Data protection clauses in contracts are essential legal instruments that enable enterprises to safeguard sensitive information, clearly allocate responsibilities among the parties, and mitigate legal risks. The following article provides an in-depth analysis of the concept, contents, duration of application, relevant legal regulations, and frequently asked questions, while also guiding enterprises on how to properly and effectively implement such clauses in all types of contracts.

I. The impact of data protection clauses in contracts on enterprises

Data protection clauses in contracts have a direct impact on the business operations and reputation of enterprises. They not only ensure the confidentiality of sensitive information but also clearly define the legal responsibilities of the contracting parties.

When such clauses are included, enterprises can reduce the risk of data breaches, enhance trust from partners and customers, and comply with legal requirements on data protection. The absence or inadequate implementation of data protection clauses may result in legal disputes, reputational damage, and financial losses for enterprises.

II. Understanding data protection clauses in contracts

Data protection clauses in contracts constitute an important component that helps the parties clearly identify their obligations, responsibilities, and the scope of data processing, thereby ensuring information security and compliance with regulations on personal data protection.

1. What is a data protection clause in a contract?

A data protection clause in a contract is a legal provision incorporated into an agreement between the parties to regulate the collection, use, storage, sharing, and protection of personal data or sensitive data. Such a clause ensures that all parties properly execute their data confidentiality obligations, comply with applicable laws, and minimize legal risks and data-related damages.

2. What types of information can be protected under the data protection clause in the contract?

Pursuant to Article 2 of Decree No. 13/2023/ND-CP and related regulations, the data protection clause in the contract may protect various categories of information, including basic personal data, sensitive personal data, enterprise information, and technical data, specifically:

  • Basic personal data (Clause 3): Full name, date of birth, gender, place of birth, permanent residence, nationality, image, phone number, citizen identification number/passport number, marital status, family information, personal accounts, online activity history, and other information identifying a specific individual.
  • Sensitive personal data (Clause 4): Political opinions, religious beliefs, health status, private life, genetic characteristics, biometric attributes, sexual life, criminal records, banking customer information, geolocation data, and other specific data requiring strong protection.
  • Enterprise data: Business information, strategies, trade secrets, financial statements, customer and partner data, and product development plans.
  • Technical and system data: Passwords, source codes, system configurations, and internal databases.
  • Contractual and transaction data: Information relating to transactions, payments, contractual terms, and communication records.

Clearly defining the categories of data to be protected in contracts not only helps the parties fulfill confidentiality obligations but also minimizes legal risks, protects the rights and interests of individuals and organizations, and ensures compliance with the Law on Personal Data Protection 2025 and Decree No. 13/2023/ND-CP.

3. Why should all contracts include data protection clauses? 

All contracts should include a data protection clause to ensure information security, legal compliance, and risk mitigation for the contracting parties.

  • Protection of personal data and sensitive information: Such clauses clearly identify the types of data subject to protection, the methods of processing, storage, and sharing, thereby preventing leakage of personal or critical enterprise information data.
  • Legal compliance: Under the Law on Personal Data Protection 2025 and its guiding regulations, data protection is a statutory obligation. Incorporating such clauses enables organizations to demonstrate compliance and avoid violations.
  • Dispute risk mitigation: In the case of a data-related incident, the clause clarifies the rights, obligations, and liabilities of the parties, thereby reducing the risk of litigation or legal disputes.
  • Enhancement of credibility and trust: Business partners, customers, and regulatory authorities place greater trust in enterprises that strictly comply with data protection regulations, thereby strengthening reputation and competitive advantage.

In summary, data protection clauses in contracts are not merely preventive measures but are also vital legal tools enabling enterprises to manage information effectively and transparently.

4. How long can the data protection clause in the contract remain effective, and can it be extended?

The data protection clause in the contract may remain effective throughout the contract term and may be extended upon agreement between the parties. Similar to confidentiality obligations concerning trade secrets and technological secrets under Clause 2, Article 21 of the Labor Code 2019 and Clause 2, Article 4 of Circular No. 10/2020/TT-BLDTBXH, the duration may be flexible and need not be fixed, provided that the parties clearly agree on the scope and methods of data protection.

