NDA in Vietnam: validity, penalties and how to draft one

What is an NDA in Vietnam? A non-disclosure agreement is a contract in which the receiving party promises to keep the disclosing party's information confidential and to use it only for a stated purpose. Companies sign one before negotiating a joint venture, buying a business, raising capital or hiring someone into a sensitive role.

The more useful legal question is what gives an NDA force, how far a penalty can go and which information it protects. This entry reflects the texts in force on 4 October 2026 and is written for both Vietnamese companies and foreign-invested enterprises.

What is an NDA in Vietnam, and is it enforceable?

Vietnam has no separate statute on NDAs. An NDA is a civil contract: an agreement between parties to establish civil rights and obligations (Article 385 of Civil Code 91/2015/QH13). The parties may set the content, including liability for breach and the dispute resolution method (Clause 1 and Points dd, e and g, Clause 2, Article 398; "Point dd" is the Vietnamese letter d with a stroke). Any undertaking that does not breach a prohibition of law or social ethics is binding on the parties (Clause 2, Article 3). Validity also requires the general conditions for a civil transaction: capacity, free consent, and a purpose and content that breach no prohibition (Clause 1, Article 117). Consideration is not on that list, which in LexData's reading differs from common law; the law also does not require an NDA to be notarised or registered, and a data message counts as writing (Article 119).

The law does not classify NDAs; in practice there are three forms: one-way (one party discloses, for example technology shown to a counterparty for evaluation), mutual (both parties exchange information, as in M&A or a joint venture) and multi-party (an investor group, a consortium, or one with advisers). A mutual NDA should have balanced duties and remedies; a multi-party NDA should say who discloses to whom.

Three limits to keep in mind:

• A clause that breaches the law is void (Article 123). Include a carve-out for disclosure required by law or by a competent authority, because a promise to conceal what the law compels you to provide cannot prevail over the law.
• An NDA binds only its signatories (Clause 2, Article 401). Employees, advisers and investors of the recipient are not bound unless they sign; the NDA should make the recipient responsible for them or require separate undertakings.
• An NDA does not displace the duty to produce evidence to a court. Whoever holds documents or evidence must provide them when the court requests (Article 7 and Clause 3, Article 106 of the Civil Procedure Code); a party may ask the court not to publish evidence that concerns business secrets (Clause 2, Article 109).

An NDA is one layer of protection, alongside trade secret protection, competition rules, agreements with employees and personal data protection (covered below). For managers and shareholders, the Law on Enterprises 59/2020/QH14 bars managers from using the company's information and know-how for personal gain or for the benefit of other organisations or individuals (Article 13, Point b, Clause 1, Article 71, Clause 3, Article 83, Point c, Clause 1, Article 165) and requires shareholders of a joint stock company to keep information supplied by the company confidential (Clause 5, Article 119). The provisions checked do not state a duty of confidentiality after leaving office, so a person who receives company documents should still consider signing an NDA.

How does an NDA in Vietnam differ from trade secret protection under the IP Law?

A trade secret (bi mat kinh doanh) is a concept of the Law on Intellectual Property: information obtained from financial or intellectual investment that has not been disclosed and can be used in business (Clause 23, Article 4, consolidated text 160/2026/VBHN-LQ-VPQH). It is protected if it meets all three conditions of Article 84: (1) it is not common knowledge and not easy to obtain; (2) it gives its holder an advantage when used in business; (3) the owner protects it with necessary measures. The right arises from lawfully obtaining the secret and keeping it confidential, with no registration (Point c, Clause 3, Article 6).

Two details to note. First, only Point dd, Clause 3, Article 125 contains the words "another agreement"; in LexData's reading, an NDA is the lawful way to close the reverse-engineering route that the statute otherwise allows, while information the recipient develops independently does not come from the NDA and should simply be carved out of the duty. Second, Point c, Clause 1, Article 127 lists breach of a confidentiality contract as an infringing act: an NDA creates a contractual duty and is also the basis for treating disclosure as infringement, if the information qualifies.

