Data protection due diligence in Vietnam checks whether the target company collects, uses, shares and sends abroad personal data in line with the Law on Personal Data Protection 91/2025/QH15 (the PDPL) and its two decrees, before the buyer signs. For a foreign acquirer the question is practical: which fines, remedial orders and missing filings come with the company, and what they do to the value of a customer base or an HR system the buyer is paying for. Vietnamese law does not require a buyer to run this review. It is market practice, and it usually sits inside the wider legal due diligence of the deal.
Two features of the Vietnamese regime make the exercise different from a GDPR review. First, the core obligations are filings with the authority, not internal records: an impact assessment dossier (DPIA) and, where data leaves Vietnam, a cross-border transfer impact assessment dossier, each lodged with the A05 Department of the Ministry of Public Security within 60 days. Second, the remedial orders can bite harder than the fines, because the authority can order data deleted or processing stopped. This guide reflects the texts in force on 13 October 2026.
Share deal or merger: where the exposure sits in data protection due diligence in Vietnam#
The deal structure decides who carries a past breach.
Share or capital purchase. The target stays the controller of its data and stays the party that is fined. Nothing moves to the buyer by law; the buyer bears the risk through the value of its stake, and through any remedial order that interrupts the business. The usual route for a foreign investor is covered in foreign investor buying shares in Vietnam and, for an LLC, transfer of capital contribution in Vietnam.
Merger. On registration of the merger, the surviving company takes on the rights, obligations and liabilities of the merged company (Article 201(2)(c) of the Law on Enterprises 59/2020/QH14). Personal data may be transferred so that processing continues after a merger or consolidation (Article 17(1)(c) PDPL), but the parties must sign a transfer agreement stating the purpose, the data subjects and data categories, the retention period, the legal basis and each side's responsibilities (Article 7(1) of Decree 356/2025/ND-CP). Filed DPIA and transfer dossiers must then be updated within 10 days of the reorganisation (Article 22(2)(a) PDPL; Article 20(2)(a) Decree 356).
A share deal does not, on its own, count as a reorganisation, so it does not trigger the 10-day update. It does change things the dossiers record: a new data protection service provider must be reported within 10 days (Article 20(2)(b) Decree 356), and a new controller, processor or third party is picked up in the 6-monthly update (Article 20(1)(b)).
PDPL exposures that data protection due diligence in Vietnam should price#
Fines under Decree 330/2026/ND-CP are stated for organisations; an individual pays half (Article 7(1)). The statutory ceilings are 10 times the proceeds for buying or selling personal data, 5% of the previous year's revenue for cross-border transfer breaches and VND 3 billion for everything else (Article 8(3) to (5) PDPL; Article 7(4) Decree 330). The overview is in PDPL penalties. In a deal, these are the findings that most often change the price or the timetable:
| Finding | Provision breached | Fine on the target | Remedial order that matters to the buyer |
|---|---|---|---|
| Marketing or lead lists bought from brokers | Article 7(6) PDPL | 2 to 10 times the proceeds (Art. 53(1)); where there are no proceeds, VND 70 million to VND 3 billion by number of data subjects (Art. 53(3)) | Delete all purchased data on every system, hand over the proceeds, notify every affected data subject (Art. 53(5)) |
| Consent missing or set as the default; consent log not kept | Article 9 PDPL | VND 30 to 50 million (Art. 43(1)(a), (c), (g)) | Where there was no valid consent or consent was pre-ticked: irrecoverable deletion of the data (Art. 43(4)(a)) |
| No DPIA dossier prepared or kept | Article 21 PDPL | VND 20 to 30 million (Art. 55(1)(a)) | Processing stopped until the dossier is filed and confirmed (Art. 55(3)(b)) |
| Data sent abroad without a transfer dossier | Article 20 PDPL | VND 30 to 50 million (Art. 56(1)) | Transfers stopped until the dossier is complete and confirmed (Art. 56(6)(b)) |
| Same, and it led to a leak of 10,000 or more Vietnamese citizens' data | Article 20 PDPL | 1% to 5% of the prior financial year's revenue in Vietnam (Art. 56(3)) | Cross-border transfers suspended for 6 to 12 months (Art. 56(5)(b)) |
| Serious breach reported to A05 later than 72 hours | Article 23(1) PDPL | VND 40 to 60 million (Art. 54(3)) | Complete the notification and evidence it (Art. 54(5)(a)) |
| No formal appointment of a data protection officer or unit | Article 33(2) PDPL | VND 20 to 30 million (Art. 57(2)(c)) | None listed for this breach, but the appointment is still required |
Read the table from the right, as data protection due diligence in Vietnam is mostly about remedial orders. A VND 50 million fine is noise in most deals; deleting the customer database the valuation rests on, or a 6-month stop on transfers to the group's regional CRM, is not. Where the proceeds of a breach have to be computed, Decree 330 uses gross revenue from the business that used the unlawfully processed data, with no deduction for costs (Article 6(2)(b)).
