Law on Data No. 60/2024/QH15 and M&A 2026: Data Rooms, Cross‑border Transfers & Contract Clauses

Vietnam data law ma strategy has become unavoidable for any transaction team preparing deals for the 2026 season, as the Law on Data No. 60/2024/QH15 reshapes how due diligence is run, how virtual data rooms are configured and how post‑closing data risk is allocated. This long‑form guide translates the statute into practical, deal‑level steps: what datasets are affected during due diligence, how to structure a compliant virtual data room, which cross‑border transfer routes are realistically available, and where to update your share purchase agreement. It is written for in‑house counsel, private equity deal teams, corporate acquirers and sellers who need a 2026‑ready playbook rather than a high‑level overview.

Throughout, statutory references point back to the primary legislative source so that each obligation can be verified.

Executive summary, key takeaways for M&A teams

The Law on Data No. 60/2024/QH15, passed by the National Assembly on 30 November 2024, elevates data handling from an operational afterthought to a priced, negotiated and documented element of every Vietnam transaction. For deal teams, the practical consequence is that the vietnam data law ma workflow now runs in parallel with financial and legal due diligence, not after it. The following six actions should be built into every mandate from the first bid.

• Harden the virtual data room. Configure hosting location, access controls, logging, watermarking and destruction protocols before any confidential data is uploaded.
• Map the target’s data. Identify where personal, sensitive and regulated datasets sit, where they are hosted, and which may trigger localisation or transfer conditions.
• Select transfer routes early. Decide, deal by deal, between onshore remote access, temporary export, approved cloud hosting or anonymised extracts.
• Update transaction documents. Refresh warranties, covenants, indemnities, escrow triggers and transition services to reflect data obligations.
• Design carve‑outs. Separate ordinary liability from regulatory fines, investigation costs and data‑breach exposure.
• Plan escrow and holdbacks. Reserve mechanisms for latent regulatory liabilities that surface after closing.

Overview, what is Law on Data No. 60/2024/QH15?

The Law on Data No. 60/2024/QH15 is Vietnam’s dedicated statutory framework governing the creation, processing, storage, transfer and protection of data within and beyond Vietnamese territory. For the purposes of vietnam data law ma planning, three categories of definition matter most: the parties who handle data, the nature of the data itself, and the acts that count as processing or transfer. The statute addresses the roles of those who own and control data and those who process it on their behalf, and it distinguishes between ordinary data and categories treated as more sensitive, where heightened obligations apply.

Two concepts anchor almost every M&A analysis under the statute. The first is data localisation, the circumstances in which certain data must be stored on servers located in Vietnam. The second is cross‑border transfer, the movement of data out of Vietnam, or access to Vietnamese‑held data from abroad, which the law conditions on specified requirements. Because due diligence inherently involves granting a prospective buyer sight of a target’s data, these two concepts determine how a transaction can lawfully proceed. The authoritative text and legislative history are published through the National Assembly of the Socialist Republic of Vietnam, and practitioners should work from that primary source rather than secondary summaries.

Legislative timeline and implementation milestones

The Law on Data took effect on 1 July 2025 and is being operationalised through a sequence of implementing instruments. As with most Vietnamese framework statutes, the detailed operating rules, covering approval procedures, notification formats, technical standards for hosting and the precise mechanics of transfer, are filled in by implementing decrees and ministerial circulars. Deal teams should therefore treat the statutory text as the fixed backbone and monitor the Government Portal and the relevant ministries for the subordinate instruments that convert principles into procedures. Where an implementing instrument has not yet been promulgated on a particular point, the prudent approach is to build conditionality into transaction documents rather than assume a particular outcome.

Interaction with other laws

The Law on Data does not operate in isolation. It sits alongside Vietnam’s cybersecurity framework and its personal‑data protection regime, including the Law on Personal Data Protection and related decrees, and the instruments overlap in important respects, particularly on hosting, localisation triggers and the treatment of personal data. For a vietnam data law ma review, the practical rule is to run a combined analysis: a dataset that is unproblematic under one instrument may still attract obligations under another. The Ministry of Public Security plays a central role in data and cybersecurity regulation, and relevant ministerial materials should be read together when assessing hosting and transfer requirements.

