With the enactment of the Law on Personal Data Protection 2025 (“PDP Law”) and Decree No. 356/2025/ND-CP, personal data protection has become an increasingly important compliance area for businesses operating in Vietnam. To strengthen the enforcement of this framework, the Ministry of Public Security has also released a draft Decree on administrative penalties for violations in cybersecurity and personal data protection (“Draft Decree on Administrative Penalties”), which proposes significant penalties for non-compliance, including fines of up to VND 3 billion, or in certain cases, up to 5% of the preceding year’s revenue. Against this backdrop, personal data protection is no longer viewed solely as an operational compliance issue. For M&A transactions, personal data protection has emerged as a standalone legal due diligence work stream, allowing potential compliance risks to be identified at an early stage and addressed before completion of the transaction.

1. Key Areas of Review During M&A Due Diligence and Common Risks Identified

Understanding Target’s Data Ecosystem

An assessment of personal data protection compliance should begin with an understanding of the target’s data ecosystem. This includes identifying the parties involved in processing activities, categories of personal data collected, purposes of processing, and any third parties that may have access to such data. While personal data issues are often associated with technology or customer-facing businesses, personal data protection compliance is relevant across all sectors. Even trading, manufacturing, and service companies routinely process personal data relating to employees, customers, suppliers, and business contacts. Particular attention should be paid to customer databases, employee records, user information collected through websites and mobile application, and marketing databases, as these are often among the target’s most valuable business assets. A clear understanding of the target’s data ecosystem enables more focused due diligence inquiries and helps identify potential compliance risks associated with the collection, use, sharing, and transfer of personal data.

Consent and Transparency Requirements

Another important area of due diligence is the target’s compliance level to consent collection and disclosure mechanisms under the PDP Law. Investors should assess whether the target has implemented appropriate privacy notices and consent mechanisms across relevant channels, such as websites, mobile applications, recruitment processes and human resources management systems, and whether adequate records are maintained to demonstrate compliance. Deficiencies in consent collection or transparency obligations remain among the most common compliance issues and may affect the target’s ability to lawfully use personal data following completion of the transaction. Where the buyer intends to use the acquired data for purposes beyond those originally disclosed to data subjects, additional compliance requirements may need to be considered.

The significance of these obligations is further reinforced under the Draft Decree on Administrative Penalties, which proposes administrative fines for non-compliance with consent requirements (potentially ranging from 50 mil VND to 100 mil VND), together with additional sanctions and remedial measures, such as the temporary suspension of personal data processing activities and the mandatory deletion of unlawfully processed personal data. These measures may directly affect a business’s ability to continue using its customer and employee databases, making it essential for investors to verify the legal basis for personal data processing during due diligence.

Documentation and Regulatory Filings

Investors should verify whether the target has prepared and maintained the mandatory documentation required under the PDP Law, including  personal data processing impact assessment dossier (“DPIA”) and, where applicable, the cross-border personal data transfer impact assessment dossier (“DTIA”). These documents can provide valuable insight into the target’s data processing and transfer activities and help identify potential compliance gaps.

The absence, incompleteness, or inaccuracy of such documentation may indicate broader compliance deficiencies, expose the target to regulatory risk, and result in additional remediation costs following completion of the transaction.

The Draft Decree on Administrative Penalties likewise imposes administrative penalties for failures to prepare or maintain mandatory DPIA and DTIA dossiers (potentially ranging from 50 mil VND to 100 mil VND), accompanied by remedial measures requiring organisations to complete or rectify the relevant documentation. Where non-compliance is identified, additional sanctions may also be imposed for more serious violations. These requirements highlight the importance of verifying the completeness and accuracy of the target's compliance documentation, as deficiencies may require substantial remediation efforts after closing.

