Debt Recovery in Vietnam: 8 Points to Consider Before Taking Action

 An overdue payment calls for a business decision about how to recover the money. From there, the process of debt recovery in Vietnam begins with checking what is due under the contract and why it remains unpaid. The agreement and the facts then shape the choice of negotiation, mediation, arbitration, or court proceedings. Enforcement can follow where the debtor does not pay.

The first distinction is between an acknowledged debt and a dispute about the duty to pay. If both parties agree that money is due, the main issue is how and when to collect it. A dispute over quality, performance, liability, or the amount due may need to be settled or decided first. However, a debtor cannot remove an existing obligation simply by denying it.

These eight points cover the full debt recovery process, from the contract and evidence to payment, including financial distress and enforcement. They help managers weigh unpaid business debts against cost, time, and the chance of collection. A company can use them to organize its records, compare options, and decide what requires further work.

Quick Reference

Effective recovery depends on proof that money is due, a realistic source of payment, and a lawful way to collect it.

• An agreed balance, a partly disputed account, and a wider contract dispute call for different responses.
• The contract, evidence, deadlines, and dispute clause shape the next step.
• The debtor’s funds and assets help show whether further cost and delay are worthwhile.
• Clear demands and workable payment terms support settlement while protecting the claim.
• The plan also covers enforcement or creditor participation in rehabilitation and bankruptcy proceedings, with progress measured by cash received.

8 Points to Consider Before Taking Action

The Payment Obligation Defines the Recovery Options

A recovery plan starts with who owes the money, how much is due, and when payment became payable.

The contract and a reconciled account show the amounts billed, payments received, credits, and deductions. Payment might depend on completion, acceptance, or another agreed condition. An invoice records the amount claimed, but does not by itself prove that the company met every condition for payment.

An acknowledgment helps, especially when an authorized representative confirms the balance and asks for more time. A lack of response does not provide the same confirmation. If the debtor objects, the company needs to understand the point in dispute and the evidence on each side. This helps avoid treating a contested amount as an agreed debt.

Where a customer accepts most of a balance but disputes a separate charge, the company can consider pursuing the accepted portion. Its approach should preserve its claim to the rest. The broader handling of contract disputes in Vietnam becomes relevant when the disagreement concerns performance, remedies, or liability.

The debtor’s legal identity and any separate guarantee determine who can be asked to pay. Directors and parent companies are not automatically liable for company debts. Private enterprise owners and general partners can bear unlimited liability under the applicable rules. A person’s role in payment discussions alone does not establish personal liability.

Reliable Records Support the Payment Claim

The evidence should show the agreement, what the company did, when payment fell due, and how the debtor responded.

A clear file of evidence for an unpaid debt claim follows that sequence. Signed terms, transaction records, emails, account confirmations, and payment history should fit together. Full electronic records and their attachments help preserve context. An extract can miss a condition, a later change, or a reply that affects the claim.

Unfavorable records and unresolved objections also matter. It is important to review whether a missing document affects the whole claim or only part of it and whether further work is worth the cost. A claim for the unpaid price is separate from proving contract damages in Vietnam. A damages claim requires its own legal basis, proof of loss, and a link between the breach and that loss.

In Vietnam, the source, reliability, and form of a document can affect its use in proceedings. Foreign documents can also require translation or authentication. An early review gives the team time to deal with those requirements before a filing deadline. It also helps avoid spending money on a claim the records do not support.

Deadlines and Contract Terms Shape the Procedure

Time limits and the dispute clause deserve early review, even when the parties expect to agree on payment.

The contract can provide for negotiation, mediation, arbitration, or court proceedings. An arbitration clause in Vietnam affects where the claim can be heard. A valid and workable agreement generally requires the covered dispute to proceed through arbitration. Ending the main contract does not, by itself, end that clause. The governing law, place of arbitration, and place of enforcement are separate issues.

The transaction, relevant events, and applicable rules determine limitation periods for contract claims. Notice dates, the expiry of a guarantee, and other filing deadlines require separate checks. Continued talks or a demand letter do not necessarily preserve the right to bring proceedings. A filing timetable helps management see what must be done and when.

Balance confirmations are best kept with the related correspondence. The signer’s authority, the wording, and the company’s conduct affect their legal value. A confirmation from finance staff or another employee can be relevant even if the signer is not the legal representative. However, not every acknowledgment restarts the filing period. Where time is short, steps to protect the claim can run alongside settlement talks.

Available Funds Shape the Prospects of Repayment

A strong claim has limited practical value if there is no realistic source of payment.

When checking debtor assets in Vietnam, reliable records matter more than assumptions about the business. A large business, continued trading, or high registered capital does not prove that cash is available. Asset ownership, security rights, and competing creditors can reduce the funds available for payment.

Asset checks should rely on lawful sources and record what remains unknown. A short cash shortage can support a payment plan. Lasting financial distress can call for a different response. Management benefits from knowing what will fund each promised payment and what supports that explanation. A proposal based only on hoped-for future sales carries a different risk from funds already available.