Does the vietnam data law ma review apply to due diligence and virtual data rooms?

In most transactions, yes. Due diligence is, by its nature, a processing activity: the target assembles, copies and discloses data, and the buyer and its advisers receive, store and analyse it. The Law on Data No. 60/2024/QH15 governs these acts, which means the obligations attach from the moment confidential information is first made available, typically well before any binding agreement is signed. Deal teams that assume the statute only bites at closing will have mishandled data for the entire diligence period.

Several features of a typical diligence process require specific attention. Copies and extracts taken from source systems remain subject to the law, so a buyer who downloads and retains spreadsheets of customer or employee records is handling regulated data, not merely viewing it. The custody of data within a virtual data room, who hosts it, where the servers sit, and who can reach them, determines whether the arrangement is compliant. And a central question for every cross‑border deal is whether granting an offshore buyer access to Vietnamese‑held data constitutes a cross‑border transfer. Because access from abroad can fall within the transfer concept, remote visibility is not automatically a safe harbour; it must be structured and documented.

The practical takeaway is that vietnam data law ma compliance begins at the teaser and non‑disclosure stage. Sellers should decide what goes into the data room, in what form, and under what controls, before the room opens. Buyers should confirm the hosting and access arrangements before uploading or downloading anything, and should scope their diligence requests so that they obtain what they need without triggering avoidable transfer or localisation issues.

VDR‑specific implications

The virtual data room is where abstract statutory duties become concrete. Hosting location is the first decision: a room hosted on servers within Vietnam avoids the clearest form of export, whereas a room hosted offshore may itself constitute a cross‑border transfer of whatever is loaded into it. Access controls must be granular enough to restrict who sees sensitive categories, and they should be time‑limited so that access expires at defined diligence milestones. Comprehensive logging is essential, every view, download and export should be recorded so that the seller can demonstrate who accessed what and when.

Encryption, both at rest and in transit, should be the default rather than an upgrade. Watermarking deters leakage and supports accountability. Contractual hosting terms with the VDR provider must address data location, subprocessors and security standards. Finally, retention and destruction after the deal closes, or after it collapses, must be planned in advance: the parties should agree that diligence copies are deleted and that the provider issues deletion certificates. Handled this way, the vietnam data law ma review of the data room produces an auditable trail rather than a latent liability.

Cross‑border data transfers in M&A, allowed routes and approvals

Cross‑border transfer is the single most consequential issue in most foreign‑buyer transactions, because the buyer, its deal team and its advisers usually sit outside Vietnam. The Law on Data No. 60/2024/QH15 conditions the movement of data out of Vietnam, and in many cases the grant of offshore access to Vietnamese‑held data, on specified requirements that may include approvals or notifications depending on the data involved and the mechanism used. The right answer is rarely “export everything” or “export nothing”; it is to select, dataset by dataset, the least‑burdensome route that still delivers the analysis the buyer needs.

For a vietnam data law ma transaction, four broad routes recur in practice. The first is remote, view‑only access to data that stays on onshore servers, minimising export while meeting the buyer’s diligence need. The second is the temporary export of copies to the buyer’s jurisdiction where genuine analytical work requires it, which is more likely to engage approval or notification conditions. The third is hosting on an approved cloud environment with data residency, which suits post‑closing integration. The fourth is the export of aggregated or anonymised datasets, where bona fide removal of identifiers can place the material outside the most restrictive controls, subject to the legal tests for genuine anonymisation and the residual risk of re‑identification.

Practical routes for buyers, remote access versus export versus onshore hosting

The choice between remote access, export and onshore hosting is a trade‑off between analytical freedom and compliance burden. Remote, view‑only access keeps the data in Vietnam and typically carries the lowest approval risk, but it constrains the buyer’s ability to run its own analytics, build models or ingest data into its systems. Temporary export unlocks full analytical capability but is the slowest and most compliance‑sensitive route, because it is the clearest form of cross‑border movement. Hosting on an approved cloud with data residency offers scalability and governance clarity for integration, but requires vendor due diligence and contractual assurances about location, security and subprocessors.

