In the context of businesses increasingly utilizing digital platforms, the demand for remote legal consultation is becoming more prevalent. Instead of meeting lawyers in person, many enterprises choose to send documents via email, communicate through online meetings, and receive written consultation results. This is particularly suitable for tasks such as contract reviews, drafting Data Processing Agreements (DPAs), conducting Data Protection Impact Assessments (DPIAs), or assessing risks related to personal data protection.
Can contracts, DPAs, and DPIAs be consulted 100% online? In principle, the answer is yes, provided that the business provides full information and documentation, and both parties establish a clear working process. However, the effectiveness of online consultation also depends on the nature of the dossier, the complexity of the transaction, confidentiality requirements, and whether in-person procedures are necessary.
The article below analyzes the cases where contracts, DPAs, and DPIAs can be consulted online, instances that require caution, and key considerations for businesses to work effectively with remote lawyers.
Legal Basis
- Law on Lawyers 2006, amended and supplemented in 2012;
- Civil Code 2015;
- Law on Electronic Transactions 2023;
- Decree No. 13/2023/ND-CP on personal data protection.
I. WHAT ARE CONTRACTS, DPAs, AND DPIAs?
1.1. What is a contract?
A contract is an agreement between parties to establish, change, or terminate rights and obligations. In business operations, contracts can include sale and purchase agreements, service contracts, labor contracts, business cooperation contracts, distribution agreements, agency contracts, or outsourcing service agreements.
Contract consultation usually includes reviewing clauses, assessing risks, proposing revisions, drafting new contracts, or advising on negotiation strategies. Since most contract content is expressed in writing, online contract consultation can generally be conducted smoothly through emails, online meetings, and electronic documents.
1.2. What is a DPA?
DPA stands for Data Processing Agreement. This is a document used when one party entrusts another party with processing personal data during service provision, system operation, customer management, customer care, or user information processing.
For example, a business may hire a CRM software provider, an email marketing platform, a data storage service, or a system operation partner. In such cases, the DPA helps clearly define the roles of the parties, the scope of data processing, processing purposes, security measures, retention periods, liabilities in case of incidents, and obligations to support data subjects.
Since DPAs are primarily legal and operational documents, online DPA consultation can be carried out effectively if the business provides sufficient information regarding data flows, list of partners, and personal data processing procedures.
1.3. What is a DPIA?
DPIA stands for Data Protection Impact Assessment. According to Decree 13/2023/ND-CP, businesses are responsible for formulating and maintaining data processing impact assessment dossiers in cases where personal data processing activities are conducted as prescribed by law.
A DPIA is not just a simple form. Its content typically requires an analysis of the types of data collected, the purposes of processing, the scope of processing, the entities with access to the data, retention periods, risks to data subjects, and risk mitigation measures.
Therefore, online DPIA consultation can still be performed, but it generally requires closer coordination from the business compared to a standard contract review.
II. CAN CONTRACTS, DPAs, AND DPIAs BE CONSULTED 100% ONLINE?
2.1. In principle, 100% online consultation is possible
Businesses can consult on contracts, DPAs, and DPIAs 100% online if the entire working process is conducted via emails, online meeting platforms, electronic documents, and electronic signatures. The Law on Electronic Transactions 2023 has recognized the validity of electronic transactions, e-contracts, e-signatures, and data messages in many cases.
For contracts, a lawyer can receive drafts, mark clauses that need revision, explain risks, and return the finalized version. For DPAs, a lawyer can discuss data flows, roles of the parties, and security responsibilities with the business. For DPIAs, a lawyer can use questionnaires, information collection forms, and online interviews to complete the assessment content.
Therefore, if the business’s goal is to consult, review, draft, or finalize internal documents, conducting contract, DPA, and DPIA consultation online is completely feasible.
2.2. When is online contract consultation appropriate?
Online contract consultation is appropriate when the business already has a draft contract, clear transaction information, and needs a lawyer to review legal risks. For example, the business may need to check terms regarding payment, penalties for violations, damages, contract termination, information confidentiality, limitation of liability, or dispute resolution.
In these cases, the lawyer does not necessarily need to meet the business in person. Documents can be sent via email or secure storage systems. Afterward, the lawyer can respond with feedback, revisions, or an online meeting to explain key points.
However, if the contract has a large value, involves multiple parties, or relates to critical assets, the business should hold an in-depth discussion to align on negotiation strategies. This discussion can still be conducted online if the parties are fully prepared.
2.3. When is online DPA consultation appropriate?
Online DPA consultation is suitable for businesses operating websites, applications, customer management software, e-commerce, or utilizing service providers that process personal data.
To consult on a DPA online effectively, the business needs to provide information such as: the types of personal data processed, processing purposes, the party determining the processing purposes, the party processing data on behalf, whether data is shared with third parties, whether data is transferred abroad, and the security measures the business is applying.