Three timing rules shape the risk window:
- Limitation. The limitation period for PDPL administrative fines is 1 year (Article 3(1) Decree 330). For a continuing breach it runs from the day the obligation is performed (Article 3(2)). On that reading, a dossier that was never filed remains open to a fine until it is filed, however old the breach.
- Old conduct. Breaches that occurred before Decree 330 took effect on 19 August 2026 are judged under the penalty rules in force at the time, unless Decree 330 is more lenient (Article 81(1)).
- Beyond fines. The PDPL keeps criminal liability and civil damages alongside administrative fines (Article 8(1)). The limitation period above does not cap those; see data breach liability in Vietnam for how those tracks fall on the entity and on individuals.
What to ask for in data protection due diligence in Vietnam#
A request list for privacy due diligence on a Vietnamese target should test the filings first, then the facts behind them.
- DPIA dossier and the A05 receipt. Every controller must file within 60 days of first processing (Article 21(1) PDPL). A dossier filed under Decree 13/2023 and received by A05 before 1 January 2026 remains valid, with later updates under the new law (Article 39(2) PDPL).
- Cross-border transfer dossier, if anything leaves Vietnam: group email, an overseas CRM, a regional HR system, offshore support teams. See cross-border data transfer in Vietnam.
- Update history. Copies of the 6-monthly and 10-day updates. A dossier filed in 2024 that still lists the old vendors is a finding.
- Small-business position, if the target relies on it. Small businesses and start-ups may opt out of the DPIA and DPO duties for 5 years from 1 January 2026, and micro businesses are exempt (Article 38(2) and (3) PDPL). The relief is lost by those that provide data processing services, directly process sensitive data, or reach 100,000 data subjects (Article 41 Decree 356). It never covered the cross-border dossier.
- Data protection officer: the appointment decision or the service contract with an outsourced provider (Article 33(2) PDPL).
- Privacy notices and consent records. Forms on the website and app, matched against the consent logs. Failing to record and keep a consent log, or being unable to prove consent when the authority asks, is itself a breach (Article 43(1)(g) Decree 330). Consents validly obtained under Decree 13 before 2026 do not need to be collected again (Article 39(1) PDPL).
- Vendor contracts. A processor may receive data only after a contract with the controller is in place (Article 37(2)(a) PDPL); see data processing agreements. Ask where each vendor hosts the data.
- Where marketing data came from. Invoices or contracts for lead lists, telesales data and "partner" databases. A purchase is the single most expensive finding (see the table).
- Incident register. Breaches, the 72-hour notices and the incident minutes the controller must prepare (Article 23(2) PDPL).
- Employee monitoring. CCTV, device tracking and screen monitoring are lawful only where employees know about them (Article 25(3) PDPL); see employee personal data.
Red flags that justify a deeper look: a sales team that "buys data", a dossier last updated before the target changed vendors, an offshore IT or call-centre arrangement with no transfer dossier, health or biometric data (eKYC, fingerprint attendance) handled as ordinary data, and a target that says it is "too small" for the PDPL but processes the data of hundreds of thousands of customers.
Personal data in the virtual data room#
The data room is itself processing, and it is the part of privacy due diligence that buyers' counsel most often overlook.
When the target uploads customer or employee files so that the buyer can read them, it provides personal data to another organisation. Outside the cases set by law, that needs the data subjects' consent (Article 15(2)(b) PDPL), which the target will almost never have for this purpose. The merger exception in Article 17(1)(c) covers data transferred so that processing continues after a merger. It does not, on its plain wording, cover a prospective buyer reviewing files before signing.