The disciplined approach is to start from remote access as the default and escalate to export only where the analytical case is genuine and the timetable can absorb the approval process.

Approvals and timeframes, practical checklist

Where a route requires an approval or notification, the governing procedures are set out in implementing decrees and ministerial guidance, so the exact forms and timelines should be confirmed against current regulator materials for each deal. As a planning discipline, deal teams should: identify, early, every dataset whose transfer may require an approval or notification; confirm the applicable procedure and documentary requirements from official sources; build realistic lead times into the deal timetable rather than assuming instant clearance; and make the completion of any required approval a condition in the transaction documents so that the parties are not forced to choose between breaching the statute and breaching the contract.

VDR controls and technical/organisational checklist

Technical and organisational controls are how a party demonstrates, after the fact, that its vietnam data law ma handling was compliant. The checklist below maps common controls to the statutory objectives of security, accountability and restricted transfer. Each item should be configured before the data room opens and verified during diligence rather than retrofitted afterwards.

• Encryption at rest and in transit. Apply strong encryption as a default across the data room and all transfers.
• Identity and multi‑factor authentication. Require verified identity and MFA for every user with access.
• IP whitelisting. Restrict access to known networks where the risk profile warrants it.
• Watermarking. Apply dynamic watermarks to deter leakage and support traceability.
• Access expiry. Time‑limit permissions to defined diligence phases and revoke promptly on milestone completion.
• Export and download controls. Govern whether, and by whom, documents can be downloaded or exported.
• Logging and retention. Record all access events and retain logs so activity can be reconstructed.
• Host service levels. Secure contractual SLAs on security, availability and location.
• Subprocessor transparency. Obtain and review a current list of the provider’s subprocessors.
• Deletion certificates. Require documented destruction of data on completion or termination.

Sample VDR provider contract clauses to request

When contracting with a data‑room provider, deal teams should insist on a small set of protective clauses. Require a complete and maintained subprocessor list, with a right to object to additions. Secure an audit and inspection right allowing verification of security and location claims. Fix log retention obligations so that access records survive long enough to support any later dispute. And agree a defined incident notification timeline obliging the provider to report any suspected breach within a specified, short period, together with cooperation obligations for investigation and remediation.

M&A transaction documents, clauses to update for the vietnam data law ma deal

The Law on Data changes what belongs in a Vietnamese share or asset purchase agreement. A vietnam data law ma review that stops at diligence and never reaches the contract leaves the risk unallocated. The following areas of the SPA or APA and the ancillary documents should be revisited on every deal.

• Representations and warranties. The seller should warrant the accuracy of its data mapping, confirm compliance with the Law on Data, and state that no required approvals or notifications are outstanding and unremedied.
• Covenants. Capture pre‑closing remediation of identified gaps, the obligation to obtain or support any required transfer approvals, and disciplined interim data handling between signing and closing.
• Indemnities and caps. Carve out data‑breach exposure, regulatory fines and investigation costs from ordinary liability caps, so that data risk is priced and allocated deliberately.
• Escrow and holdbacks. Reserve part of the consideration against latent regulatory liabilities that may only surface after closing.
• Transition services and data migration. Specify how data moves at and after closing, who hosts it in the interim, and on what security and location terms.

The allocation of these obligations is itself a negotiation. The table below summarises the typical division of responsibility that a buyer and seller bring to the table on data matters.

Model clause language, warranty, covenant, indemnity and escrow triggers

The wording below is illustrative drafting to be adapted to each deal, not a substitute for advice tailored to the final statutory and decree position.

Warranty (compliance and approvals): “The Company has, in all material respects, complied with the Law on Data No. 60/2024/QH15 and its implementing instruments, and there are no outstanding approvals, notifications or conditions required in respect of the Company’s processing, storage or transfer of data that have not been satisfied or disclosed.”

Drafting note: ties the warranty to the statute and to the localisation and transfer obligations it establishes; confirm the applicable decree position before finalising.

Covenant (interim handling and approvals): “Between signing and Closing, the Seller shall procure that the Company handles data in accordance with the Law on Data, shall not effect any cross‑border transfer otherwise than in compliance with it, and shall use reasonable endeavours to obtain any approval or notification required for the transactions contemplated by this Agreement.”

