A customer record is entered into the software, exported to Excel for a report, emailed to a partner and then saved on a personal computer. When the source needs to be traced or a correction request handled, the business has to ask several departments to piece the full picture together.
The problem lies in the gap between governance documents and how staff actually work. The Personal Data Protection Law No. 91/2025/QH15 takes effect on 1 January 2026, making a review of the data governance foundation something businesses need to pay attention to. [1]
The hidden cost of not seeing your data clearly
Without a responsible owner and a consistent inventory, every request for information becomes a search. Business teams wait for IT; vendors are asked but the scope is unclear; old and new documents exist side by side.
Time spent in meetings, discussions and reconciliation should be counted as a management cost. Buying another tool may not solve the problem if the business has not yet defined which data needs managing and who keeps it up to date.
Start with one specific process
Metatek suggests choosing one process with clear data and a coordinating contact, such as recruitment or handling customer requests.
For each step, record: the type of data, purpose of use, where it is stored, who can access it, who receives it, and how it is handled when no longer needed.
This is a suggested operational survey to get started, not a checklist that replaces all legal requirements. The NIST Privacy Framework also approaches risk across the data processing lifecycle and the context of each organisation. [2]
Don't overlook copies outside the software
During the survey, also ask about exporting files, sending emails, sharing folders or passing records to external parties. Operational staff often know these steps better than the technical diagrams do.
A useful outcome is an inventory good enough to show what needs fixing: revoking unused access, agreeing on storage locations, assigning who updates records, or adding a check before sharing.
Measure by the ability to get work done
The business can pick a few scenarios to test:
- How long does it take to locate where a record is stored?
- Was the request routed to the right contact?
- When systems change, is the data inventory updated?
Without baseline data, measure first before setting improvement targets.
The aim is to help teams coordinate on a firmer basis, rely less on individual memory, and build a foundation for the next governance steps.
How does Metatek support you?
Metatek helps survey processes, inventory and describe data flows, clarify responsibilities and propose implementation priorities. Matters requiring specialist legal advice are coordinated with suitable firms or experts within the agreed scope.
References
[1] National Assembly — Personal Data Protection Law No. 91/2025/QH15: https://chinhphu.vn/?docid=214590&pageid=27160
[2] NIST — Getting Started with the Privacy Framework: https://www.nist.gov/privacy-framework/getting-started-0
