A salesperson leaves and takes the customer list to a competitor. Many businesses have faced this. The file contains customers’ personal data under the Law on Personal Data Protection 2025, and it may also be a trade secret under the Law on Intellectual Property. If your business chooses the wrong route, it may fail to protect its interests and may even have to explain how it met its own data protection obligations. This article looks at when a customer list is protected, which acts count as violations, liability under Article 288 of the Penal Code, the risks that come back to your own business, and the steps to take when you find out.
- A list of individual customers contains personal data under Law No. 91/2025/QH15. It may also be a trade secret if it meets all 3 conditions in Article 84 of the Law on Intellectual Property.
- A trade secret is protected only if the business has applied the necessary security measures. Data left open to everyone is the biggest weakness in a dispute.
- A competitor that uses confidential information without permission may be dealt with under Article 127 of the Law on Intellectual Property and Article 45 of the Law on Competition 2018.
- Article 288 of the Penal Code (the offence of unlawfully providing or using information on computer networks or telecommunications networks) applies only when the thresholds for illegal gain, damage or consequences set by law are met.
- When the business finds out, it must also assess its own duty to notify the breach within 72 hours under Article 23 of the Law on Personal Data Protection, not only focus on pursuing others.
1. What kind of asset is the customer list that was taken?
When a salesperson, market manager or technical team leader leaves and copies the customer list, transaction history and contacts to a competitor, the first question is not “who do we sue?” but which of your business’s rights has been infringed.
A customer data file usually has two characteristics at the same time: it is customers’ personal data, and it may be a trade secret of the business. Each one leads to different tools, conditions and risks.
The personal data angle
Law No. 91/2025/QH15 (in force from 1 January 2026), Clause 1, Article 2: personal data is digital data or information in other forms that identifies, or helps identify, a specific person, and includes basic personal data and sensitive personal data.
Article 7 lists prohibited acts, including: processing personal data in breach of the rules; using another person’s personal data without authorisation; buying or selling personal data (unless otherwise provided by law); and appropriating, deliberately disclosing or losing personal data.
Analysis: The names, phone numbers, emails, addresses and transaction information of individual customers are all personal data. An employee who extracts this data without permission and gives it to another business to use shows signs of the prohibited acts above. Note: if the customer is a company, information about the legal entity is not personal data, but information about its legal representative and contact persons is still personal data.
The trade secret angle
Clause 23, Article 4: a trade secret is information obtained from financial or intellectual investment, which has not been disclosed and can be used in business.
Article 84: a trade secret is protected when it meets all of the following conditions:
- It is not common knowledge and is not easy to obtain;
- When used in business, it gives its holder an advantage over those who do not hold or use it;
- Its owner keeps it secret with the necessary measures so that it is not disclosed and not easily accessible.
Analysis: A single phone number is nobody’s exclusive asset. What can become a trade secret is the body of information the business has invested in building: customer segments, purchase history, discount levels, needs, and decision-makers. The third condition, the necessary security measures, is often the deciding point. Your business can do a quick self-check:
- Is access to the customer list restricted by role?
- Are there access and download logs in the CRM/ERP?
- Does the employment contract or a separate agreement contain a confidentiality clause that clearly names the customer list as confidential information?
- Are there internal confidentiality rules that have been communicated, with staff acknowledgement?
- When an employee leaves, is there a procedure to withdraw accounts and devices, and a commitment to hand over data?
If most answers are “no”, proving that the customer list is a trade secret will be difficult.
2. Which acts of the former employee and the competitor are violations?
Law on Intellectual Property, Clause 1, Article 127 sets out acts that infringe rights to trade secrets, including: accessing or collecting a trade secret by defeating the security measures; disclosing or using a trade secret without the owner’s permission; breaching a confidentiality contract; and using or disclosing a trade secret while knowing, or being obliged to know, that someone else obtained it unlawfully.
Law on Competition No. 23/2018/QH14, Clause 1, Article 45: infringing confidential business information (accessing or collecting it by defeating security measures; disclosing or using it without the owner’s permission) is a prohibited act of unfair competition.