What happens if an NDA in Vietnam is breached: penalty cap, damages, administrative and criminal liability?

Contractual liability. A penalty is a sum the breaching party pays under the agreement (Clause 1, Article 418 of the Civil Code), so one can be claimed only if the NDA has a penalty clause. Damages are a separate right: full compensation unless the parties agree otherwise or the law provides otherwise (Article 13), including the benefit that would have been obtained (Clause 2, Article 419). Whether both are available depends on the relationship:

• Civil: if the NDA has a penalty clause but does not say that the breaching party pays both the penalty and damages, only the penalty is owed (Clause 3, Article 418). For readers used to common law: a Vietnamese penalty is a separate sum and can be combined with damages if the contract says so.
• Commercial: where a penalty is agreed, the injured party may claim both the penalty and damages unless the law provides otherwise (Clause 2, Article 307 of the Commercial Law).

A common drafting approach, not a legal requirement: state the base for the penalty and keep it within 8% if the NDA is commercial activity. A bill amending the Commercial Law (together with the Competition Law and other laws) goes to the National Assembly for debate and adoption at its second session (planned for 17 October to 21 November 2026); under the first draft, it repeals Chapter VII (Articles 292 to 319, including Article 301) from 1 March 2027. As of 14 October 2026 the bill has not been passed and Article 301 remains in force. See penalty for breach of contract in Vietnam.

Liability under the IP Law. If the information is a qualifying trade secret, a court may order the infringer to stop, apologise and publish a correction, perform civil obligations and pay damages (Clauses 1 to 4, Article 202). The plaintiff must prove actual loss (Clause 6, Article 203); where material damages cannot be determined on the bases in Points a, b and c, Clause 1, Article 205, the court decides, up to VND 1 billion (Point d, Clause 1, as in the consolidated text that includes Law 131/2025/QH15, effective 1 April 2026; cases accepted before that date and not yet resolved continue under the old rules, Clause 5, Article 3 of Law 131/2025). The right holder may also ask the court to order the infringer to pay reasonable lawyers' fees (Clause 3, Article 205).

Administrative liability. The Competition Law 2018 prohibits infringing confidential business information (thong tin bi mat trong kinh doanh): accessing or collecting it by circumventing the owner's protective measures, or disclosing or using it without the owner's permission (Clause 1, Article 45). Article 16 of Decree 75/2019/ND-CP sets a fine of VND 200 to 300 million, with confiscation of exhibits, means and the profit obtained. That range is the level for an organisation; an individual is fined up to half (Clause 7, Article 4). Decree 102/2026/ND-CP (effective 20 May 2026) amends many provisions of Decree 75/2019 but not Article 16 or Clause 7, Article 4. The sanction applies to organisations and individuals doing business (Article 2 of the Competition Law) and attaches to the conduct whether or not an NDA was signed.

Criminal liability. Article 212 of the Law on Intellectual Property only says that infringing acts meeting the elements of a crime are prosecuted; it creates no offence itself. Article 226 of the Penal Code (consolidated text 135/VBHN-VPQH) names only trademarks and geographical indications; LexData found no offence naming trade secrets in the full consolidated text, so the claim that "breaching an NDA is a crime" lacks a basis. Accompanying conduct may amount to another offence, depending on the facts, for example deliberately bypassing access codes to break into another person's system and steal data (Article 289).

Limitation periods. Civil contract disputes: three years from when the entitled person knew or should have known of the infringement (Article 429 of the Civil Code); commercial disputes: two years from when the rights were infringed (Article 319 of the Commercial Law), a date that may precede discovery of a leak.

NDA in Vietnam for employees: how does it differ from a non-compete?

