An FDI company lets its Vietnamese design team leader relocate to Germany after marriage and work fully remotely, still accessing servers holding drawings and the company European customer data. Six months later, security finds his account logging in simultaneously from two countries and part of the data synced to a personal drive. Management asks: how protected are company secrets when the person holding them sits outside Vietnamese territory, and what must be added to the contract?
Governing legal framework
Secrets held on company servers remain trade secrets under Article 84 of the IP Law, and unlawful disclosure or use remains actionable under Article 127 even when the actor is abroad — the difficulty is enforcement, not rights. On the labour side, Article 21 of the Labour Code 2019 requires the contract to state the workplace: allowing long-term remote work in another country changes the workplace and needs an appendix agreement, with consequences for the law governing discipline and termination. The most forgotten layer is data: when the overseas employee accesses and downloads personal data of customers and colleagues, that flow may constitute an outbound personal-data transfer under Law 91/2025/QH15 and Decree 356/2025/ND-CP, triggering the transfer impact assessment dossier the company must prepare.
What this means for an FDI employer
The practical protection strategy must shift from trusting the person to access architecture: the overseas employee should work only inside the company virtual desktop, data never leaves the server, sync and download are disabled for secret document groups, and login requires multi-factor authentication plus anomalous-location checks. In contract terms, the cross-border remote-work appendix should state: the new workplace and the law governing the labour relationship, confidentiality duties covering home devices and networks, a ban on sharing accounts and devices with household members, a duty to report device loss or suspected compromise immediately, and handover and data-deletion mechanics on termination. Management should be told plainly: when a dispute erupts with a person residing abroad, enforcement cost and time rise sharply, so investment belongs in technical prevention rather than litigation hopes.
On data stored abroad, the risk is not only leakage but loss of legal control: data on a personal drive in another country is exposed to that jurisdiction authorities and sits beyond the company recovery reach. The operating rule should be that no secret data may reside outside company systems — if a task genuinely requires offline processing, it needs separate approval, full encryption and a concrete deletion deadline. The company must also review outbound personal-data duties: prepare the transfer impact assessment dossier under the framework of Law 91/2025/QH15 and Decree 356/2025/ND-CP when HR and customer data flows cross the border, instead of treating an employee remote login as a purely technical matter.
Safe-handling checklist
- Sign a cross-border remote-work appendix: new workplace, governing law, home confidentiality duties, termination handover mechanics.
- Move all secret-data access into a virtual desktop: no downloads, no sync, multi-factor authentication and anomalous-login alerts.
- Prepare the outbound personal-data transfer impact assessment if HR or customer data is accessed from abroad.
- Periodically review cross-border account access logs and revoke rights immediately on anomalies.
FAQs
How are company secrets protected when an employee works remotely from another country?
Protect through access architecture rather than trust: place the employee inside the company virtual desktop so data never leaves the server, disable downloads and sync for secret documents, apply multi-factor authentication and strange-location login alerts. The law still sides with the company — unlawful disclosure or use of a trade secret is actionable under Article 127 of the IP Law wherever the violator is — but overseas enforcement is costly, so the technical layer is the decisive one. The contract needs a remote-work appendix stating confidentiality duties at the overseas residence and handover mechanics on termination.
What are the risks of data stored abroad?
Yes, two risk groups. First, security risk: data outside company systems sits beyond recovery reach and may be accessed by the host country authorities under their law. Second, compliance risk: personal data of customers and staff accessed or stored abroad may constitute an outbound personal-data transfer under Law 91/2025/QH15 and Decree 356/2025/ND-CP, obliging the company to prepare a transfer impact assessment dossier and answer for that channel. The safe rule is to let no secret data reside outside company systems; exceptions require encryption and a deletion deadline.
What must be added to the labour contract?
The appendix should add six points: the new overseas workplace, recording the workplace change under Article 21 of the Labour Code 2019; the law and dispute forum governing the labour relationship; confidentiality duties extended to home devices and networks, with a ban on sharing accounts and devices; mandatory technical requirements — work only through the company access environment, no downloading secret data to personal machines; a duty to report device loss or suspected compromise immediately; and an end-of-work procedure — account revocation, data deletion and written confirmation within a fixed period from termination.