Data compliance the hidden clause in cross border Vietnam deals

Cross-border deals in Vietnam now carry a hidden compliance requirement: a transfer impact assessment dossier, due within 60 days of the first transfer of personal data. The fine for missing this deadline is up to $1,925 (VND50 million). Decree No.330/2026/ND-CP on administrative penalties for cybersecurity and personal data protection violations took effect in August, increasing the potential penalty for broader cross-border transfer violations to 5% of prior-year revenue in Vietnam.

This compliance obligation adds a new layer of complexity to cross-border deals, requiring deal teams to produce a disclosure schedule and redact personal data in real time while coordinating with auditors, local law firms, and investment banks. Vietnamese targets must now meet both domestic compliance requirements and foreign buyer diligence standards. To meet these demands, data room providers must offer features like AI redaction, granular permissions, and detailed audit logs.