An FDI investor offers a plant project for sale to three potential buyer groups and opens an online data room containing technical reports, major customer contracts, price lists and even a production-process annex. One group withdraws after round two and, six months later, launches a similar product with a very close price structure. The seller suspects data-room information was used, but admits that when opening the room it staged no document rounds, applied no watermarking and kept no log of who viewed or downloaded what.
Primary sources to check
A data room has no dedicated legal regime in Vietnam: the entire protection discipline is built on a confidentiality agreement signed before access is granted, under the Civil Code 2015, defining the viewed information as confidential, limiting purpose to deal evaluation, and banning copying and use beyond that purpose. The statutory layer behind it is the IP Law: data-room documents meeting Article 84 remain the seller trade secrets, and a withdrawn buyer using them to compete infringes under Article 127. The point to stress is that the data-room process itself — view permissions, download bans, document watermarking, access logs — is simultaneously the dossier proving necessary secrecy measures; a wide-open uncontrolled room seriously weakens any later litigation.
Applying the rules in practice
A safe data room follows the principle of disclosure graduated by deal seriousness. Round one, for buyers without an exclusivity commitment: overview documents, aggregated figures, no customer identities and no process parameters. Round two, after a letter of intent and a good-faith deposit: major contracts with sensitive terms redacted, technical reports at descriptive level. Round three, only for the final buyer in the confirmatory stage: the most detailed documents, viewed on-site or through a view-only room, with per-account watermarks. Documents holding core technology secrets should be considered for exclusion from the room at every round, replaced by an independent expert confirmation or a post-signing review mechanism under warranty clauses. Every access account is one named person, never a shared account for a whole buyer group.
When a buyer walks away, information recall is work that must be designed in advance in the confidentiality agreement: a duty to return or delete all received materials, written confirmation by the buyer authorised person, and the seller right to require proof of deletion on backup systems within a reasonable period. The reality to accept is that downloaded copies sit beyond physical recall — which is why the most sensitive round is view-only with no downloads. If misuse by a withdrawn buyer is later discovered, the decisive evidence comprises the data-room access logs, watermarked documents found inside the rival materials, and the abnormal product-launch timing. A sloppy data-room process not only loses secrets in this deal, it is also used by the counterparty to rebut the seller own secrecy condition in court.
Steps to follow
- Sign a confidentiality agreement with recall and deletion-confirmation clauses before granting any data-room access.
- Design the room in three graduated rounds, with named accounts, watermarking and full view and download logging.
- Keep core technology secrets outside the room, replaced by independent expert confirmation or a post-signing review mechanism.
- When a party withdraws: immediately trigger the return and certified-deletion duty and preserve all access logs as a reserve file.
FAQs
How are technology secrets protected when opening a data room for project buyers?
Protect by rounds and technical control: the first round holds only overview documents and aggregated figures; detailed materials open only for buyers reaching the final confirmatory round; core technology secrets are kept out of the room and replaced by independent expert confirmation. All sensitive documents carry per-account watermarks, the deep round is view-only with no downloads, and every view and download is logged. The legal base is the confidentiality agreement signed before access, backed by Articles 84 and 127 of the IP Law for information used off-purpose.
Should viewing rights be staged by negotiation round?
Yes, permissioning by negotiation round is correct practice and should be applied: preliminary buyers see only enough to decide whether to proceed; customer contracts, detailed price lists and deep technical documents appear only once there is a letter of intent, a good-faith deposit or an exclusivity commitment. This staging both shrinks the leak surface and is itself evidence of secrecy measures proportionate to sensitivity. What must be avoided is opening everything in round one under deal-speed pressure — the most common mistake, and one that cannot be undone after the information has been viewed.
When a buyer walks away, how is information recalled?
Through the mechanism written in the confidentiality agreement signed before the room opened: the withdrawing party must return or delete all materials with written confirmation, and its data-room access is locked at once. For downloaded copies beyond physical recall, the remaining tool is legal: if that party uses the information to compete, the seller demands cessation and damages under Article 127 of the IP Law, evidenced by access logs and watermarked documents. That is why the most sensitive materials must be view-only from the start, so the recall situation barely arises.
This article has been quality-reviewed by the FLAW AI Legal Council