Vietnamese rehabilitation and bankruptcy law can require creditors to act through collective proceedings. Those proceedings can affect individual claims, filing requirements, and the treatment of assets. An overdue payment does not itself mean the debtor has been declared bankrupt. Where the business remains viable, a plan that preserves its ability to pay can produce a better result than immediate escalation.

Expected Net Recovery Helps Compare the Options

The useful comparison is the cash likely to reach the company after further costs, with time and risk taken into account.

A recovery budget covers preparation, proceedings, any translation, asset protection, and enforcement. It should also allow for management time and the effect on the business relationship. The debtor will not necessarily reimburse all legal fees or other expenses. Spending already incurred should not be the sole reason to keep pursuing a weak claim.

A funded settlement can leave the company with more money than a larger but uncertain claim. Where full payment is realistic, a discount might be unnecessary.

Spending approvals work better in stages, with a clear purpose for each phase. Agreed settlement limits help the team negotiate without repeated delays. A missed payment, a new defense, or weaker repayment prospects can trigger a fresh decision. If further action is no longer proportionate, management can stop spending. An accounting write-off does not, by itself, release the debtor from the legal obligation.

Clear Demands and Settlement Terms Support Payment

A demand explains why payment is due, while a settlement sets terms the company can monitor and enforce.

When preparing a payment demand, the company can state the basis of the claim, the amount due, and the response date. Clear payment details and compliance with contractual notice terms reduce room for misunderstanding. Proof of delivery also matters. A claim for late payment interest in Vietnam requires a separate calculation from principal. The relevant rules depend on the transaction; loan rules do not govern every business debt.

Negotiation can continue while the legal file is prepared. Mediation can help when direct talks have stalled. The people negotiating need authority to agree, and the payment offer needs a credible source of funds. A promise from someone without authority or access to funds provides little comfort, even if the proposed amount appears attractive.

The settlement terms for an installment plan should cover payment dates, default, any security, and when claims are released. A private agreement is not automatically enforceable like a court decision. Eligible out-of-court mediated settlements can obtain court recognition and become enforceable under the applicable conditions. An application for recognition must be filed within six months from the date the parties reach the mediated agreement. This period runs from the agreement, not from a later missed payment. The form of settlement and the recognition procedure therefore deserve attention before terms are finalized.

Arbitration and Courts Can Establish Payment Rights

Formal proceedings can establish enforceable rights, but the choice of procedure should still serve the goal of receiving payment.

Arbitration can be the agreed procedure even where the main issue is an unpaid balance. The arbitration procedure in Vietnam covers how to file the claim, notify the other party, and present the case. Where court proceedings are appropriate, debt recovery litigation in Vietnam requires a review of jurisdiction, evidence, defenses, and the remedy sought. Both procedures still require a realistic view of the debtor’s finances.

Interim measures to protect assets can be relevant where the facts justify urgent action. The available measures, required proof, and possible security depend on the forum and stage of proceedings. An unsupported application can lead to liability. When a debtor transfers assets, the facts require investigation. A transfer is not automatically unlawful or reversible.

Vietnamese investment law prohibits debt collection services as a business line. The legal limits on debt collection in Vietnam distinguish that prohibited business from a creditor pursuing its own lawful claim or obtaining lawful legal representation. Threats, unlawful disclosure, or taking property without authority can lead to civil, administrative or criminal liability. The creditor also remains responsible for its own contract duties. An improper response to nonpayment can create a separate claim against it.

Enforcement Planning Connects a Decision to Payment

A favorable decision supports the claim, while actual recovery depends on receiving the money.

For court judgment enforcement in Vietnam, the decision must be enforceable and the request must reach the competent body within the relevant deadline. Arbitral awards and recognized settlements have their own enforcement conditions. Foreign judgments and foreign arbitral awards generally require recognition and permission for enforcement before compulsory recovery in Vietnam. Different legal tests apply to the two categories.

Vietnamese civil enforcement law provides for state enforcement bodies and private civil enforcement offices, with authorized practitioners known. The law defines their powers and permitted work. The chosen procedure must be available and suitable for the case. A statutory enforcement office is distinct from a prohibited debt collection business.

Up-to-date asset information helps to follow the claim through to payment. Security rights, competing claims, and insufficient assets can still limit collection. Reports should distinguish money received from money promised or awarded. Closing the file also calls for a review of any rights or commitments that remain.

Step by Step Debt Recovery Process

1. A case owner gathers the records, coordinates the team, and reports to the manager who can approve action.
2. The account review separates agreed amounts from disputed charges and issues that depend on resolving the contract dispute.
3. The team checks the evidence, payment terms, dispute clause, and deadlines to identify action that cannot wait.
4. A review of funds and assets helps management compare settlement, mediation, arbitration, and court proceedings against the likely net return.
5. Management sets the budget and settlement limits. An appropriate demand then states the claim and a clear response date.
6. Any agreement is recorded in workable terms. If proceedings are needed, the claim goes to the correct forum while settlement remains possible.
7. The team addresses any recognition or enforcement steps, or creditor participation in rehabilitation and bankruptcy proceedings where relevant.
8. Actual receipts and missed payments guide further decisions. The file records closure and lessons for future credit terms.

