Confidentiality agreements are the first document signed in almost every Vietnamese transaction and the one most often treated as a formality. They govern what a bidder may see, who inside its organisation may see it, what it may do with the information afterwards, and what happens if the deal does not proceed.
The stakes are higher than the length of the document suggests. A data room on a Vietnamese target contains employee records, customer lists, pricing, licence correspondence and often personal data of individuals, and the parties are frequently competitors. Confidentiality agreements therefore have to work as commercial protection, as competition-law discipline and as a personal data compliance document at the same time.
The NDA decides what a bidder may see and keep. Photo: Pexels.
Confidentiality agreements are essential in Vietnam M&A because parties exchange commercially sensitive, personal and sometimes regulated information before they know whether a deal will proceed. Generic confidentiality agreements may not adequately address advisers, financing sources, clean teams, employee communications or data-room security.
This guide explains the provisions buyers and sellers should negotiate in confidentiality agreements for a Vietnam acquisition.
What confidentiality agreements should cover
Cover written, oral, electronic and observed information relating to the target, sellers and transaction. Include data-room materials, management presentations, analyses derived from information and the fact or status of negotiations.
1. Identify permitted recipients
Permitted recipients should be defined by role and, where practical, listed by name. Confidentiality agreements on Vietnamese deals commonly extend to the bidder’s affiliates, directors, employees, professional advisers and, in a leveraged transaction, its financing sources, each on a need-to-know basis. Two obligations make the list work: the recipient must procure that every person to whom it passes information complies, and it remains liable for their breach as if it were its own. Without those words the counterparty has no practical remedy against an adviser who leaks.
Allow disclosure to directors, employees, professional advisers, insurers, lenders and potential co-investors who need the information and are bound by confidentiality duties. The receiving party should generally remain responsible for representatives under its control.
2. Restrict use
Information should be used only to evaluate, negotiate, finance and implement the proposed transaction. Prohibit competitive, commercial or employment uses unrelated to the deal.
3. Set exclusions
Standard exclusions cover information already known without restriction, publicly available other than through breach, received lawfully from a third party or independently developed. Allocate the burden of proving an exclusion.
4. Address compelled disclosure
Permit disclosure required by law, court, stock-exchange rule or regulator. Where lawful, require prompt notice, cooperation and disclosure limited to what is necessary.
5. Protect personal and regulated data
Minimise personal data in the data room, control access and consider anonymisation. Confidentiality agreements should not be treated as the sole basis for data-protection compliance. Coordinate with personal data due diligence.
Personal data is the point at which confidentiality agreements stop being purely commercial. A Vietnamese data room routinely contains employee identity documents, salary and social insurance records, and customer contact details, all of which are personal data under Decree 13/2023 on personal data protection. The disclosing party remains responsible for the lawfulness of the disclosure, so the practical answer is to redact or pseudonymise identifiers at the outset, to release full records only where a specific diligence question requires them, and to record in the confidentiality agreements that the recipient processes the data solely to evaluate the transaction and must delete it if the deal does not proceed.
6. Use clean-team arrangements
Where parties compete, limit competitively sensitive information to designated external advisers or ring-fenced personnel. Define permitted outputs and prevent disclosure of granular customer, price or strategy data to operational teams.
7. Control contact with stakeholders
Require consent before contacting employees, customers, suppliers, landlords or regulators about the transaction. Provide a process for approved diligence interviews and site visits.
8. Address non-solicitation carefully
If employee non-solicitation is included, define covered employees, duration and exceptions for general advertising, unsolicited approaches and recruiter activity not targeted at the target.
Permitted recipients should be named or defined by role. Photo: Pexels.
9. Restrict announcements
Prohibit public statements and unauthorised disclosure of deal discussions. Establish approval and coordination procedures for legally required announcements.
10. Set return and destruction obligations
On request or termination, require return or destruction of information and copies, subject to legal retention, automatic backups and professional recordkeeping. Retained material should remain protected.
11. Clarify privilege
State that disclosure is not intended to waive legal privilege or protection. Establish a process for inadvertently produced privileged documents.
12. Set duration
Choose a period reflecting transaction sensitivity and the useful life of the information. Trade secrets may require protection for as long as they remain confidential.
Duration should be graduated rather than uniform. Two to three years is standard for general commercial information, which loses value quickly; five years or longer is appropriate for pricing models, source code and formulations; and trade secrets should be protected for as long as they remain secret, with no fixed expiry. Non-solicitation periods run separately and are usually shorter. Confidentiality agreements that impose a single long period across everything are frequently resisted by bidders and, where they operate as a restraint of trade, are harder to enforce.
13. Address remedies
Remedies are the weakest part of most confidentiality agreements. Damages for a leak are hard to quantify, so confidentiality agreements should acknowledge expressly that damages may not be an adequate remedy and that the disclosing party may seek injunctive relief without proving loss, and it should preserve the right to apply to any competent court for urgent interim measures even where disputes are otherwise referred to arbitration. A liquidated sum can be added, but in Vietnam it should be characterised carefully so that it is not treated as a penalty subject to the statutory cap.
