A sales employee resigns; two months later he appears at a competitor and starts calling the company's old customers with sales pitches. It is one of the most infuriating situations a business owner can face — but handling it lawfully is not as simple as emotions suggest. This article analyzes a hypothetical case of an employee who resigns and takes customer data, from the legal framework to each feasible handling option.
Table of contents
- 1. The hypothetical facts
- 2. The legal questions
- 3. Analysis
- 4. Conclusion and recommendations
- 5. Extended questions
- Is your situation different?
- Language versions
- References
1. The hypothetical facts
Company T is a foreign-invested enterprise manufacturing and distributing industrial equipment in Vietnam. Mr. K worked as a sales employee in charge of the company's key customer group for 3 years. Upon resignation, Mr. K took all customer data he had managed and used it to pitch for a competitor. The case below is hypothetical and for illustration.
Given facts:
- F1. Company T manages 2,300 customers on a permissioned CRM system. Mr. K had a personal CRM account accessing only his assigned customer group.
- F2. Mr. K's labour contract contained a confidentiality clause: no disclosure of customer lists, price lists or discount policies during employment and for 24 months after resignation; breach triggers damages.
- F3. The company's labour regulations (registered with the state authority and publicly posted) classify customer lists, price lists and discount policies as trade secrets; all copying or disclosure without permission is banned. Security measures: personal passwords, CRM access control, watermarks on file exports.
- F4. Mr. K terminated the labour contract properly (resignation letter, 45-day notice), received all wages, severance allowances and handed over the CRM account.
- F5. Two months after Mr. K's resignation, the company discovered he was working as sales manager for a direct competitor. About 80 of Company T's old customers received pitches from the competitor with price lists and discount levels identical to Company T's pricing system.
- F6. Checking CRM system logs, the company found that in his final week, Mr. K had exported the 2,300-customer list with representatives' names, phone numbers and emails to his personal email address.
- F7. Company T never signed any agreement permitting Mr. K to use customer data after resignation.
2. The legal questions
The case raises three legal questions:
- Q1. Did Mr. K's conduct violate the law? If so, which provisions?
- Q2. Can Company T dismiss Mr. K as a disciplinary measure, given he has already resigned?
- Q3. What handling options does Company T have, and which is most feasible here?
3. Analysis
The three legal questions in section 2 are answered in sequence: first the legal framework applicable to Mr. K's conduct, then the three handling options Company T may choose, and finally a comparison table to decide the most feasible option.
3.1. Applicable legal framework
First, the contractual confidentiality duty (F2). Clause 2, Article 21 of the Labour Code 2019 provides: where an employee works directly with trade secrets or technical secrets as prescribed by law, the employer may agree in writing with the employee on the content and term of trade-secret protection, benefits, and compensation for breach. This has two important consequences: first, the confidentiality duty must be agreed in writing to stand on firm legal ground; second, the law allows the parties to agree a protection term extending beyond termination of the labour contract. Here, Company T did the right thing by including a 24-month post-resignation confidentiality clause. The duty survives independently — it is not extinguished merely because the labour contract ended. (On labour-law matters, see foreign labour for EPC contractors.)
Second, the trade-secret protection regime (F3, F5, F6). Under Article 84 of the 2005 Intellectual Property Law, a trade secret is protected if it simultaneously meets three conditions: it is not common knowledge and not easily obtainable; its use in business gives its holder an advantage over non-holders; and it is protected by its owner through necessary measures against disclosure and easy access. Company T's list of 2,300 customers with representatives' contact details, price lists and internal discount policies can fully meet these three conditions — especially with personal passwords, CRM access control and watermarks in place. The point to stress: the third condition is the one many businesses miss. If the company had no security measures at all, invoking trade-secret protection would be very weak. Company T did this part well.
Third, unfair competition (F5, F6, F7). Point b, Clause 1, Article 45 of the 2018 Competition Law prohibits disclosing or using confidential business information without the owner's permission. Mr. K's export of the data file to his personal email and use of it to pitch for the competitor matches this description. On administrative sanctions, Article 16 of Decree 75/2019/ND-CP fines organizations VND 200–300 million for disclosing or using confidential business information without permission; individuals face half the organizational fine, i.e. VND 100–150 million.