Frequently Asked Questions

Q1: Is debt recovery the same as resolving a contract dispute?

No. An agreed overdue debt mainly raises questions about collection. A genuine dispute over performance, quality, liability, or the amount due can first require settlement or a binding decision. A debtor cannot remove an existing obligation merely by denying it. An undisputed portion can be considered separately from the issues still in dispute.

Q2: Can an unpaid debt be pursued through arbitration?

Yes, if a valid arbitration agreement covers the claim and the matter can legally be resolved by arbitration. The clause should be checked before court proceedings are chosen. An award determines the parties’ rights, but enforcement can still be needed if the debtor does not pay.

Q3: Can a foreign company recover a debt in Vietnam?

Yes, subject to the applicable jurisdiction and procedure. Preparation for debt recovery in Vietnam for foreign creditors includes proof of authority, supporting records, and any required translation or authentication. The debtor’s assets and any need to recognize a foreign judgment or award also affect the plan.

Q4: How long does debt recovery take?

There is no single completion period. For ordinary domestic commercial cases, the statutory timetable for trial preparation and opening the first-instance hearing is about three to five months after the court accepts the case, allowing for permitted extensions. Hearings can take longer in practice, including where proceedings are suspended or adjourned. Appeals and enforcement add time. Cases with foreign elements and arbitration follow different rules. A settlement follows its agreed payment dates, with default risk considered separately.

Q5: Is it better to accept a reduced settlement?

It can be, where the funded settlement offers a better likely net return than further proceedings. Payment certainty, timing, future costs, and the value of any security all matter. A promise of future installments is not worth the same as funds available for immediate payment.

Q6: What if the debtor cannot pay after a judgment or award?

Available assets and enforcement options help show whether further spending is justified. Rehabilitation or bankruptcy proceedings can become relevant where the debtor is in financial distress. A judgment or award strengthens the legal position but cannot create assets or guarantee full payment.

General Disclaimer

This article is for general informational purposes only, does not constitute legal advice, and does not create a lawyer-client relationship. Vietnamese laws, regulations and administrative practice change over time, and the correct position for any matter depends on its specific facts and the rules in force when action is taken. Verify the current position before relying on anything stated here, and consult qualified counsel on your specific situation.

Read More

Vietnam Data Compliance: 7 Decisions for Foreign Companies Doing Business in Vietnam

For foreign companies, Vietnam data compliance rests mainly on the Data Law, the Personal Data Protection Law, and the Cybersecurity Law, together with their implementing decrees and any sector rules. They govern how a business collects, uses, shares, transfers, stores, and protects information. The duties depend on the data, the activity, and the company’s role. Vietnam continues to legislate in this area, so the starting point for management is not a fixed list of rules but a set of decisions the business needs to get right.

Decisions about data affect how a foreign company enters the Vietnamese market, operates, and works with others. Management needs to know what information the company may use, who may access it, and what responsibilities follow. The seven decisions below cover the main questions from collection and use through sharing, overseas transfers, storage, and deletion.

Why Vietnam Is Strengthening Data Compliance Now

Data has commercial value. E-commerce businesses use purchase histories and browsing information to understand demand and improve sales. AI systems can use large datasets for training, prediction, and product development. The questions are who may use this information, who benefits from it, and how misuse can be controlled.

Vietnam’s policy combines data sovereignty, economic development, and protection of individuals. Here, data sovereignty means Vietnam’s authority to govern data within its legal jurisdiction. That includes the use of valuable national data, access by overseas organizations, and accountability when something goes wrong.

The official text of Resolution 57-NQ/TW links national digital sovereignty with data markets and AI development. The Politburo adopted this policy on December 22, 2024, to advance science, technology, innovation, and national digital transformation. It sets a policy direction; legal obligations come from legislation.

The Data Law expressly treats data as a resource and supports its development into an asset. The main data, privacy, and cybersecurity laws took effect during 2025 and 2026. Together, they give Vietnam data compliance a wider role in business planning, alongside the protection of customer and employee information.

For management, this means checking rights to use data before investing in analytics, AI tools, or a new digital service. A useful dataset may still carry restrictions on reuse, sharing, or overseas processing.

Quick Reference

Data Law: Law No. 60/2024/QH15 took effect on July 1, 2025. It covers digital data, rights to use it, and core and important data.

Personal Data Protection Law: Law No. 91/2025/QH15 took effect on January 1, 2026. It governs information about identifiable individuals.

Cybersecurity Law: Law No. 116/2025/QH15 took effect on July 1, 2026. It covers cybersecurity duties, including local storage for covered service providers.

