When selling an FDI project, the customer list is the asset that makes the price — and the asset most easily stolen during the sale process. Potential buyers always demand the full list ‘to diligence revenue’; the seller knows that if the deal fails, that list stays in the hands of a rival who has just been shown exactly who its customers are and what prices they pay. The art of selling lies in showing enough to price the business without handing over a complete competitive weapon.
Legal basis applicable at the time of writing
A company’s customer list — where it holds transaction terms, purchase history and contact persons — can be a trade secret under Articles 84–85 of the IP Law if kept secret by necessary measures, and unlawful use of the list infringes under Article 127 of that law. The personal-contact layer of the list is simultaneously personal data, so placing it in a data room must comply with the Personal Data Protection Law 91/2025/QH15 and Decree 356/2025/ND-CP on purpose, scope and consent or another lawful processing basis.
Staged disclosure: sell the revenue picture, hold customer identities to the last minute
The standard mechanism opens in three stages: the teaser stage — the buyer receives only aggregated data: revenue structure by anonymised customer group (Customer A, Customer B), top-10 concentration, contract durations and historical renewal rates; enough for preliminary pricing without exposing any identity. The serious diligence stage after NDA and letter of intent — the list opens one more layer, such as names of large corporate customers already semi-public in the industry, while detailed price terms and personal contacts stay hidden. The final pre-signing stage — the full list with commercial terms and contacts opens to a very narrow circle, possibly through a clean team or the buyer’s counsel confirming on their behalf (confirmatory diligence) and reporting conclusions back.
The sale NDA needs three specialised clauses beyond the standard form: a ban on using customer information outside deal evaluation — including using it to pitch competitively during negotiations; a ban on soliciting or directly approaching listed customers without the seller’s consent, surviving for a period after talks end even if the deal breaks; and a duty to delete customer data from all the buyer’s systems when talks end, with certification. Where a buyer misuses the list — classically approaching listed customers with offers during the negotiation or after break-up — the seller works a ladder: breach notice and immediate cessation demand with evidence from the approached customers themselves; activation of the NDA penalty; and where the list qualifies as a trade secret, suit for infringement under the IP Law alongside unfair-competition analysis.
Recommended actions
1. Design the sale package in three opening stages. Teaser stage: aggregated anonymised figures by customer group; diligence stage: names of semi-public large customers opened, detailed pricing withheld; final stage: the full list for a narrow circle or via the buyer’s counsel confirming on their behalf.
2. Sign a sale NDA with three customer-specific clauses. Ban on out-of-purpose use of the information; ban on approaching and soliciting listed customers, surviving after talks end; data-deletion duty with certification if the deal breaks.
3. Anonymise contact persons’ personal data stage by stage. Names, phone numbers and personal emails of customer contacts appear only at the final stage; earlier stages use substitute identifiers to comply with the personal data protection frame.
4. Pre-build the ladder for list misuse. Collect confirmations from approached customers → breach notice and cessation demand → NDA penalty → trade-secret infringement suit where conditions are met, all pre-written into the sale plan.
Frequently asked questions
Must the customer list be disclosed when selling a project?
It is disclosed, but in stages and never in full at the start. The buyer needs customer data to diligence revenue — that need is met at the teaser stage with aggregated anonymised figures: revenue structure by customer group, large-customer concentration, contract durations and renewal rates. Identities and detailed terms open progressively as the deal deepens, and the full list with contacts appears only at the final stage for a narrow circle.
How is the customer list protected during a sale?
Through four cumulative mechanisms: a sale NDA with customer-information-specific clauses; staged disclosure with anonymisation in the early stages; a tightly locked viewer circle for the full list with data-room access logs; and processing of contact persons’ personal data in compliance with the Personal Data Protection Law 91/2025 — opened only at the final stage when the processing basis and purpose are clear.
A buyer used the customer list for the wrong purpose — how is it handled?
On the pre-built ladder: record evidence from the approached customers themselves (timing, pitch content); send an NDA breach notice demanding immediate cessation and certified data deletion; apply the NDA penalty; and where the list qualifies as a trade secret, sue for infringement under Article 127 of the IP Law with a damages claim — while removing that buyer from the sale process and notifying involved advisers within legal limits.
Should customer names be masked during the sale?
Yes, in the early stages. Masking names with identifiers (Customer A, B, C) alongside industry, revenue scale, contract duration and renewal history lets the buyer price the revenue stream seriously without knowing identities. Real names need opening only when the buyer has proven commitment at the final stage — and in many deals, verification of the full list is delegated to the buyer’s counsel or auditors who check on their behalf and report only conclusions, so identities never leave the seller’s control circle until signing.
This article has been quality-reviewed by the FLAW AI Legal Council