At present, data is regarded as a valuable asset of enterprises. Accordingly, disputes arising from breaches of clauses in data transfer agreements are increasingly common. Such breaches may directly affect economic interests, data exploitation rights, confidentiality obligations, and the reputation of the parties. The following article outlines the current situation, the concept, causes, legal consequences, and handling measures in cases of breach of clauses in data transfer agreements, and explains why enterprises should seek timely advice from specialized legal counsel.
At present, data is regarded as a valuable asset of enterprises. Accordingly, disputes arising from breaches of clauses in data transfer agreements are increasingly common. Such breaches may directly affect economic interests, data exploitation rights, confidentiality obligations, and the reputation of the parties. The following article outlines the current situation, the concept, causes, legal consequences, and handling measures in cases of breach of clauses in data transfer agreements, and explains why enterprises should seek timely advice from specialized legal counsel.
I. Current situation relating to breaches of clauses in data transfer agreements
In practice, breaches of clauses in data transfer agreements are on the rise as enterprises increasingly depend on data for operations, analytics, and business development. Data transfers take place not only between enterprises and their business partners, but also with service providers, data processors, and relevant third parties.
Common forms of breach include exceeding the agreed scope of data use, unauthorized disclosure of information, failure to ensure security standards, or onward transfer of data to another party without the data provider’s consent. In many cases, breaches arise from an inadequate understanding of newly enacted regulations on data protection and information security.
Such a situation has led to numerous disputes concerning rights, obligations, and compensation for damages, while at the same time increasing compliance pressure on enterprises. As the legal framework becomes increasingly stringent, the legal consequences of such breaches become more severe, compelling the parties to pay greater attention to risk management, contract control, and security systems when conducting data transfers.
II. Concept of breach of clauses in data transfer agreements
To effectively handle breaches of clauses in data transfer agreements, it is necessary to clearly understand the relevant concepts and causes.
1. What constitutes a breach of clauses in a data transfer agreement?
Contractual clauses specify the agreements reached by the parties during negotiation and execution of the contract. Accordingly, the parties are obliged to comply with and respect such clauses.
A breach of clauses in a data transfer agreement refers to an act whereby one party fails to perform, improperly performs, or performs contrary to the clauses of the data transfer agreement. In essence, it constitutes a breach of contractual obligations as prescribed in Clause 1, Article 351 of the Civil Code 2015.
Where a breach of clauses in a data transfer agreement occurs, the breaching party not only takes civil liability and, where damage is caused, an obligation to compensate for damages pursuant to Article 360 of the Civil Code 2015, but may also be subject to contractual sanctions in accordance with Article 418 of the Civil Code 2015.
2. When is a breach of clauses in a data transfer agreement deemed serious?
A breach of clauses in a data transfer agreement is deemed serious when the breach renders the contractual purpose unattainable or causes substantial damage to the other party.
In data transfer agreements, the contractual purpose typically relates to rights to exploit data, processing purposes, confidentiality, analytics, business operations, or service provision. A breach that renders the contractual purpose unattainable may occur where the transferred data cannot be used in the agreed format, lacks integrity, fails to meet quality requirements, or does not correspond to the agreed data category. Substantial damage in the context of a data transfer agreement may be economic, technical, or legal in nature. Economic damage may include loss of commercial opportunities, loss of customers, incident response costs, compliance costs, or legal expenses.
A breach that renders the contractual purpose unattainable does not necessarily have to concurrently cause substantial damage, and vice versa. For example, providing data in an incorrect format may prevent the exploitation of data for the intended purpose without causing significant pecuniary loss. Conversely, disclosure of confidential data or unauthorized transfer to a third party typically leads to both commercial and legal consequences, simultaneously rendering the contractual purpose unattainable and causing substantial damage.
3. Common causes leading to breaches of clauses in data transfer agreements
Breaches of clauses in data transfer agreements often arise from the parties’ insufficient awareness of the legal value and risks associated with data. In practice, many enterprises execute contracts without clearly defining the scope of data use, data control rights, confidentiality obligations, or conditions for onward transfer, thereby leading to disputes during implementation.
