated in the DPA, there is no basis for a request.
Principle of least privilege
When establishing access control, the principle to follow is the least privilege: each person should only see and access what is necessary for their role, no more. SSO is a tool to enforce this principle at the system level. NDA and DPA enforce it at the legal level. Both need to run in parallel; neither can replace the other.
Obligations regarding personal data have legal consequences that extend beyond the scope of brand design or operations, so this part needs legal review or the company's lawyer to check before signing. Being thorough from the start incurs lower costs; patching after an incident is much more expensive.
Decision checklist
Topic: How to handle SSO, NDA, and DPA security requirements. Sinh Vũ guide, sinhvu.com
Tick each item that applies or that you can already answer, then print or save as PDF to take with you.
If you have marked most of the signs above, this is the time to discuss in more detail. Sinh Vũ can help you review and propose a direction.
This article provides general information according to the documents in effect as of October 6, 2026. This is not legal advice and does not substitute for a lawyer's opinion for your specific case. Rights and obligations between Sinh Vũ and clients arise only according to the signed contract.
How Sinh Vũ handles your data: see Privacy policy.
References
GDPR Article 28 (Data Processing Agreement); Termly, What Is a Data Processing Agreement; Hyperstart, DPA Complete Guide; Secure Privacy, DPAs for SaaS; Bynder, What is Digital Asset Management. Sinh Vũ's practical experience in establishing a brand portal with delegation.
Frequently asked questions
Is a DPA needed after signing the NDA?
Yes, if your partner processes personal data, such as customer lists, user information, or behavioral data. NDA protects confidential information in a broad sense but does not specify who can do what with personal data. NDA also does not clarify where the data is stored and how it is deleted at the end. DPA fills that gap. The two documents complement each other, not replace each other.
How to handle authorization for a company without an SSO system?
If you do not have SSO, you need to manage separate accounts for each tool and manually track changes when personnel change. The risk lies in forgetting to revoke access when someone leaves, which is the most common gap. A temporary solution is to create an access list by name, review it periodically, and revoke access immediately when there are personnel changes. As the scale grows, investing in SSO will save significant administrative effort.
Can DPA samples from the web be used?
Templates found online can be used as references to understand the structure, but should not be used directly without legal review or a lawyer's oversight. The applicable laws vary by country and type of data; in Vietnam, it is necessary to compare with the Law on Personal Data Protection 91/2025 and Decree 356/2025. Provisions regarding subcontracting and data deletion need to align with the actual contract of yours.
This article is for reference. The scope, pricing, and specific commitments of Sinh Vũ are detailed in the proposal and signed contract.