Fourth, personal-data protection duties (F6). The names, phone numbers and emails of customer representatives are personal data under Article 2 of the Personal Data Protection Law 91/2025/QH15 (effective from 01/01/2026). Article 7 prohibits processing personal data in violation of the law, as well as appropriating or deliberately disclosing or losing personal data. Mr. K's copying and use of this data to serve another company without permission shows signs of breaching these prohibitions. On sanctions, Article 8 sets very heavy administrative frames: trading in personal data may be fined up to 10 times the illegal proceeds; other violations up to VND 3 billion; individuals face half the organizational fine. Note: detailed fines per specific act await implementing guidance, so check the latest text when acting. (See our personal data protection policy and privacy policy for compliant data-handling practices.)
Fifth, damages liability. Where Mr. K's conduct caused damage to Company T, the company has grounds to claim compensation under the confidentiality agreement in the labour contract (the 24-month clause still being effective), or under non-contractual damages rules in Articles 584–585 of the Civil Code 2015. Damages may include revenue lost from the 80 poached customers, remediation costs and other provable losses.
3.2. Option A: Negotiate and demand voluntary cessation
Content. Company T sends a formal letter to Mr. K (and possibly simultaneously to the competitor employing him): stating the still-effective confidentiality duty under the labour contract; demanding immediate cessation of customer-data use; demanding a written commitment to destroy all data copies; proposing negotiation of damages; setting a reply deadline, e.g. 7–10 working days, while reserving the right to sue and file administrative complaints if he does not cooperate.
Legal basis. The confidentiality duty under Clause 2, Article 21 of the Labour Code 2019 and the compensation agreement in the labour contract; the prohibitions in Article 45 of the 2018 Competition Law and Article 7 of the 2025 Personal Data Protection Law invoked as deterrents.
Advantages. Fast, inexpensive, avoids public disputes harming both sides' reputation. In many real cases, a tightly drafted demand letter citing the right provisions is enough to make the violator stop and negotiate.
Risks and limits. No coercive force. If Mr. K ignores it or the competitor backs him, Company T must move to stronger options. Prolonged negotiation may also give the violator more time to exploit the data.
3.3. Option B: Sue for damages and cessation
Content. Company T sues Mr. K in court, seeking: an order to stop the unlawful use of customer data and trade secrets; destruction of data copies; damages under the confidentiality agreement or non-contractual damages rules.
Legal basis. The confidentiality agreement still effective 24 months post-resignation; Articles 584–585 of the Civil Code 2015 on non-contractual damages; Article 45 of the 2018 Competition Law and IP Law trade-secret rules as grounds for unlawfulness.
Advantages. Coercive force of a judgment; deterrent precedent for other employees; court-awarded damages may cover all provable losses.
Risks and limits. Litigation takes months to over a year. The burden of proof lies with the plaintiff: Company T must prove actual damage and causation between Mr. K's conduct and the damage — e.g. revenue decline from exactly the 80 pitched customers, remediation costs. This is the hardest part and usually needs lawyers and financial experts working together. Determining the competent court and limitation periods for post-termination confidentiality disputes can also be complex and needs separate legal assessment before filing. (On dispute resolution options, see commercial disputes and arbitration in Vietnam.)
3.4. Option C: Complain for administrative sanctions
Content. Company T files complaints with competent state authorities: for disclosing/using confidential business information, the competition authority may sanction under Article 16 of Decree 75/2019/ND-CP at VND 100–150 million for an individual violator; for personal-data violations, the competent authority sanctions under the Article 8 frame of the 2025 Personal Data Protection Law.
Legal basis. Article 16 of Decree 75/2019/ND-CP; Articles 7–8 of the Personal Data Protection Law 91/2025/QH15.
Advantages. Strong administrative pressure, especially where the violator is an individual unwilling or unable to face a public sanction decision. An administrative sanction decision can later serve as evidence in a civil suit.
Risks and limits. Administrative procedure depends on the handling authority; timelines are hard to control. More importantly, administrative sanctions do not directly bring compensation to Company T — damages still require the civil route. For personal data, detailed fines per act still await guidance, so short-term deterrence should be assessed cautiously.