Another common cause is non-compliance with specialized legal regulations, particularly those concerning personal data. Pursuant to Article 7 of Decree No. 356/2025/ND-CP, the transfer of personal data must be based on a valid legal ground and must ensure confidentiality, purpose limitation, and the consent of data subjects. Where these conditions are not satisfied, the use or disclosure of data beyond the contractual scope is likely to be deemed a breach.
In addition, technological factors and inadequate internal processes also contribute to breaches. Weak data governance systems, lack of cybersecurity measures, or insufficient control over third parties increase the risk of data leakage or loss, thereby causing damage and triggering liability for compensation under civil law, data protection regulations, and contractual liability clauses.
III. Legal provisions relating to breaches of clauses in data transfer agreements
Where breaches of clauses in data transfer agreements occur, the following legal issues are relevant:
1. How should the data transfer process be regulated in contracts?
The data transfer process should be agreed upon by the parties in the contract in terms of scope, method, timing, conditions, and responsibilities, in compliance with applicable legal regulations governing data transfers. In particular, with respect to personal data, compliance with procedures on security, consent, and notification under Article 7 of Decree No. 356/2025/ND-CP is required.
In practice, a typical data transfer process includes:
- Determination of data scope and purposes: The parties agree on the types of data, scope of processing, duration, and purposes of use.
- Agreement on transfer methods and technical standards: The data format (files, databases, APIs, etc.), transmission methods (online/offline/system integration), and information security measures are specified.
- Notification and recording of the transfer: The transferring party notifies the timing, volume, and status of the data transfer. Where personal data is involved, the consent of the data subject is required according to Point (a), Clause 1, Article 17 of the 2025 Law on Personal Data Protection, and notification obligations toward data subjects must be fulfilled.
- Data transfer and transmission: The transfer is conducted in accordance with the agreed structure, content, and format, with measures applied to prevent loss, leakage, or distortion.
- Acceptance and confirmation of data: The receiving party verifies the completeness, accuracy, and usability of the data, and the parties record and confirm the acceptance in writing.
- Allocation of risks and responsibilities after transfer: The parties determine the point at which risk transfers (upon delivery or upon acceptance). Confidentiality obligations continue throughout the period of data use.
- Handling of data upon expiry of purpose: The parties must delete, return, or cease exploitation of the data in accordance with the agreement.
Where the process is designed in a detailed and rigorous manner, the likelihood of breaches and related disputes is significantly reduced.
2. How do breaches of clauses in data transfer agreements affect the rights and interests of the parties?
Breaches of clauses in data transfer agreements may directly or indirectly affect the parties’ rights and interests in various aspects, including economic interests, data exploitation rights, commercial reputation, and arising legal obligations. Main impacts include:
- Rights to exploit and use data: If the transferring party fails to provide the correct type, quality, format, or timely delivery of data, the receiving party’s ability to exploit the data for the agreed purposes may be restricted, causing business losses.
- Rights to confidentiality and data control: If the receiving party uses data beyond the agreed purpose, provides it to third parties, or allows data leakage, the transferring party’s confidentiality and data control rights are infringed.
- Financial and commercial interests: A breach may result in one party failing to receive corresponding payment for transferred data, while the other party incurs incident response costs, compensation liabilities, or technical remediation costs.
- Reputation and business relationships: Data often relates to business strategy, customers, or technological products. Contractual breaches may undermine reputation and harm relationships with customers and partners, particularly in the context where data has become a core asset of enterprises.
Breaches of clauses in data transfer agreements may therefore directly impair financial interests, data exploitation rights, and the reputation of the parties.
3. How should the parties handle breaches of clauses in data transfer agreements once detected?
Upon detecting a breach of clauses in a data transfer agreement, the parties should take the following steps:
- Verification of the breach and collection of evidence: Identifying the acts constituting the breach (e.g., breach of content, timing, scope of use, confidentiality, data leakage, or provision of incorrect data) and establishing the causal connection between the breach and the damage incurred.