5. What main contents are typically included in the data protection clause in the contract? 

To ensure information security and minimize legal risks, modern contracts should contain data protection clauses with clear and comprehensive core contents, including:

  • Definition of protected data: Clearly identifying categories of data, including basic personal data, sensitive personal data, sensitive enterprise information, trade secrets, and technological secrets.
  • Scope of data use: Defining permitted purposes and limitations of data processing, as well as authorized access and usage.
  • Responsibilities and obligations of the parties: Commitments to implement data protection measures, comply with legal requirements, and ensure information security and confidentiality.
  • Duration and conditions of data protection: Specifying the term of application, including extension or termination mechanisms, similar to regulations on trade secret and technology confidentiality.
  • Measures for handling violations: Establishing mechanisms for addressing breaches, including compensation for damages, legal liability, and technical or managerial remedial measures.
  • Confidentiality in data transfers to third parties: Clearly defining third-party responsibilities for data protection in cases of entrustment or third-party services .

Incorporating these contents ensures contractual clarity, protects the parties’ interests, and reduces legal risks.

III. Legal regulations relevant to data protection clauses in contracts

To lawfully implement data protection clauses in contracts, enterprises must be well-versed in applicable legal regulations, ranging from the Law on Personal Data Protection 2025 to relevant decrees and guiding circulars.

1. How does Vietnamese law regulate data protection clauses in contracts?

Vietnamese law regulates data protection clauses in contracts to ensure lawful processing, storage, and sharing of data, protect the parties’ interests, and limit legal risks.

  • Under Article 2 of Decree No. 13/2023/ND-CP, data protection clauses may apply to all types of data, including basic personal data, sensitive personal data, enterprise data, and other confidential information.
  • Decree No. 13/2023/ND-CP (Article 3) sets out principles of personal data protection, requiring lawful, purpose-specific, appropriate, and limited processing; proper protection, updating, and storage of data; and compliance with and demonstration of  these principles by data controllers. Article 26 of the Decree prescribes data protection measures, including managerial, technical, state-administered, investigative, procedural, and other lawful measures.
  • The Law on Personal Data Protection 2025 (Article 8) requires parties to implement data protection measures as agreed in contracts and imposes liability for compensation in cases of violations.
  • The Labor Code 2019 (Clause 2, Article 21) and Circular No. 10/2020/TT-BLDTBXH (Clause 2, Article 4), which regulate the protection of trade secrets and technological secrets in labor contracts, may be referenced to determine duration, scope, and methods of information protection in contracts.

Accordingly, data protection clauses in contracts are both a legal requirement and a critical tool for risk management, data protection, and allocation of legal responsibility among the parties.

2. Who is responsible for implementing data protection clauses in contracts?

In data protection contracts, the Data Controller takes primary responsibility for implementing security measures, maintaining logs, notifying data breaches, and ensuring the rights of data subjects (Article 38, Law on Personal Data Protection 2025).

The Data Processor may only process data in accordance with the contract, implement protection measures, and take liability for damages arising from its processing activities (Article 39, Decree No. 13/2023/ND-CP). Any third parties involved must also comply with the agreed data protection clauses. Clear allocation of responsibilities among the parties helps minimize legal risks and ensure effective data protection.

3. Can compensation be claimed if a party violating the data protection clause fails to execute its obligations?

Data protection clauses not only define obligations but also establish a legal basis for claiming compensation in a case of a breach.

  • Under Article 548 of the Civil Code 2015, any organization or individual causing damage to others through unlawful acts must fully compensate for actual damages incurred.
  • Under Article 8 of Decree No. 13/2023/ND-CP, parties violating personal data protection regulations may be required to compensate for damages, including data-related losses and consequential damages, as well as taking administrative sanctions or criminal liability. 

Therefore, where a contracting party fails to fulfill its data protection obligations, the aggrieved party is entitled to claim compensation in accordance with these provisions to protect its lawful interests and deter violations.