Where an employee's work relates directly to business or technology secrets, the employer may agree in writing on the content and duration of protection and on compensation for breach (Clause 2, Article 21 of the Labour Code 45/2019/QH14). Circular 10/2020/TT-BLDTBXH allows the agreement to sit in the labour contract or a separate document (Clauses 1 and 2, Article 4). On breach the employer may claim compensation as agreed (Clause 3, Article 4): during the labour contract, under the procedure for compensation that Clause 2, Article 130 of the Labour Code leaves to the Government (Articles 71 and 72 of Decree 145/2020/ND-CP); after termination, under civil law (Point b, Clause 3, Article 4). These texts speak of compensation, not of a contractual penalty; in LexData's reading, a monetary penalty clause in an employee NDA needs separate consideration.

Four points:

• Work rules must cover protection of property, business secrets, technology secrets and intellectual property (Point dd, Clause 2, Article 118 of the Labour Code; Point dd, Clause 2, Article 69 of Decree 145/2020/ND-CP), so they are a general layer for staff who have not signed a separate NDA.
• An employer may not require a money or property guarantee for performance of the labour contract (Clause 2, Article 17) or impose fines in place of discipline (Clause 2, Article 127), so be careful with deposits and fines in an employee NDA.
• Dismissal for disclosing business secrets applies only to conduct stated in the work rules (Clause 2, Article 125), and the limitation period for discipline is 12 months rather than six (Clause 1, Article 123).
• A trade secret that an employee obtains while doing the assigned work belongs to the employer unless otherwise agreed (Clause 3, Article 121 of the Law on Intellectual Property).

The Supreme People's Court precedent portal published an article by an author noting two opposing lines of case law on non-competes: refusing to recognise them as contrary to the freedom to choose work, or recognising them as civil agreements under Clause 2, Article 3 of the Civil Code. LexData has not seen the original judgments the article refers to, so we do not cite case numbers. The article is the author's opinion, but it shows the risk of bundling a non-compete with an NDA; enforceability, drafting and remedies are covered in our guide to the non-compete agreement in Vietnam.

What Precedent No. 69/2023/AL says, and does not say. The precedent (applied from 1 November 2023) arose from an employee's application to set aside an arbitral award; the employee had been the respondent in the arbitration at the Vietnam International Arbitration Centre, over an agreement on confidentiality and non-competition containing an arbitration clause. Its legal solution (paragraph 8 of the decision): the agreement is independent of the labour contract and falls under the jurisdiction of commercial arbitration, based on Clause 2, Article 2 of the Law on Commercial Arbitration (at least one party engages in commercial activity) and on the applicant having lost the right to object to jurisdiction (Article 13 and Clause 4, Article 35).

In paragraph 6 of the original decision, outside the part published as the precedent's content, the panel also found the NDA valid because it was signed voluntarily by an employee with full capacity and without coercion (citing Article 4 of the 2005 Civil Code), and declined to set aside an award of VND 205,197,300 (three months' salary). In LexData's reading, that is a finding in an application to set aside an award, not the precedent's legal solution. The precedent therefore does not confirm that every non-compete is valid, nor that every employee NDA can go to arbitration. A separate NDA document fits the precedent's "independent agreement" reasoning, but it does not guarantee the outcome.

Data rooms in M&A: how is personal data handled alongside an NDA?

In a business acquisition or merger the NDA is usually the first document, before a letter of intent or MOU (see what is an MOU in Vietnam) and due diligence; that sequence is market practice, not a mandatory procedure (see M&A in Vietnam and due diligence in Vietnam).