- Notification of breach and request for remedial measures: The non-breaching party should issue a formal notice, in accordance with the contract, requesting explanations and remedial actions from the breaching party.
- Negotiation and application of contractual remedies: Data transfer agreements commonly provide for remedies such as technical rectification, re-provision of data, suspension of data use, contractual sanctions, or reduction of payment value, as agreed by the parties.
- Claim for damages or termination in cases of serious breach: If the breach renders the contractual purpose unattainable or causes substantial damage, the non-breaching party may terminate the contract according to Article 428 of the Civil Code 2015 and claim damages under Articles 360 and 361 of the Civil Code 2015.
- Dispute resolution through mediation, arbitration, or court proceedings: If negotiations fail, the dispute resolution mechanism specified in the contract should be applied. Data contract disputes are currently primarily resolved through commercial arbitration or courts, depending on the parties’ agreement.
Timely handling in accordance with proper procedures and legal grounds helps mitigate risks, protect rights and interests, and limit damage, particularly in the context where data is a valuable asset subject to increasingly stringent regulation.
4. What legal consequences may arise from breaches of clauses in data transfer agreements?
Where breaches of clauses in data transfer agreements occur, the breaching party may take the following legal consequences:
- Liability for compensation for damages where the breach causes damage to the non-breaching party, according to Clause 1, Article 351 and Articles 360 and 361 of the Civil Code 2015.
- Where the parties have agreed on contractual sanctions, the breaching party must pay sanctions in accordance with Article 418 of the Civil Code 2015.
- Where the breached clause is material and the breach renders the contractual purpose unattainable or causes substantial damage, the non-breaching party may terminate the contract according to Clause 1, Article 428 of the Civil Code 2015.
- In particular, where the breach involves violations of personal data regulations, such as cross-border transfers of personal data or trading in personal data, administrative sanctions or criminal liability may be imposed, depending on the nature, severity, and consequences of the violation, in accordance with Clause 1, Article 8 of the Law on Personal Data Protection 2025.
Breaches of clauses in data transfer agreements may therefore lead to multiple legal consequences, adversely affecting the normal operations and reputation of the parties.
IV. Questions regarding breaches of clauses in data transfer agreements
1. Can breaches of clauses in data transfer agreements lead to criminal liability?
Breaches of clauses in data transfer agreements may lead to criminal liability only in exceptional circumstances where the conduct exceeds the scope of civil liability and constitutes criminal offenses under the Penal Code 2015 as amended in 2017 and 2025.
Where breaches involve business secrets, customer secrets, financial registration information, technology, or sensitive personal data, and involve acts of misappropriation, disclosure, trading, or unlawful use causing substantial damage, affecting multiple organizations or individuals, or involving customer data in the banking, finance, e-commerce, or telecommunications sectors, criminal prosecution risks are heightened. Relevant offenses may include violations of regulations on banking activities and other banking-related activities (Article 206 of the Penal Code 2015, as amended by Clause 48, Article 1 of the amended Penal Code 2017), and unlawful collection, storage, exchange, trading, or disclosure of bank account information (Article 291 of the Penal Code 2015, as amended by Clause 48, Article 1 of the amended Penal Code 2017).
2. May the parties agree on measures for handling breaches of clauses in data transfer agreements?
The parties may agree on measures for handling breaches of clauses in data transfer agreements, provided that such agreements do not contravene prohibitions of law (Clause 1, Article 398 of the Civil Code 2015).
Article 360 of the Civil Code 2015 provides that, where damage is caused by a breach of obligation, the obligor must compensate in full unless otherwise agreed by the parties. Accordingly, the parties may agree on remedial measures in the case of damages arising from breaches of contractual clauses. In addition, Article 418 of the Civil Code 2015 permits the parties to agree on contractual sanctions, whereby the breaching party must pay a sum of money to the non-breaching party, with the penalty amount determined by agreement.
The parties may agree on multiple remedies for breaches in data transfer agreements as a means of mitigating dispute risks. However, with respect to personal data or sensitive data, such agreements must comply with mandatory legal provisions.