Sensitive personal data, important data, and core data are different categories. Review domestic sharing, cross-border transfers, and local storage duties separately.

Before using or sharing data, it is important to confirm its source, the permitted purpose, the recipients, and the responsible company. Keep contracts, assessments, and operational controls consistent with those answers.

7 Decisions for Foreign Companies Doing Business in Vietnam

What Data Does Your Company Hold?

The first decision is how far the review reaches and who produces the answer. Most companies hold more data than management expects, and much of it sits outside company systems. Human resources holds recruitment files and payroll records. Sales keeps customer details in a company system and in separate spreadsheets. Production information may sit in equipment software or with a maintenance supplier. Customer, operational, and employee information all count.

A data inventory turns this into something the business can work with: a record of what is held and what happens to it. It should cover shared drives, messaging tools, backups, and copies sent outside the company, and it should record where the information came from, who uses it, and how long it is kept. It is also the point at which a business finds out whether its records are accurate and whether it can correct outdated information.

The Data Law covers digital data more broadly than personal information. Personal data concerns identifiable individuals. A business may also hold equipment readings, product specifications, and commercial forecasts that identify no one.

The legal categories then matter. “Sensitive personal data” is different from “important data” and “core data” under the Data Law. Important and core data are identified using the legal criteria and the applicable government list. Information does not become core data simply because the company treats it as confidential.

Before approving a new use of data, ask what information the business needs, whether it has the right to use it, who will have access, and what they may do with it.

Which Rules Apply to Your Business?

Vietnamese rules can apply to a company with no office in Vietnam. They could reach overseas organizations involved in processing the personal data of Vietnamese citizens, so the question is not where the company is registered but whose data it handles and what it does with it.

Several laws may also apply to the same activity at once for sensitive area i.e. bank or healthcare business. That overlap is normal and it is why the review works better activity by activity than law by law.

Responsibility then depends on the company’s role. A controller decides why and how personal data is processed. A processor handles it on another party’s behalf, and a business may take different roles in different services. The contract wording should match what each party actually does, because the role determines who must prepare and maintain any required impact assessment.

Size affects some duties but not the overall picture. Small enterprises and startups may choose not to apply certain assessment and staffing requirements for a limited period, and household and micro businesses have their own exemptions. None of this is available to a business that provides processing services, handles sensitive personal data, or processes data about a large number of people. The relief is temporary and the other duties continue.

For a foreign company, Vietnam data compliance becomes unclear when work is divided between the local office and headquarters. The local team may believe headquarters has completed the review, while headquarters expects the local team to handle Vietnamese requirements. Agree who will assess each important activity and who will complete the resulting work.

An existing global privacy program can help. Its records and security controls may already cover much of the operation. The remaining task is to compare them with Vietnamese requirements and deal with any gaps.

Can You Use the Data for This Purpose?

Wanting the data is not a legal basis for using it. For personal data, the company must identify a basis recognised by Vietnamese law, which means consent or one of the specified circumstances where processing may take place without it.

Where consent is the basis, it must be a real choice. Silence and preselected settings do not establish valid consent, and the company needs to keep evidence of what the person agreed to. People need to understand what information will be used, for which purposes, and by whom. Sensitive personal data requires additional care and additional information.

Collection limits follow from the same question. A form or software system often allows the company to collect more than it needs, so it is worth asking why each field is there. If the business cannot explain how it uses the information, it should consider whether to collect or keep it at all.

A new purpose needs its own check. Contact details collected to deliver orders are not automatically available to a regional marketing team, and the answer may change depending on who receives the list and whether the information leaves Vietnam. Run that check before the data moves, not afterwards.

Non-personal information raises a different question: does the company have the right to use it? Data received under a contract or license may be restricted to an agreed purpose, so the limits need checking before sharing, reselling, or reusing it. Possession of data does not, by itself, allow every use.

Can You Share or Transfer Data Within Vietnam and Overseas?

The first is whether the company may move the data at all. The second is whether a copy must stay in Vietnam. A transfer assessment does not answer the storage question, and the storage rules do not permit a transfer.

Sharing within Vietnam still needs a basis. Confirm the recipient, the purpose, and the legal or contractual basis, and agree who protects the information and whether it may be passed on.

Cross-border arrangements are wider than they first appear. Overseas access by headquarters, group companies, suppliers, and subcontractors counts, as do cloud storage and backups. Access or processing from abroad can raise transfer requirements even when the main server stays in Vietnam.

Under the Personal Data Protection Law, cross-border transfers generally require an impact assessment file, with exceptions for defined activities. The file describes the transfer, its risks, and the measures used to address them, and it must be prepared and submitted when required. This is not a universal requirement to obtain prior approval for every transfer.

Exceptions are narrow and specific. They cover defined activities rather than categories of company, so an exemption that fits one arrangement will not automatically cover other overseas uses or sharing within a corporate group. Record the reason for relying on one.