If this information is fully provided, online DPA consultation can be highly effective. A DPA is a document that can be drafted, reviewed, and negotiated through electronic means, so in most cases, in-person meetings are not mandatory.
2.4. When is online DPIA consultation appropriate?
Online DPIA consultation can be executed if the business clearly describes its data processing activities. Unlike contracts or DPAs, a DPIA requires more factual information about systems, processes, and how the business handles data.
The business needs to clarify where personal data is collected, who has access, how long data is stored, whether it is shared with partners, whether data is transferred abroad, whether sensitive data is processed, and what the response procedure is when an incident occurs.
If the business already possesses data flow diagrams, security policies, internal procedures, and a list of vendors, the online DPIA consultation can proceed smoothly. Conversely, if the business does not yet thoroughly understand its own system, the lawyer may need to organize multiple online interview sessions with the legal, technology, human resources, marketing, or operations departments.
III. WHEN SHOULD 100% ONLINE CONSULTATION BE AVOIDED?
3.1. When the dossier carries high risks or information is unclear
Not all cases should be handled entirely online. If the dossier carries high risks, involves multiple stakeholders, or if the business cannot provide adequate information, relying solely on online consultation may make it difficult for the lawyer to accurately evaluate the nature of the matter.
For example, if the business is currently in a contract dispute, facing a partner’s complaint regarding personal data, or at risk of being inspected for personal data protection. In these scenarios, the business can still initiate the process with online consultation, but should prepare the dossier carefully and may need additional intensive working sessions.
3.2. When verification of documents, signatures, or authority is required
For certain critical transactions, a lawyer may need to inspect original documents, verify signing authority, review power of attorney, or check the legal status of the enterprise, assets, or partners. In such cases, while online consultation can support the majority of the content, businesses should not view online methods as a total substitute for necessary legal checks.
In particular, if the contract requires notarization, certification, registration, or submission to state authorities, the business needs to check the specific requirements of each procedure. The consultation itself can be online, but the execution, submission, or legal confirmation steps may have to follow specific statutory regulations.
IV. KEY CONSIDERATIONS FOR EFFECTIVE ONLINE CONTRACT, DPA, AND DPIA CONSULTATION
4.1. Prepare full documentation prior to consultation
Businesses should prepare draft contracts, appendices, corresponding emails, partner information, data processing procedures, privacy policies, vendor lists, and relevant documents. For DPAs and DPIAs, businesses should additionally prepare descriptions of data flows and data processing purposes.
The more complete the documentation is, the more time the lawyer saves on research, enabling them to provide more accurate advice.
4.2. Clearly define the scope of consultation
Before starting, the business needs to clearly identify what it wants to consult on: reviewing contracts, drafting a DPA, assessing a DPIA, checking personal data compliance, or building a complete set of legal documents.
If the scope is unclear, the online consultation process can easily become prolonged, leading to multiple revision rounds and making costs difficult to control. Conversely, when the scope is explicit, the lawyer can provide a clear work plan, timelines, and specific deliverables.
4.3. Document confidentiality during the online consultation process
Contracts, DPAs, and DPIAs can all contain sensitive information such as customer data, business secrets, internal policies, financial data, or technology system details. Therefore, businesses should use corporate emails, secure storage systems with access authorization, or document management platforms with controlled access.
Before initiating online contract, DPA, or DPIA consultation, the business should also agree on the person-in-charge, communication channels, document naming conventions, and access permissions. This ensures that the online consultation process is both convenient and secure.
V. FREQUENTLY ASKED QUESTIONS
5.1. Does online contract consultation have legal validity?
Yes. Online legal consultation is a form of providing legal services via electronic means. The validity and value of the advisory opinion depend on the content of the advice, the scope of work, and the agreement between the business and the consulting firm.
5.2. Is a hard copy signature mandatory for a DPA?
Not in all cases. If the parties meet the conditions for electronic contracts and electronic signatures in accordance with regulations, the DPA can be signed electronically. However, businesses should check internal requirements and their partners’ demands before applying this method.
5.3. Can a DPIA be done completely online?
Yes, it can, provided that the business provides sufficient information regarding data processing activities, systems, partners, and security measures. However, if data processing activities are complex or involve sensitive data, the business should have multiple in-depth discussion sessions to ensure the accuracy of the dossier.
CONCLUSION
Contracts, DPAs, and DPIAs can be consulted 100% online in many cases, especially when businesses need to review, draft, assess risks, or finalize legal documents. With the support of emails, online meetings, electronic documents, and electronic signatures, businesses can save time, reduce costs, and still receive appropriate legal advice.
However, for online contract, DPA, and DPIA consultation to be effective, businesses need to prepare documentation thoroughly, define the scope of work clearly, and ensure information security during exchanges. For complex dossiers, disputes, cases requiring original document verification, or procedures with state authorities, businesses should consider combining online consultation with in-person working steps when necessary.
