SSO, NDA, and DPA: three layers of security that do not replace each other

When an external partner, whether a design studio, content agency, or technical contractor, begins to access the company’s systems and documents, you need three layers of separate controls. Each layer protects something different. Mixing or omitting a layer leaves a gap that can only be discovered after an incident occurs.

Three layers do not replace each other

Sinh Vũ distinguishes three layers as follows:

• SSO (Single Sign-On): Controls who can access the system, how far they can go, and how to revoke access when they leave the project. SSO connects to the enterprise's centralized login system, assigns permissions based on roles, and logs who accessed what.
• NDA (Non-Disclosure Agreement): a legal obligation to keep strategic information, unpublished assets, and sensitive content confidential. The NDA covers both direct personnel and subcontractors who have access to the information.
• DPA (Data Processing Agreement): stipulates what the partner can do with personal data, where the data is stored, how it is protected, and when it must be deleted or returned. The DPA clearly defines who is the data controller and who is the processor.

When each layer becomes mandatory

• SSO: A priority when the enterprise already has a centralized login system and multiple users or partners accessing resources. It is not necessary from the start if the scale is small, but there must be a manual revocation mechanism in place.
• NDA: is almost always necessary when sharing strategic documents, brand briefs, or unpublished product plans. It should be signed before sharing any sensitive information, not afterward.
• DPA: mandatory as soon as an external partner touches personal data. According to GDPR Article 28, the processor may only act according to written instructions, must commit to confidentiality, and cannot subcontract without the controller's consent.

The data processing party may only process personal data according to the documented instructions of the controlling party, unless otherwise required by law.

GDPR Article 28

Common errors to avoid

• Stopping at NDA, overlooking DPA: this is the most common mistake. NDA does not specify who can do what with personal data, nor does it mention deleting or returning data when the work is done.
• No revocation of access when personnel leave: Access rights remaining active after someone departs is a real risk, not just theoretical. SSO helps with centralized revocation; if SSO is not yet available, a clear manual process is needed.
• Use downloaded DPA templates without legal review: Online templates may violate applicable laws in Vietnam or lack clauses appropriate for the actual contract. An incorrect DPA is more dangerous than having none, as it creates a false sense of security.
• No clear regulations on data deletion and return: When the contract ends, personal data must be deleted or returned. If not stated in the DPA, there is no basis for a request.

Sinh Vũ's viewpoint

Sinh Vũ handles these security requests during the setup phase, often associated with the brand portal that has role-based access. This is an area where Sinh Vũ does not make unilateral decisions on behalf of the client and always recommends that the company's legal team review before signing.

The simple reason: personal data constraints have legal consequences beyond the scope of design or brand operations. Being strict from the beginning incurs lower costs. Fixing issues after they occur is much more expensive and damaging to your reputation.

The principle Sinh Vũ uses when establishing delegation is minimum privilege: each person only sees and interacts with what is necessary for their role, no more. SSO is the tool that implements this principle at the system level. NDA and DPA are implemented at the legal level. Both need to run in parallel; neither can replace the other.