For core or important data that is not personal data, the Data Law framework sets separate cross-border assessment procedures. Where the transferred data is also personal data, the personal data protection assessment requirements apply instead. Confirm the data category before deciding which assessments and filings are needed.

Local storage is where the market entry question arises. The Cybersecurity Law addresses enterprises providing services over telecommunications networks, the Internet, and value-added online services in Vietnam. Providers that collect, use, analyze, or process the user data described in the law, including personal information, information about users’ relationships, and data generated by users in Vietnam, must store that data in Vietnam for the period set by the Government. Foreign enterprises within that group must also establish a branch or representative office here.

For a foreign provider, that duty affects whether and how to enter the market, not just where to put a server. Consider it alongside the wider Vietnam market entry strategy, including the activities the local presence may carry out.

Buying an overseas service is different from providing one. Using cloud software does not automatically make every customer subject to the same local storage or local presence requirements, so separate the company’s own duties from the provider’s.

Before approving a sharing or transfer arrangement, confirm the permitted use, required assessments, and any local storage duty. Keep that decision with the contract and review it if recipients, access locations, or purposes change.

What Should Your Supplier Contracts Cover?

Can the supplier use your data to develop its products? Can it share the data with subcontractors? Could it use the information to train an artificial intelligence system? A promise to keep information secure answers none of these, so read the supplier’s terms alongside its description of the service and see which questions are left open.

The agreement should set out permitted uses, access, locations, and security responsibilities, and it should explain how the supplier will help with individual requests and data incidents. Where personal data is involved, the parties need a written arrangement that reflects their actual roles, because the contract is what allocates responsibility between them.

The timing of cooperation matters as much as its existence. If a supplier only promises to report a leak after finishing its investigation, the customer may struggle to meet its own deadlines. Agree how early information will be shared while the investigation continues.

The end of the service deserves the same attention. The company may need its records returned in a usable format before access is closed, so agree what will be deleted, what may need to be retained, and how copies held by subcontractors will be handled.

When buying or licensing data, check whether the seller has the right to supply it for your intended use. Confidentiality, licensing, and ownership also raise questions about intellectual property in Vietnam. A confidentiality agreement can restrict disclosure. It does not, by itself, give either party the right to collect or transfer personal information.

Buying or selling personal data is prohibited unless the law provides otherwise, and data exchanges do not remove that restriction. Foreign legal entities trading through a regulated data exchange must also have a local presence in Vietnam, which can be a commercial presence, branch, or representative office, subject to applicable treaty provisions. A listing does not, by itself, establish the right to trade the data or use it abroad.

How Will You Handle Requests and Data Incidents?

Much of Vietnam data compliance is tested when someone asks a question or reports a problem. An employee receiving a deletion request or discovering a possible leak should know whom to contact, and the person receiving that report needs authority to bring in the right colleagues and suppliers.

Requests may concern access, correction, deletion, withdrawal of consent, or limits on processing. Verify the person’s identity first, then establish what they are asking for, locate the information, and assess the applicable right and any exception. Deletion in particular may involve the local team, headquarters, and several suppliers.

Some records must be kept even when someone asks for deletion, because other laws require their retention. This happens most often with staff records, where employment law in Vietnam sets its own requirements alongside the personal data rules.

If information is exposed, the first steps are stopping further access, preserving evidence, and recording when the incident was discovered. The response team then needs to work out what happened, who may be affected, and what harm could follow. Supplier and customer contracts may require notifications of their own.

The Personal Data Protection Law sets a 72-hour notification duty to the data protection authority for specified violations that may harm protected interests, including national security, public order, and an individual’s life, health, honor, dignity, or property. The period runs from discovery, which means the deadline can fall well before the investigation is complete. Decide which duties apply as early as possible rather than waiting for a full picture.

Not every technical incident triggers that duty in the same way. Processors must promptly notify the controller, affected individuals may also need to be told, and the incident records still have to be kept.

When an authority requests information, verify the request and its legal basis, confirm what must be provided and by when, keep a record of the response, and send the information securely.

To see whether these arrangements work, ask the team what it would do if a supplier exposed a customer file on a Friday evening. Can it reach the right people and obtain the information needed to act?

Who Is Responsible for Data Security and Ongoing Compliance?

Vietnamese law requires organisations to have data protection personnel, so this is an obligation rather than an internal preference. A company may appoint an officer or an internal unit, engage a service provider, or combine both, and the personnel must meet the conditions set by the rules. Eligible small enterprises and startups may set this duty aside for a limited period. Where the business handles core or important data, a responsible person and a data safety unit are required under the data legislation as well.

Security measures then have to fit the information and the risks. Limit access to people who need it, protect accounts and systems, and test backup recovery. Staff should know the rules for handling information and how to report a concern.

