An FDI company hires a Vietnamese software workshop to build an order-management platform, handing source code to the workshop repository, real customer data for testing and system architecture documents. After the contract ends, the company finds the workshop pitching a similar platform to a competitor, including a module nearly identical to the one built for it. Management asks: how is source code protected in this outsourcing model, and what clauses should the contract have carried beyond a generic NDA?
Governing legal framework
Source code is protected on two layers. The copyright layer: computer programs are protected as literary works under Article 22 of the IP Law (consolidated text 67/VBHN-VPQH 2026); for works created by a hired party under a work-for-hire style contract, ownership is as the parties agree — meaning an outsourcing contract silent on source-code ownership opens a dispute over who owns the code the workshop wrote. The trade-secret layer: undisclosed source code, architecture and data meeting Article 84 remain trade secrets, and copying or use for another client is actionable under Article 127. Both layers only work where the outsourcing contract clearly allocates: source code and all developed products belong to the hiring company, the workshop pre-existing tools and libraries are licensed to what extent, and the handover and copy-deletion duties at the end.
What this means for an FDI employer
Beyond a generic NDA, a software outsourcing contract needs six special terms. First, a comprehensive IP clause: source code, design documents, test data derived from real data and all improvements made during the work belong to the hiring company; the workshop pre-existing tools are listed in an annex and licensed only to the extent the project needs. Second, repository discipline: code lives in a repository controlled by the company or synchronously mirrored to it, with named accounts and a ban on copying to personal repositories. Third, test data: prefer fake or anonymised data; real data is used only in a controlled environment and deleted after testing. Fourth, a no-reuse bar: the workshop may not use the developed source code, modules and architecture for third parties, even with variables and interfaces renamed. Fifth, end-of-term handover: the full latest source code, deployment documents, and certification of copy deletion at the workshop. Sixth, workshop personnel: a named project-participant list with their own confidentiality and internal non-compete undertakings.
On discovering a workshop reusing code for another client, the decisive evidence is the duplication level at source-code and architecture level, not functional similarity — two order-management systems resembling each other in features is normal. The company must compare: verbatim code segments, directory structure, variable names and distinctive bugs copied as-is are the strongest traces. Before confronting, fix evidence through the workshop sales materials and demo, and re-audit the company own repository to scope what was used. Remedies include cessation of use and distribution of the infringing platform, destruction of the copied code portions, and damages under Article 127 and the contract clauses — and where the contract carried a clear no-reuse clause, the case is far cleaner than one resting on a generic NDA alone.
Safe-handling checklist
- Write a comprehensive IP clause into the outsourcing contract: source code, documents and derived data belong to the hiring side; workshop pre-existing tools listed separately.
- Place the code repository under company control, with named accounts for each workshop developer and full access logs.
- Use fake or anonymised data for testing; real data only in a controlled environment, deleted after testing with confirmation.
- Close the project with a latest-source-code handover record and copy-deletion certification, plus later market review of the workshop products.
FAQs
How is source code protected when outsourcing software to a Vietnamese workshop?
Protect through repository control and contract terms: source code must live in a repository controlled by the hiring company or be continuously mirrored to it, with named accounts for each workshop person. Legally, a computer program is copyright-protected under Article 22 of the IP Law, and undisclosed source code is simultaneously a trade secret under Article 84. But the decisive layer is the contract stating that source code and developed products belong to the hiring company — if the contract is silent, ownership of the code the workshop wrote becomes the first dispute point.
What clauses are needed beyond a generic NDA?
Five clause groups beyond a generic NDA: an IP clause establishing that source code, design documents and developed products belong to the hiring side, with an annex of workshop pre-existing tools; a no-reuse clause barring use of source code, modules and architecture for other clients in any transformed form; repository discipline and named access accounts; test-data rules — anonymisation, a controlled environment and post-testing deletion; and an end-of-term handover mechanism covering the latest source code, deployment documents and certification of copy deletion at the workshop. Without the no-reuse and handover groups, a generic NDA can barely address the scenario of the workshop reselling a similar platform.
If the workshop reuses the code for another client, how is it handled?
Handle it on the IP and contract track: fix duplication evidence at source-code and architecture level — verbatim code segments, structure, distinctive bugs — through the workshop sales materials and demo; demand cessation of use and distribution and destruction of the copied code portions; claim damages under Article 127 of the IP Law for trade-secret infringement, copyright in the computer program under Article 22, and the contract no-reuse clause where present. In parallel, notify the client being pitched at an appropriate level to stop further spread, and audit all access the workshop still holds.
This article has been quality-reviewed by the FLAW AI Legal Council