IV. Questions regarding data protection clauses in contracts

The application of data protection clauses in contracts often raises questions regarding scope, responsibility, and legal consequences, which enterprises must clarify to ensure compliance and minimize risks.

1. Should data protection clauses be included in all types of contracts, or only in certain contracts? Why?

Enterprises should consider incorporating data protection clauses in most contracts, particularly those involving the exchange or processing of personal or sensitive data. It helps protect information, limit legal risks, and clearly define responsibilities in data handling.

Contracts not directly involving data may not strictly require such clauses; however, it should still be considered whether significant data may arise. Such an approach aligns with the spirit of the Law on Personal Data Protection 2025 and fundamental data protection principles.

2. In what cases may the data protection clause in the contract be deemed unlawful?

The data protection clause may be deemed unlawful if it violates fundamental rights of data subjects or contravenes legal provisions governing civil transactions.

If the clause compels data subjects to waive fundamental rights, such as the right to be informed or the right to withdraw consent, or violates prohibited acts such as unlawful disclosure of personal data under Article 7 of the Law on Personal Data Protection 2025, it may be considered illegal.

Pursuant to Articles 117 and 122 of the Civil Code 2015, a civil transaction is valid only if it is entered into voluntarily, and its purpose and content do not violate prohibitions of law or social ethics. If the data protection clause breaches these principles, the relevant transaction may be declared invalid.

Accordingly, to be lawful, data protection clauses must respect data subject rights and comply with the validity conditions of civil transactions under Vietnamese law.

3. If an enterprise uses outsourced services, must the data protection clause be added to the contract?

When enterprises engage third-party service providers, supplementing contracts with data protection clauses is essential to ensure compliance with personal data protection obligations.

Under Articles 38 and 39 of Decree No. 13/2023/ND-CP, the Data Controller is responsible for selecting suitable Data Processors, ensuring protection measures, and coordinating responses in cases of violations.

Contracts with third parties must clearly specify the scope and purpose of data processing, protection measures, compensation liability for incidents, and obligations to delete or return data upon termination of services. Such terms enable enterprises to demonstrate compliance and mitigate legal risks associated with improper data processing.

Therefore, when outsourcing services, enterprises are required to include data protection clauses in contracts to ensure legal responsibility and protect data subject rights.

4. If a data breach occurs, what liabilities may be stipulated in the data protection clause?

In a case of a data breach, the data protection clause may stipulate specific liabilities of the parties involved.

Under Article 8 of the Law on Personal Data Protection 2025, violating organizations or individuals may be subject to administrative sanctions, criminal liability, or compensation obligations, depending on the nature, severity, and consequences of the breach.

Contracts may specify compensation obligations, remedial measures, timely notification duties, and compliance with legal procedures to mitigate damage. Applicable administrative sanctions may include fines of up to 3 billion VND for general violations, ten times the illicit proceeds for data trading offenses, or up to 5% of the preceding year’s revenue for violations involving cross-border data transfers.

Accordingly, data protection clauses must clearly define legal liability and compensation to protect enterprises and data subjects while ensuring compliance with the Law on Personal Data Protection 2025.

5. How should the parties handle unclear data protection clauses in contracts?

Where the data protection clause in the contract is unclear, the parties must reasonably amend and interpret it to determine their rights and obligations.

Under Article 121 of the Civil Code 2015, ambiguous transactions are interpreted based on the actual intent of the parties, the purpose of the transaction, and relevant customs. Article 404 of the Civil Code 2015 provides that unclear contractual clauses must be interpreted in light of the entire negotiation and execution process, rather than solely on the wording.

Therefore, when data protection clauses are ambiguous, the parties should revise the provisions to clarify rights and obligations, and interpret them based on intent, contractual purpose, and practical implementation to ensure legality and effectiveness.

V. Are you looking for a reputable law firm to assist with data protection clauses in contracts?

If you require assistance in drafting or reviewing data protection clauses in contracts, NPLaw provides legal consultancy, clause drafting, and guidance on handling data breaches, helping enterprises protect information securely and comply with applicable laws.

The above information is for reference purposes only. For case-specific advice, please contact NPLaw for immediate consultation.