The law also expects the company to be able to demonstrate what it did. That is the purpose of the data inventory, the legal basis for processing, notices, consent records, required assessments, supplier agreements, and incident records. These need to be kept current and accessible, because they are the evidence available if an authority asks.

Retention follows the purpose of the data and any legal requirement to keep it. Decide how information will be deleted or made anonymous once it is no longer needed, then check that this actually happens in company systems, exported files, backups, and supplier records. Keep a way to suspend deletion when records must be preserved for a legal matter.

Compliance work also has to keep pace with the business. New software, an acquisition, or a different overseas support team can change who receives information and what they do with it, and these changes often take place without a legal review. Procurement and project teams should know when to ask for one, preferably before signing the contract or uploading the data.

The consequences are financial as well as operational. For organizations, the Personal Data Protection Law sets a general fine ceiling of VND 3 billion for personal data violations. Special ceilings reach 10 times the proceeds from unlawful personal data trading and, for the most serious cross-border transfer violations, 5% of prior-year revenue. These are legal ceilings, not automatic fines, and the amount depends on the conduct and the relevant penalty rules.

Financial exposure is not the only consequence. Corrective measures can also require changes to data use, records, or systems, and these obligations form part of the framework on Vietnam personal data protection penalties.

Step by Step To Review Vietnam Data Compliance

Knowing what to examine is one thing; getting it done across a business is another. The steps below turn the seven decisions into a review a manager can run on a single process, then repeat elsewhere. They describe a management sequence, not a statutory filing procedure.

Step 1. Choose a process and name a coordinator

Start with a business activity where data use is important or a significant change is planned. Name a person who can obtain answers from the local team, headquarters, and suppliers. Agree what the review will cover and when management will consider the findings.

Step 2. Follow the data through the process

Record what is collected, why it is needed, who can access it, and where it goes, including overseas support, exports, backups, and deletion. Check a sample against actual system settings and contracts rather than against the written policy. Use masked examples where possible, so that the review itself does not create unnecessary copies of personal data.

Step 3. Identify the duties and the missing evidence

Check the data categories, each party’s role, the permitted uses, and any overseas transfer or local storage duties, then confirm which notices, contracts, assessments, or filings this arrangement requires. Duties can arise under more than one law at the same time, so record unresolved questions and seek advice on them rather than treating a standard checklist as proof of compliance.

Step 4. Assign and complete the changes

Give each action an owner, a due date, and a record showing it was completed. Changes may include limiting access, updating a notice, or agreeing supplier assistance. If a proposed new use has no confirmed legal basis, resolve that question before the use begins.

Step 5. Test the result

Take the team through two scenarios: an access request from an individual, and a data leak at a supplier. Confirm that they can locate the records, reach the person responsible, and act within the relevant deadline. Correct whatever fails the test and keep the results as evidence. Repeat the review when the process, the provider, or the purpose changes, and when new data legislation takes effect.

Frequently Asked Questions on Vietnam Data Compliance

Q1: Do data transfer rules apply only when files are sent abroad?

No. Review domestic sharing as well as cross-border transfers. Overseas storage, remote access, and processing arrangements may engage cross-border requirements even without moving the main server. The relevant duties depend on the data, the parties, and the activity.

Q2: Can a foreign company use cloud services outside Vietnam?

Yes, provided the arrangement meets the rules that apply to the service and data. Check overseas transfer requirements and any local storage or sector duties. Using a well-known provider does not settle those questions on its own.

Q3: Must data be stored in Vietnam?

Some data must be stored locally when the provider and activity fall within the cybersecurity rules. Telecommunications, Internet, and value-added online services need particular attention. Sector rules may add other duties. There is no general rule requiring every foreign company to keep every type of data exclusively in Vietnam.

Q4: Does GDPR compliance satisfy Vietnamese requirements?

No. GDPR documents and controls can help with the review, but Vietnamese law has its own requirements. The company still needs to check whether its activities and documents meet those rules.

Q5: Does consent allow any use of personal data?

No. Consent must be valid and cover the proposed use. Other duties and prohibitions still apply. Before changing the purpose or sharing information with a new recipient, check whether the new arrangement is permitted.

Q6: Can data be shared between companies in the same group?

Sharing may be possible, but being in the same group is not enough by itself. Check why the recipient needs the information, what it will do with it, and the legal basis. Overseas transfer requirements may also apply.

Q7: Can customer data be used to train an AI model?

Sometimes, but collecting information for one business purpose does not automatically permit AI training. Check the legal basis, stated purpose, supplier terms, and any overseas access. Removing names alone may not prevent people from being identified. Assess the actual dataset and proposed use before making it available.

Q8: What are the penalties for non-compliance?

For organizations, the Personal Data Protection Law sets a general ceiling of VND 3 billion for personal data violations. Special ceilings reach 5% of prior-year revenue in Vietnam for the most serious cross-border transfer violations and 10 times the proceeds from unlawful personal data trading. These are maximum limits; the actual fine depends on the conduct and the penalty rules. Corrective measures may also follow.