3.5. Comparing the options
| Criterion | Option A: Negotiation | Option B: Civil suit | Option C: Administrative complaint |
|---|---|---|---|
| Legal basis | Art. 21 Labour Code 2019; confidentiality agreement | Confidentiality agreement; Arts. 584–585 Civil Code 2015 | Art. 16 Decree 75/2019/ND-CP; Art. 8 Data Protection Law 2025 |
| Timeline | Fastest, in weeks | Slowest, months to over a year | Medium, depends on the authority |
| Cost (statutory) | Lowest | Highest (court fees, lawyers, experts) | Low, mainly dossier costs |
| Damage recovery | Depends on goodwill | Highest if won and enforced | No direct compensation |
| Deterrence | Low | High | Medium to high |
| Risk | No coercive force | Burden of proving damage | No direct compensation |
4. Conclusion and recommendations
Conclusion. On the given facts, Mr. K's conduct shows signs of violating the law on three fronts: breaching the contractual confidentiality duty (F2, Clause 2 Article 21 Labour Code 2019); disclosing and using confidential business information without permission (F5, F6, F7, point b Clause 1 Article 45 Competition Law 2018); and unlawfully processing personal data (F6, Articles 2 and 7 of the 2025 Personal Data Protection Law). However, Company T cannot dismiss Mr. K as a disciplinary measure, because the employment relationship already ended under F4, and labour discipline applies only while the relationship exists. The feasible routes are civil and administrative, not labour discipline.
Recommended next steps. Company T should proceed in sequence: first execute Option A immediately — send the demand-and-negotiate letter within 7–10 days, fully reserving litigation and complaint rights. In parallel, prepare dossiers for Options B and C: back up CRM system logs proving the file export (F6), collect evidence of pitches to the 80 customers (F5), and start quantifying damage. If negotiation fails, file the administrative complaint for pressure while suing civilly for damages. Long-term, the company should overhaul its data-protection system: tighten CRM permissions, set automatic alerts on bulk file exports, and ensure every employee in sensitive positions signs a confidentiality agreement with a post-resignation term.
5. Extended questions
What if the employee never exported the file but only used memory to contact old customers?
The confidentiality duty in the labour contract usually covers all information the employee accessed during employment, regardless of storage form. Proving it, however, is far harder without system-log traces of a file export.
If the labour contract has no confidentiality clause, does the company have any recourse?
Still yes. The company may invoke trade-secret protection under Article 84 of the 2005 Intellectual Property Law, unfair competition under Article 45 of the 2018 Competition Law, and personal-data protection rules. But its position is much weaker without a written agreement on duties and agreed compensation.
What if the employee transfers customer data abroad to the competitor's parent company?
The act may then trigger cross-border personal-data transfer rules under the 2025 Personal Data Protection Law, with administrative fines up to 5% of the violating organization's prior-year revenue — an aggravating factor for a lawyer to assess separately.
What if the company had no security measures at all?
That is a fatal weakness. The third condition of Article 84 of the Intellectual Property Law requires the owner to protect the secret by necessary measures. Without real security measures, the company almost loses its trade-secret basis. Lesson: security must be enforced before incidents, not built afterward.
What is the limitation period for suing in this case?
It depends on how the dispute is characterized: a confidentiality-agreement dispute, a non-contractual damages claim, or an administrative complaint each carries different limitation periods. A lawyer should determine this specifically before filing, to avoid losing the right to sue on limitation grounds.
Is your situation different?
Every real case has its own details: your labour contract may lack a confidentiality clause, the employee may not have resigned yet but be stirring, or the data taken may not be a customer list. Describe your company's actual situation for a tailored legal assessment and handling plan. Contact FLAT Law Firm via hotline 0988424851.
Language versions
References
- Labour Code 2019 (45/2019/QH14)
- Intellectual Property Law 2005, Article 84
- Competition Law 2018, Article 45
- Personal Data Protection Law 91/2025/QH15 (effective 01/01/2026)
- Decree 75/2019/ND-CP, Article 16
- Civil Code 2015, Articles 584–585