An FDI company discovers its Vietnamese software-outsourcing supplier stores its design data on unencrypted servers, supplier staff use shared accounts and no access logs exist. When the company requests a full security audit, the supplier replies that the current contract contains no such right and offers only a self-declaration of compliance. Management asks: does the company have a right to inspect, what should be inspected, and what happens if the supplier fails?
Governing legal framework
The starting point must be stated plainly: Vietnamese law gives a buyer no automatic right to audit a supplier information security. Inspection rights exist only where the service contract or the confidentiality and data-processing agreement states them — a contractual relation under the Civil Code 2015 and the Commercial Law 36/2005. An indirect legal footing sits in the personal-data framework: under Law 91/2025/QH15 and Decree 356/2025/ND-CP, the personal-data controller remains responsible for data handed to a processor, so requiring the supplier to evidence its protective measures is part of the company own compliance duty — a persuasive negotiation argument, though ultimate enforcement still rests on contract clauses. For trade secrets specifically, Article 84 of the IP Law obliges the owner to maintain necessary secrecy measures across the whole chain holding the information, including while it sits at a supplier.
Applying the rules in practice
A supplier security audit that serves its purpose inspects four groups. Governance: a written information-security policy, a named responsible person, confidentiality agreements with the supplier own staff. Access: named accounts instead of shared ones, need-based permissions, retained and reviewed access logs, and an access-revocation process when supplier staff leave. Technical: encryption of data at rest and in transit, backups with restore testing, endpoint management and patching. Incident: a notification procedure within a fixed deadline and evidence of drills. The customary reference standard is ISO 27001, but it must be remembered as a benchmarking practice, not a legal requirement imposed on every supplier. Audit results should be classified by risk level tied to the type of data the supplier holds, rather than a generic pass-or-fail verdict.
When a supplier fails, the practical handling ladder has three rungs by severity and cooperativeness. Rung one, a deadline remediation plan: list the failing points, fix deadlines by risk — grave points such as shared accounts on secret data counted in days, minor ones in months — and a re-audit right. Rung two, compensating measures while remediation runs: narrow the data given to the supplier, pull the most sensitive parts back to company systems, or require a segregated work environment controlled by the company. Rung three, contractual escalation: pause further data transfers, trigger penalty or termination clauses where the contract has them, and move sensitive work to another supplier. Where the current contract lacks audit rights, as in the scenario, the company should negotiate a data-processing and audit appendix at renewal or new-order signing — the moment of highest bargaining leverage — and meanwhile use a self-assessment questionnaire with evidence attachments instead of accepting a bare self-declaration.
Steps to follow
- Put security-audit, data-processing and incident-notification clauses into every new supplier contract and renewal appendix.
- Audit across the four groups — governance, access, technical, incident — with results graded by the risk of data the supplier holds.
- Issue a deadline remediation plan for failing points and apply data-narrowing compensations meanwhile.
- Re-audit after remediation; escalate to pausing data transfers or contract termination if grave points remain unfixed.
FAQs
Do we have the right to audit a supplier information security?
Only if the contract says so. Vietnamese law grants no automatic security-audit right to a buyer; the right must be agreed in the service contract, the confidentiality agreement or a data-processing appendix under the Civil Code 2015 and the Commercial Law 36/2005. If the current contract is silent, the company cannot force an on-site audit, but it has strong negotiating ground: the personal-data controller duties under Law 91/2025/QH15 and Decree 356/2025/ND-CP for data handed to a processor, plus the Article 84 secrecy condition of the IP Law. The moment to insert the clause is contract renewal or a new order.
What should be inspected?
Inspect four content groups: governance — a written security policy, a responsible person, confidentiality undertakings of supplier staff; access — named accounts, job-based permissions, access logs and revocation when personnel leave; technical — encryption at rest and in transit, backups with restore testing, endpoint management and patching; and incident response — a deadline for notifying the company of incidents plus drill evidence. ISO 27001 is commonly used as the practice reference frame for benchmarking, and results should be graded by risk level rather than a bare pass-or-fail conclusion.
What if the supplier fails the audit?
Handle it on a three-rung ladder. First, a remediation plan with deadlines tied to severity — grave points such as shared accounts on secret data must be fixed in the shortest time. In parallel, apply compensating measures: narrow data handed over to the minimum or move sensitive parts into a company-controlled environment. If the supplier misses the deadlines, escalate under the contract — pause further data transfers, apply penalty clauses, terminate the sensitive work portion and move it to another supplier. Every step must be in writing so the company own compliance file stands up when regulators ask.
This article has been quality-reviewed by the FLAW AI Legal Council