Transferring customer data in M&A under the PDPL: what's required?

What is transferring customer data in a company M&A under the PDPL?

This refers to the seller, buyer, or M&A advisor accessing, sharing, copying, or handing over customers’ personal data during negotiation, due diligence, and closing. Under the Personal Data Protection Law (Law 91/2025/QH15), this must have a clear purpose, comply with data processing principles, and rely on an appropriate legal basis.

In Vietnamese practice, data often includes names, phone numbers, emails, purchase history, contracts, receivables, customer service call recordings, or identifiers in the CRM. For SMEs, the risk often does not lie in “selling the company,” but in sending the entire database to the buyer without filtering, anonymization, or customer notice.

When does transferring customer data trigger obligations under the PDPL?

Obligations arise as soon as personal data is reviewed, disclosed, or transferred to a third party in M&A, including during due diligence. If the data can identify an individual directly or indirectly, the business must handle it under the rules, regardless of whether the deal has been signed.

The important point is to separate 3 stages:

• Pre-transaction due diligence: only share minimal data, prioritizing anonymized, aggregated, or sanitized datasets.
• Signing and closing: determine who will be the data controller after the merger.
• Post-M&A operational transfer: update notices, privacy policies, and customer request handling mechanisms.

Is customer consent required when transferring data in M&A?

Often it may be required, but not everything must rely solely on consent. Under the rules, the business must identify the legal basis that fits the transfer purpose. If using consent, it must be voluntary, specific, demonstrable, and customers must understand who their data is being transferred to and for what purpose.

For M&A transactions, many businesses assume “a clause in the service contract is enough.” This is risky because generic clauses do not replace transparent notices or specific consent when the scope of use changes. If data is transferred to a new legal entity, purposes change, or processing scope expands, review the legal basis and notice documentation.

What should M&A due diligence do to avoid “leaking” customer data?

Design due diligence with data minimization in mind. The seller should only provide data sufficient for the buyer to assess company value, not open the entire CRM or support tickets if unnecessary.

A safer structure is:

• Aggregated data by customer segment, region, revenue.
• Sample contracts with names, IDs, phone numbers redacted.
• A list of complaints/claims that is tokenized.
• Sensitive data shared only when truly necessary and with additional safeguards.

If using a data room, set role-based access, log downloads, apply watermarks, and implement a process to revoke access after due diligence ends.

Can the buyer immediately use customer data after taking over the company?

Do not automatically assume it’s allowed. After a merger or acquisition, the buyer should check what notices and policies governed the original data collection, and whether customers need updated notices about the change of the controlling legal entity.

If the new company changes brand, operating entity, or moves to a different CRM, the business must ensure customers are informed about who is processing the data, how to contact them, and how customers can request access, correction, deletion, or restriction of processing in accordance with the rules.

What are the risks if you forget to notify or overshare?

Risks can include customer complaints, remedial orders, administrative penalties under the implementing decree when the law is in effect, and, in serious cases, criminal liability. The enforcement authority is the Ministry of Public Security (A05).

Businesses should treat M&A as a data compliance problem, not only a transaction legal issue. Common mistakes include: emailing the buyer a customer list without encryption; using a data room without download controls; an SPA without data clauses; and failing to update the privacy policy after closing.

Short template for use in M&A transactions

You can use the following notice for customers or partners:

"We hereby inform you that [Company name] is/has been conducting an M&A transaction with [Name of the relevant legal entity]. Some personal data of customers may be transferred for due diligence and/or to continue providing services, in accordance with personal data protection law. The data processed includes [short list]. You can contact [email/contact point] to exercise your rights to access, rectify, object, or make other requests as provided by law."

How should SMEs prepare before selling the company?

SMEs should complete four tasks in advance: build a data inventory; cleanse and anonymize data before due diligence; review existing notices and consents; and standardize contracts with employees, agents, and CRM providers to avoid data exposure during handover. If you have a cookie banner, lead forms, or a consent capture system, retain versioned, timestamped evidence of consent.

If you are building an M&A process, consent.vn can help retain consent evidence, manage cookie banners, and streamline DSAR flows so legal and engineering teams share a single source of data.

Source: the Personal Data Protection Law (Law 91/2025/QH15); Decree 13/2023/ND-CP — thuvienphapluat.vn; Ministry of Public Security (A05) — bocongan.gov.vn