Conclusion

At the next management meeting, choose one process and name the person who will lead its review. Ask for the data flow, unresolved questions, and actions needed before approving a new arrangement. That turns Vietnam data compliance into decisions the business can follow through.

General Disclaimer

This article is for general informational purposes only, does not constitute legal advice, and does not create a lawyer-client relationship. Vietnamese laws, regulations and administrative practice change over time, and the correct position for any matter depends on its specific facts and the rules in force when action is taken. Verify the current position before relying on anything stated here, and consult qualified counsel on your specific situation.

Read More

Vietnam Construction and Real Estate Penalties: 7 Key Points Under Decree 339

The Government introduced Decree 339 to make enforcement of construction and property rules more consistent and address problems in applying the previous penalty decree. It sets out which violations can be penalized, who can be held responsible and what must be done to correct particular failures. 

Vietnam construction and real estate penalties changed on August 26, 2026, when Decree No. 339/2026/ND-CP was issued and took effect on the same day. It replaced Decree No. 16/2022/ND-CP and covers construction, technical infrastructure, housing management and development, and real estate business.

For management, the immediate task is to review work in progress, customer money and outstanding handovers. Depending on the violation, a fine may be accompanied by restrictions on operations or an order to stop work, correct documents, return money or complete a handover.

Quick Reference

The seven points to check under Vietnam Construction and Real Estate Penalties Under Decree 339 cover responsibility and timing, land use and construction approvals, property eligibility, customer money and contracts, brokers, trading floors, and apartment maintenance funds. The applicable penalties depend on the activity, the responsible party and whether the violation has ended. A fine may also come with restrictions on operations or an order to correct the failure.

What Decree 339 Changes

Vietnam Construction and Real Estate Penalties Under Decree 339 sets out administrative violations, penalties and corrective measures. The underlying duties must still be read under the applicable construction, housing and real estate legislation. The replacement of the penalty decree does not mean every duty described below is new.

The rules apply to Vietnamese and foreign organizations and individuals committing covered violations in Vietnam. Each business should focus on its actual role. A developer, an individual broker and a building management board do not have the same obligations.

Seven Points for Management to Check

Responsibility and the Date of the Violation

A project may involve several companies, a contractor and an outside sales agency. Management should identify which party has each legal duty and who holds the supporting records. An internal assignment helps organize the work; it does not by itself change the party legally responsible.

The limitation period for administrative penalties is one year for real estate business and technical infrastructure management, and two years for construction and housing management or development. For a completed violation, the period runs from its legally determined end date. For a continuing violation, it runs from detection. These periods are not fixed cutoffs for reviewing old records; a failure that began years ago may still be continuing.

The transition rule generally applies the rules in force when the violation occurred to conduct completed before August 26, 2026. Conduct that began earlier and was still continuing when Decree 339 took effect is handled under the new Decree. 

An unresolved problem is not automatically a continuing violation. The Decree contains specific rules for deciding when certain acts end. For example, the end date for a failure to hand over apartment maintenance funds is tied to full handover. Dated bank records and handover documents can therefore be important.

Construction Approvals and Actual Work

The project team should compare the work on site with the approved design and the construction permit, where a permit is required. The review should also cover site handover, the relevant construction contract, approved construction drawings and the commencement notice.

A site that is ready for workers may still lack a legal condition for starting. Missing commencement conditions can require construction to stop until they are met. Changes to the design or the work should be checked before they are carried out.

The permitted land use needs a separate review. The Decree directs violations involving construction on land used for the wrong purpose to the land-law penalty decree. Outside that specific case, works that breach both land and construction law are handled under both decrees. A construction review should therefore include the land documents and any required change of land-use purpose. 

A foreign contractor should separately need to check whether its work requires a construction operation license in Vietnam. The owner’s construction permit does not replace the contractor’s own licensing requirements.

Property Eligibility and Sales Information

Before a property is offered for sale or lease, the company should confirm that the proposed transaction is legally permitted. The documents needed will depend on whether the property is completed, still under construction or part of a project involving land with infrastructure.

The review should cover the relevant land and project documents, construction and acceptance status, mortgages, buyer eligibility and required public information. These are also central to real estate due diligence in Vietnam.

Sales information should reflect the current legal position. A change to the mortgage or project status may require a disclosure update. Management should make sure that sales staff and outside agents receive the same approved information before they make commitments to customers.

Customer Payments and Contract Terms

The bank-payment rule covers project developers, real estate businesses and real estate service enterprises, including brokerage and trading-floor companies. Customer payments under real estate or real estate service contracts must pass through an account at a domestic credit institution or a foreign bank branch operating lawfully in Vietnam. Finance teams should check the account stated in the contract against the account actually receiving the money.

For off-plan property, the Law on Real Estate Business limits a developer’s deposit to 5% of the sale or lease-purchase price. The property must already meet the legal conditions for being put into business before the deposit is collected. The agreement must state the price. A deposit within the 5% cap can still be unlawful if collected too early. 