The easiest point to get wrong is that trade secrets and personal data are not the same thing. Personal data is digital data or information in other form that identifies or helps identify a specific individual (Clause 1, Article 2 of Law 91/2025/QH15). Payroll files or customer lists of individuals placed in a data room still need their own transfer basis even with an NDA:

• Transfer basis. Article 17 lists the cases in which personal data may be transferred, including the data subject's consent (Point a), a split, division, merger or consolidation of organisations (Point c) and a transfer to a processor or third party (Point d). The law does not mention share purchases, so whether records placed in a data room during diligence on a share purchase fall under Point c depends on how the deal is structured.
• Transfer agreement. For transfers under Points a, c and d, the transferor must conclude an agreement with the recipient stating the purpose, the data subjects and categories of data, the processing period and the deletion or destruction requirement once the purpose is met, the legal basis, protection responsibilities, responsibility for data subject rights and cooperation on breaches (Clause 1, Article 7 of Decree 356/2025/ND-CP). An NDA that deals only with confidentiality does not yet replace that agreement; add an annex or use a separate document (see transfer of personal data in Vietnam).
• Data room abroad. Storing data on servers outside Vietnam, sending it to a person or organisation abroad, or processing it on a platform outside Vietnam is a cross-border transfer of personal data (Clause 1, Article 20 of Law 91/2025/QH15): an impact assessment dossier must be filed with the specialised authority within 60 days of the first transfer, subject to the exclusions (Clauses 2 and 6). See cross-border data transfer.

In practice, mask or de-identify the data before it enters the data room (personal data that has been de-identified is no longer personal data; Clause 1, Article 2; see de-identification), and if the recipient processes data on the provider's behalf, add a data processing agreement.

Foreign parent or foreign-law NDA: which law applies?

The right to choose the law governing a contract (Clause 1, Article 683 of the Civil Code) belongs to civil relationships with a foreign element: at least one party is a foreign individual or legal entity, or all parties are Vietnamese but the relationship is established, performed or terminated abroad, or its object is abroad (Clause 2, Article 663). A foreign-invested enterprise is an economic organisation established and operating under Vietnamese law that has a foreign investor as a member or shareholder (Clauses 21 and 22, Article 3 of the Investment Law 143/2025/QH15; see what is an FDI company in Vietnam). In LexData's reading, an NDA between two Vietnamese entities, performed in Vietnam, has no foreign element merely because the owner is a foreign investor; an NDA with a foreign parent company does.

For a dispute with a foreign element, an arbitral tribunal applies the law the parties choose; for a dispute without one, it applies Vietnamese law (Clauses 1 and 2, Article 14 of the Law on Commercial Arbitration). A court may set aside an award that contradicts the fundamental principles of Vietnamese law (Point dd, Clause 2, Article 68). Group template NDAs often contain common law clauses. The "How to adjust" column is LexData's view:

Provide a Vietnamese or bilingual version stating which prevails, because a contract is interpreted by the parties' common intention (Article 404). If you choose arbitration, see commercial arbitration in Vietnam. LexData's service on commercial contracts in Vietnam can help.

Checklist for drafting an NDA under Vietnamese law

1. Identify the information and test it against Article 84 of the Law on Intellectual Property; if it fails, the NDA is the only protection.
2. Define confidential information by categories and a schedule, with confidentiality markings; avoid "all information", because content that is unfavourable to the other side and inserted by the drafter is read in the other side's favour (Clause 6, Article 404).
3. State the purpose, who may have access and the exceptions (information that is public without the recipient's fault, already lawfully known, independently developed, or required to be disclosed by law), and a duty to return or destroy materials at the end.
4. Choose the form (one-way, mutual, multi-party) and separate the disclosure period from the confidentiality period; the parties set the duration themselves (Clause 1 and Point d, Clause 2, Article 398) and LexData found no provision setting a minimum or maximum duration for an NDA.
5. Remedies: state the base for the penalty, keep it within 8% if the NDA is commercial activity, and say expressly that the breaching party pays both penalty and damages if that is intended (Clause 3, Article 418). Keep a log of what was disclosed (data room, emails, dates).
6. Employees: only those working directly with secrets; be careful with deposits and fines; assess any non-compete separately. Personal data: a separate transfer agreement and de-identification.
7. Choose the governing law and forum; arbitration has jurisdiction only with an arbitration agreement (Clause 1, Article 5 of the Law on Commercial Arbitration).