Recognise that unauthorised disclosure may cause harm not fully compensated by damages and may justify injunctive relief, subject to applicable law.
14. Choose governing law and dispute resolution
Confidentiality agreements are often the only document signed before a deal collapses, so their dispute clause has to stand alone. Where the counterparty and the information both sit in Vietnam, Vietnamese law and a Vietnamese seat make enforcement straightforward. Where the bidder is offshore, arbitration under an institution whose awards are enforceable in Vietnam is preferable, with an express carve-out allowing either party to seek urgent injunctive relief from any competent court. Confidentiality agreements that point to a foreign court alone leave the disclosing party with a judgment it cannot enforce against a local recipient.
Select law, forum, arbitration rules, seat and language appropriate to the parties and likely enforcement locations. Ensure consistency with the term sheet and later acquisition agreement.
Common mistakes in confidentiality agreements
- Allowing information to be used for broad business purposes.
- Uncontrolled disclosure to co-investors or financing sources.
- No clean-team process between competitors.
- Uploading excessive personal data.
- Ambiguous stakeholder-contact rights.
- Return obligations that ignore backups and retention duties.
- A short term that does not protect trade secrets.
- Conflicting dispute clauses across transaction documents.
Relationship with exclusivity
Exclusivity is usually bolted on to the same document, and the two should be read together. Confidentiality agreements that also grant exclusivity need to say when the exclusive period starts and ends, whether it extends automatically while a regulatory filing is pending, and what the seller may do if the bidder stops progressing. Keeping the confidentiality obligations alive after exclusivity lapses is essential, because a bidder that walks away still holds everything it was shown, and confidentiality agreements are then the only protection the seller has left.
Confidentiality and exclusivity often appear in the same term sheet but serve different purposes. Coordinate recipient access, announcements and remedies with the framework for negotiating M&A exclusivity.
Conclusion
A strong confidentiality agreement enables efficient diligence while controlling commercial, privacy and competition risk. It should reflect the actual information flow, recipient group and transaction process rather than rely on a generic template.
Frequently asked questions about confidentiality agreements
What should confidentiality agreements cover in a Vietnam deal?
A workable definition of confidential information including the fact of the discussions themselves; a closed list of permitted recipients and an obligation to procure their compliance; a use restriction limiting the information to evaluating the transaction; standard exclusions for information that is public or independently developed; a compelled-disclosure procedure; return or destruction obligations; a duration; and a governing law and dispute resolution clause. For competitor bidders, clean team wording should be added.
Are confidentiality agreements enforceable in Vietnam?
Yes. They are enforced as ordinary contracts, and confidential business information can also be protected as a trade secret under the Intellectual Property Law where it has commercial value, is not generally known and has been the subject of reasonable protection measures. The practical difficulty is proof of loss, which is why agreements normally include an express acknowledgement that damages may be inadequate and that injunctive relief may be sought.
How should personal data in the data room be handled?
Minimise first. Redact identity numbers, addresses and bank details, provide anonymised payroll data for the initial phase, and release identified records only where the diligence question genuinely requires them. Decree 13/2023 imposes obligations on the party disclosing the data, so confidentiality agreements should record the purpose of processing, the recipient’s obligation to apply equivalent security measures, and deletion on termination.
What is a clean team and when is one needed?
A clean team is a defined group, often external advisers plus employees who are not involved in day-to-day commercial decisions, that receives competitively sensitive information such as customer-level pricing and margins. It is needed whenever the bidder competes with the target, because exchanging that data before completion can amount to prohibited coordination. The protocol should set out who is in the team, what they may receive, and in what aggregated form findings may be reported to the deal team.
How long should confidentiality obligations last?
Match the period to the information. Two to three years for general commercial material, longer for technical and pricing information, and indefinitely for genuine trade secrets. Include a separate and shorter period for non-solicitation, and state expressly that the obligations survive termination of the discussions, since confidentiality agreements that expire when negotiations end leave the disclosing party unprotected precisely when the risk is highest.
Next step
Before opening the data room, decide what goes in each phase and who may see it. Set up the folder structure so that competitively sensitive and personal data sit behind a clean team gate, and confirm which corporate documents will have to be disclosed in any event for the filings required under the Law on Enterprises.
IVLF Lawyer prepares confidentiality agreements, clean team protocols and data room rules for buyers and sellers in Vietnam, and advises on personal data compliance during diligence. An experienced Vietnam M&A lawyer will make confidentiality agreements fit the process rather than the other way round. See our legal services or contact IVLF Lawyer.
Related reading: Essential clauses in a Vietnam share purchase agreement, Deposits and break fees in Vietnam acquisition agreements, and Dispute resolution clauses in cross-border M&A contracts.
This article is provided for general information only and does not constitute legal advice for any specific case. Regulations may change – please consult a qualified professional before acting. Should further analysis be required, please contact one of our lawyers below.