The review should also cover the amount and timing of later payments and the permitted use of customer funds. Sales staff and outside agents should use payment terms that reflect the project’s current legal status.

Off-plan housing also needs a separate bank-guarantee check. The developer should confirm the required bank approval and guarantee commitment, and when the buyer must receive a guarantee letter. The Decree recognizes an exception to providing the buyer-specific letter where the buyer refuses the guarantee. That refusal does not remove the requirements for the developer’s bank approval and guarantee commitment. 

The required contract model and mandatory terms should be checked before signing. A property sale contract in Vietnam should clearly address payment conditions, handover, title documents and refunds. Improper collection or use of customer money may lead to repayment and related interest or other corrective measures, depending on the applicable provision.

Individual Brokers and Brokerage Companies

Each person practicing real estate brokerage must have the required certificate and work within a real estate brokerage company or a real estate trading-floor company. The individual broker must also follow the operating rules of that enterprise. The company has separate duties concerning its rules, facilities, reporting and pre-operation information submission.

The requirement for a brokerage company to have at least one certified individual does not allow its other brokers to practice without certificates. Management should check the people actually handling transactions, including those engaged through outside arrangements. 

Property information supplied by the company and its brokers must be complete and truthful as required by law. A practical review should compare their statements to customers with the documents supporting the listing.

Real Estate Trading Floors

A company operating a real estate trading floor should review its operating license and the qualifications of its manager. The review should include its facilities, published transaction procedure, property information, transaction confirmations, retained records and required reports.

Changes to registered information may require a filing. The operator should also confirm that the brokers it contracts with are qualified and that properties placed on the trading floor meet the legal conditions for business.

Certain failures can lead to a suspension of trading-floor services. The operator should identify which condition is missing and what must be corrected before relying on the business to continue handling transactions.

Apartment Management and Maintenance Funds

The developer, the apartment operator and the building management board have separate duties. A building management board is treated as an organization for penalties; individual board members may separately face penalties for their own breaches. The review should also distinguish the maintenance fund for common property from money collected for day-to-day building operations. 

For the developer, the maintenance-fund review starts with the correct account, required account notices and information in sale or lease-purchase contracts. It also covers the contribution calculation, including qualifying areas retained or not yet sold by the developer, and the handover of the fund and accrued interest when due.

The first apartment meeting, building records and handover documents also need attention. A building occupied by residents may still have outstanding developer obligations.

The apartment operator must meet its operating requirements and report as required to the board and apartment meeting. The board has duties concerning receipt of records and funds, its maintenance account, financial rules and disclosure of expenditure. Where required, board members must complete the relevant training.

Management should reconcile the amount due, the amount held in the bank and the amount transferred. Any difference should have an explanation and supporting documents. An order to reimburse misused funds or complete a handover may apply in addition to a fine.

In short, for managing the risks of Vietnam Construction and Real Estate Penalties Under Decree 339, the management should begin with activities still taking place and obligations that remain unpaid or incomplete. Each issue needs a responsible person, a correction date and evidence that the required action has been completed.

Frequently Asked Questions

Q1: How Large Can Vietnam Construction and Real Estate Penalties Be?

The maximum fine for an organization is VND 1 billion in construction and real estate business, and VND 300 million in technical infrastructure and housing management or development. These are statutory ceilings, not the fine for every violation. The applicable amount depends on the specific act and the rules governing the penalty.

Q2: Do the Same Fine Amounts Apply to Individuals?

Generally, an individual faces half the organizational fine for the same act. Individual rates also apply to households and registered household businesses. Some provisions state an individual fine directly, including certain breaches by brokers and individual building management board members.

Q3: Does Correcting a Problem Remove Liability for the Earlier Violation?

Correction does not automatically erase an earlier violation. It may end a continuing failure or satisfy a required corrective measure. The dates, applicable rules and limitation period still need to be reviewed.

Q4: Does Paying the Fine Allow the Business to Continue?

Not necessarily. For specified violations, additional sanctions include suspension of construction activity in Vietnam for one to six months or real estate business for three to six months. The right to use a construction practice certificate may be suspended for six to twelve months, or a construction permit for three to twelve months. These sanctions depend on the particular violation; they do not accompany every fine. Payment of a fine does not replace a missing approval or make an ineligible transaction lawful.

Conclusion

Decree 339 gives developers and property businesses a reason to review how their current work is being carried out. A focused review of construction approvals, sales, customer money and apartment funds can identify what needs correction before the next transaction or handover. Management should confirm that each agreed correction has actually been completed.

General Disclaimer

This article is for general informational purposes only, does not constitute legal advice, and does not create a lawyer-client relationship. Vietnamese laws, regulations and administrative practice change over time, and the correct position for any matter depends on its specific facts and the rules in force when action is taken. Verify the current position before relying on anything stated here, and consult qualified counsel on your specific situation.

Read More