Third-party Data Processing Arrangements

Many businesses engage third-party service providers to process personal data on their behalf. Although certain processing activities may be outsourced, the target generally remains responsible for complying with applicable personal data protection requirements. Accordingly, investors should review agreements involving the processing of personal data as part of the due diligence exercise in order to assess the allocation of responsibilities, confidentiality obligations and risk-sharing mechanisms in the event of a data-related incident. Deficiencies in third-party oversight or contractual arrangements may expose the target to regulatory risks and potential liabilities, particularly where personal data is shared with external service providers or processed across different jurisdiction.

Given the increasingly stringent enforcement framework proposed under the Draft Decree on Administrative Penalties, businesses relying on third-party processors should ensure that appropriate contractual and governance arrangements are in place to mitigate potential compliance risks.

Data Security and Governance Measures

The importance of data security and governance issues will vary depending on the nature, volume, and sensitivity of the personal data processed by the target. Where personal data plays a significant role in the target’s operations, investors may consider conducting a separate technical review of the target’s data security framework as part of the broader due diligence process.

From a legal due diligence perspective, particular attention should be paid to any history of data breaches, complaints from data subjects, regulatory investigations, enforcement actions, or other personal data protection incidents involving the target. Such incidents may indicate potential regulatory exposure, litigation risks, or liabilities that could survive completion of the transaction. The findings of any technical review may also assist investors in identifying post-closing remediation measures and integration priorities.

The Draft Decree on Administrative Penalties further strengthens the enforcement of data security and governance obligations. Under Article 57, organisations may be subject to administrative fines of up to VND 70 million for failing to implement appropriate institutional, technical, and organisational measures or establish internal policies to protect personal data. Meanwhile, Article 69 proposes additional sanctions and remedial measures for certain serious personal data protection violations, including the temporary suspension of personal data processing activities, mandatory implementation of appropriate data protection measures, and deletion of unlawfully processed personal data. Together, these proposed enforcement measures highlight the importance of assessing the target’s data governance framework, security controls, and historical security incidents as part of the due diligence process.

2. Risk Allocation and Post-Acquisition Compliance Measures

Once personal data protection risks have been identified during the due diligence process, investors will typically seek to allocate and manage such risks through transaction documents as well as post-closing remediation arrangements.

Representations and Warranties

The buyer may require representations and warranties confirming that the target has complied in all material respects with applicable personal data protection regulations, has completed material mandatory documentation and filings, and is not subject to any ongoing or threatened investigation or enforcement action in relation to personal data processing.

Indemnities

Where specific compliance issues are identified during due diligence, the buyer may seek targeted indemnity protection covering disclosed breaches, unresolved compliance deficiencies, or liabilities arising from pre-closing data processing activities.

Conditions Precedent

In case involving significant compliance gaps, the buyer may require remediation measures to be completed before closing, such as the preparation of outstanding DPIA or DTIA dossiers, implementation of key governance measures or rectifying outstanding regulatory issues.

Escrow or Purchase price retention mechanisms

The buyer may also seek escrow or purchase price retention arrangement to cover potential liabilities arising from historical non-compliance.  

Post-Closing Undertakings

The parties may agree on transitional and continuing obligations to support post-closing compliance, including cooperation in completing outstanding documentation and filings (including DPIA and DTIA dossiers), assisting in responding to data subject requests, and supporting the handling of inspections, investigations, or information requests from competent authorities relating to pre-closing personal data processing activities.

These mechanisms collectively enable a structured allocation of regulatory and operational risk, while facilitating post-closing remediation and integration of personal data protection compliance within the target’s business operations.

Conclusion

As Vietnam’s personal data protection framework continues to develop, and with an administrative sanctions regime expected to be introduced soon, compliance with personal data protection requirements is becoming an increasingly important component of M&A due diligence.

A structured assessment of data processing activities, early identification of compliance risks, and implementation of appropriate risk allocation mechanisms in transaction documents are essential not only to protect investors’ interests, but also to support effective post-closing integration and the ongoing compliance of the target’s business operations.