The data room also creates a cross-border problem a foreign buyer should not ignore. Storing personal data collected in Vietnam on the cloud service of a provider located abroad is a cross-border transfer (Article 17(1)(a) Decree 356), and so is handing it to an organisation abroad (Article 20(1)(b) PDPL). Most commercial virtual data room platforms are run by foreign providers, and the buyer's deal team often sits in Singapore, Seoul or Tokyo. Uploading identifiable personal data could therefore oblige the target to prepare and file a cross-border transfer dossier within 60 days (Article 20(2) PDPL).
The practical answer is to keep identifiable data out of the virtual data room:
- Upload aggregated figures (headcount by grade, customer counts by segment, consent rates) and template contracts rather than individual records. Data that has been de-identified is no longer personal data (Article 2(1) PDPL).
- Where the buyer must see real records, for example key employment contracts or a sample of consent logs, show a small redacted sample in a clean-room session in Vietnam rather than uploading the file.
- Set read-only access, block downloads and printing, watermark each viewer, and sign the NDA and a short data protection undertaking before access is granted.
Data protection warranties and other SPA protection#
Findings belong in the same bucket as tax and labour findings: they adjust the price, become conditions or are covered by specific protection.
- Data protection warranties: the target has filed its DPIA and, where relevant, its cross-border transfer dossier and has kept both updated; it has not bought or sold personal data; it holds valid consent or another legal basis for each processing purpose; it has had no breach requiring notice that was not notified; it has received no inspection, request or penalty from A05.
- Specific indemnity for fines and remedial costs arising from pre-closing conduct, priced on the remedial order rather than the fine. In a share deal the fine falls on the target, so the indemnity should cover the buyer's loss through the target, not only the buyer's direct loss.
- Conditions precedent for serious gaps: file the missing dossiers, delete purchased lists and obtain the vendor's confirmation, appoint a data protection officer.
- Survival period long enough for the risk. A breach that continues until a filing is made does not age out after 1 year (Article 3(2) Decree 330), so a general 12-month warranty period may expire before the exposure does.
For a foreign buyer, warranties do not replace data protection due diligence in Vietnam itself. A target that has never filed a dossier cannot fix that by giving a warranty, and the fix (preparing the dossier, cleaning the data) takes weeks, not days.
Post-closing integration: moving the target's data into group systems#
Most PDPL work in an acquisition happens after closing, when the group connects the target to its CRM, ERP, HRIS and security tools. Post-closing integration should be planned during data protection due diligence in Vietnam, not after it, because the filings it triggers have their own deadlines.
Group systems abroad are a cross-border transfer. Moving customer data to a CRM hosted outside Vietnam, or giving the regional team access to it, falls under Article 20(1) PDPL. The target must prepare a cross-border transfer dossier and file it within 60 days from the first transfer, or update its existing dossier for the new recipient at the next 6-monthly update (Article 20(2) PDPL; Article 20(1)(b) Decree 356). The conditions and the dossier are explained in cross-border data transfer in Vietnam; the domestic dossier in what a DPIA is.
HR data has two exemptions. No transfer dossier is needed where an organisation stores its own employees' personal data on a cloud service (Article 20(6)(b) PDPL), or where data moves abroad for cross-border personnel management under internal labour rules and collective agreements (Article 17(3)(d) Decree 356). Customer data has no equivalent.
The parent is a separate company. Sharing data between departments of one organisation is a recognised ground for transfer (Article 17(1)(b) PDPL), but the parent and the Vietnamese subsidiary are different legal entities. Our reading is that intra-group sharing needs another ground. If the parent processes on the subsidiary's instructions, that is a transfer to a processor, which needs a processing contract (Article 17(1)(d) and Article 37(2)(a) PDPL). If the parent uses the data for its own purposes, the parent is a controller and the transfer needs consent or another legal basis. Either way a transfer agreement under Article 7(1) of Decree 356 is required.
After a merger, update both dossiers within 10 days and record the transfer agreement between the merging companies (Article 20(2)(a) and Article 7(1) Decree 356).
LexData runs data protection due diligence in Vietnam as part of its legal due diligence service and its M&A advisory, from the request list to the SPA protection and the post-closing dossiers. For the deal process itself, see M&A in Vietnam.