3. Can breaches of clauses in data transfer agreements lead to termination of the contract?
Breaches of clauses in data transfer agreements may lead to termination of the contract. Clause 1, Article 428 of the Civil Code 2015 provides for unilateral termination of contracts. Where a breach of clauses in a data transfer agreement constitutes a serious breach of contractual obligations, the other party has the right to unilaterally terminate the contract without liability for damages.
In practice, certain breaches are commonly regarded as serious, such as breaches of clauses on data quality and usability (e.g., transfer of incorrect data or data that cannot be used for the agreed purposes), breaches of confidentiality and non-disclosure obligations (e.g., data leakage or unauthorized disclosure to third parties), and breaches of clauses on security and safety of data processing systems (e.g., failure to ensure system security).
Cases leading to termination typically involve material clauses of the contract and are recognized by law as grounds for termination where they render the contractual purpose unattainable or cause substantial damage.
4. How can breaches of clauses in data transfer agreements be prevented?
To mitigate the risk of contractual breaches, the parties should clearly stipulate the purpose of transfer, scope of data, duration, security measures, and responsibilities in the cases of breaches at the negotiation stage. Detailed clauses help avoid interpretational disputes and provide a basis for determining breaches under both contractual and legal standards.
The parties should implement technical measures to ensure data security, such as encryption, access control, logging systems, and real-time monitoring of transfers. At the same time, internal compliance and governance mechanisms should be established, including approval procedures, data handover processes, personnel training, and periodic risk assessments.
In particular, clauses on incident response and remediation should be included, clearly specifying response timelines, cooperation obligations, remediation roadmaps, and compensation responsibilities in the cases of data breaches or unauthorized use. These measures are important to reduce the risk of contract termination, minimize damage, and avoid regulatory liabilities.
5. What remedial measures may be applied when breaches of clauses in data transfer agreements occur?
Where breaches of clauses in data transfer agreements occur, the following remedial measures may be applied:
- Technical remediation or supplementation of data: Applied where data is defective, incomplete, incorrectly formatted, unusable for agreed purposes, or causes system disruption. The breaching party must rectify defects, re-transfer data, or supplement data within a specified timeframe.
- Temporary suspension of data transfer or processing: Pursuant to confidentiality, personal data protection, or system security clauses, the non-breaching party may request suspension to investigate, assess risks, and prevent further harm.
- Claims for damages: Where the breach causes actual damage (financial, data-related, reputational, or remediation costs), the breaching party must compensate pursuant to Clause 1, Article 351 and Article 360 of the Civil Code 2015. Where contractual sanctions are agreed, sanctions may also be claimed according to Article 418 of the Civil Code 2015.
- Amendment of the contract or extension of timelines: Applied where the breach is not serious or is remediable. The parties may agree to amend clauses on transfer methods, data standards, timelines, or access rights.
Where breaches of clauses in data transfer agreements occur, the parties may apply multiple remedial measures to minimize damage and reduce the risk of unnecessary disputes.
V. Why seek legal advice from NPLaw in cases of breach of clauses in data transfer agreements
NPLAW has a team of lawyers with in-depth expertise in data-related contracts and the latest legal regulations, providing accurate advice when breaches occur. Support from the prevention stage through dispute resolution helps clients maximize protection of their rights and mitigate risks. The firm also assists with negotiation, contract drafting, remediation of breaches, and the application of appropriate legal measures. It is a reliable choice for enterprises seeking to ensure compliance and security in data transfers.
Breaches of clauses in data transfer agreements are becoming an increasingly complex legal issue as data grows in value for enterprises. Proactive risk identification, robust contractual clauses, and proper handling of breaches help minimize damage and safeguard the parties’ interests. In the context of an increasingly comprehensive and stringent legal framework governing data, enterprises should proactively establish prevention, compliance, and security mechanisms. Where disputes or risks of breach arise, consulting specialized legal counsel is a prudent and effective solution to protect legitimate rights and interests.
The above information is for reference purposes only. For advice on specific cases, please contact NPLAW for prompt consultation.