Drafting note: addresses the cross‑border transfer concept and preserves compliance during the interim period.

Indemnity (carve‑out): “The Seller shall indemnify the Buyer against all regulatory fines, penalties, investigation costs and third‑party claims arising from any breach of the Law on Data occurring on or before Closing, and such liability shall not be subject to the general limitation of liability in this Agreement.”

Drafting note: separates statutory penalty exposure from ordinary caps; align scope with the escrow trigger.

Escrow trigger: “An amount equal to [●] shall be retained in escrow and released on the later of [●] and the final resolution of any pending or threatened regulatory action under the Law on Data identified before Closing.”

Drafting note: funds latent regulatory liability where diligence identifies unresolved exposure.

Deal playbook, buyer, seller and counsel step‑by‑step

A disciplined vietnam data law ma process runs in three phases. In the pre‑signing phase, the seller prepares a data map and configures the data room to the control standard above; the buyer scopes its diligence requests to avoid unnecessary transfers and reviews the data‑room terms; and both sides identify datasets that may trigger localisation or require transfer approvals. Conditionality is captured in the letter of intent so that the parties understand, early, that completion of any required approval may be a condition to signing or closing.

Between signing and closing, the parties execute the agreed data‑transfer protocol, submit any approval or notification applications, and manage interim data handling under the covenants. In the post‑closing phase, the buyer implements its integration and remediation plan, migrates data on the agreed terms, and closes out any outstanding approvals before escrow is released. Documenting each step preserves the audit trail that supports the warranties and indemnities already negotiated.

Red flags and escalation path

Certain findings should stop the clock. The discovery of datasets that trigger localisation requirements may force a change of hosting strategy and should be escalated to deal principals immediately. Evidence of an active regulatory investigation, an unreported breach, or systematic non‑compliance in the target’s data handling warrants a reassessment of price, indemnity scope and escrow quantum, and, in serious cases, of whether to proceed. The escalation path should be agreed at the outset so that these findings reach decision‑makers without delay.

Practical examples and short case scenarios

Consider a cross‑border private equity buyer that needs to run its own analytics on a Vietnamese target’s customer base. Rather than exporting the full dataset, the buyer begins with remote, view‑only access to onshore servers for validation, and negotiates the temporary export of a tightly scoped, partly anonymised extract for modelling, building the lead time for any required approval into the timetable and conditioning closing on its completion.

Now consider a strategic buyer integrating the target’s HR and customer datasets. Diligence reveals that part of the data is subject to localisation, which rules out straightforward offshore consolidation. The parties agree an approved onshore hosting arrangement for the affected data, a phased migration under transition services, and an escrow holdback against the risk that a historical compliance gap in the target’s records attracts regulatory attention after closing.

Appendix, due diligence checklist and sample clause starters

The following starters condense the guidance above into a working aide‑mémoire. They should be expanded into a full checklist and adapted to each transaction and to the current decree position.

• Data map. Inventory personal, sensitive and regulated datasets, their hosting locations and any localisation triggers.
• VDR configuration. Confirm hosting location, encryption, MFA, logging, watermarking, access expiry and deletion certificates.
• Transfer route selection. Record the chosen route per dataset and any approval or notification requirements.
• Warranty starter. Compliance with the Law on Data and no outstanding approvals.
• Covenant starter. Compliant interim handling and endeavours to obtain required approvals.
• Indemnity and escrow starters. Carve‑out for fines and investigation costs; holdback pending resolution of identified regulatory risk.

This article is general information and not legal advice. The Law on Data No. 60/2024/QH15 continues to be implemented through subordinate instruments, and the precise obligations for any transaction should be confirmed against the current statutory and decree position with qualified local counsel. A well‑run vietnam data law ma process, combining a hardened data room, a deliberate transfer strategy and carefully drafted transaction documents, is the most reliable way to keep a 2026 deal both compliant and on schedule.

Sources

1. National Assembly of the Socialist Republic of Vietnam
2. Government Portal (Chính phủ)
3. Ministry of Public Security (MPS)
4. Ministry of Justice (MOJ)