Article 288, the offence of unlawfully providing or using information on computer networks or telecommunications networks. Clause 1 covers buying, selling, exchanging, giving, modifying, changing or making public the lawful private information of an agency, organisation or individual on a computer network or telecommunications network without the owner’s permission, if this brings an illegal gain of VND 50 million to under VND 200 million, causes damage of VND 100 million to under VND 500 million, or causes adverse public opinion that harms the reputation of the agency, organisation or individual. The highest penalty under Clause 1 is up to 3 years’ imprisonment.
Analysis: Liability is not limited to the former employee. The company that hires that person, if it knows or must know that the list was obtained unlawfully and still uses it, may also be dealt with under Article 127 of the Law on Intellectual Property or Article 45 of the Law on Competition.
On the criminal side, Article 288 is the offence most often cited. But it applies only when the act is linked to a computer network or telecommunications network and meets the thresholds or consequences set by law. Not every case of copying a customer list contains all the elements of a crime. The Penal Code is currently being amended; a draft published for comment by the Ministry of Public Security in 2026 proposes a separate offence for infringing personal data. This is still a draft, and businesses should follow the official text once the National Assembly passes it.
3. Comparing two routes: IP/competition law and personal data law
| Criterion | Trade secret route (Law on Intellectual Property, Law on Competition) | Personal data route (Law on Personal Data Protection, Penal Code) |
|---|---|---|
| Whose rights are protected | The business’s rights and competitive advantage | The rights of customers as data subjects; the business is in the position of data controller |
| Who may be dealt with | The former employee and the competitor that uses the information | Mainly individuals and organisations that unlawfully process, use, buy, sell or appropriate data |
| Main remedies | Civil remedies (order to stop the infringement, damages, etc.); action against unfair competition | Administrative penalties; criminal prosecution if all elements of the offence are present |
| Competent authority | People’s Court; competition authority (National Competition Commission) | Specialised personal data protection authority (A05, Ministry of Public Security); investigation authorities |
| Key condition | Prove the information meets Article 84, especially the necessary security measures; prove the damage if claiming compensation | Prove the violation; for criminal liability, the statutory threshold must be met |
| Can the business be compensated? | It can claim compensation for damage | Administrative and criminal penalties do not directly make good the business’s commercial loss |
| Risk for the business itself | Cost and time of proceedings; the information may not be recognised as a trade secret | Its own data protection measures and breach notification duty may be examined |
Analysis: The two routes are not mutually exclusive. The trade secret route helps the business recover its economic interests and stop the competitor from continuing to use the information. The personal data route deters the wrongdoer but puts the business itself in the position of having to explain its own compliance. The choice and order of routes should be based on the actual evidence and the business’s current level of internal compliance.
4. The reverse risk: your business must also explain itself
The data controller must apply appropriate management and technical measures to protect personal data.
Article 23: when a breach of personal data protection rules is discovered in the cases set by law (where it may harm national defence or security, or the lawful rights and interests of data subjects), the data controller must notify the specialised personal data protection authority no later than 72 hours after discovery.
Article 8: the maximum administrative fine is VND 3 billion for ordinary violations; for buying or selling personal data, it is 10 times the revenue earned (if there is no revenue, or it is lower, the maximum is VND 3 billion). The maximum for an individual is half the amount for an organisation.
Analysis: When your business reports an employee for appropriating customer data, the authorities may at the same time examine whether your business applied appropriate protection measures and notified the breach on time. The fines above are the statutory maximums; the specific fine for each violation is set by the instrument on administrative penalties. This risk does not mean your business should not report the case. It means you should prepare your compliance file before dealing with the authorities.
As soon as you find that customer data has been copied out, assess straight away whether the case is one that must be notified under Article 23. Waiting until the internal investigation is finished before considering this may make your business miss the deadline.
5. What to do when you find an employee has taken data
Priority steps- Lock accounts, withdraw access rights and recover the devices involved.
- Preserve evidence: system logs, emails, download history.
- Assess the duty to notify the breach within 72 hours.
- Review contracts, confidentiality agreements and internal rules.
- Gather evidence that the competitor has approached your customers (a bailiff’s record (vi bằng) can be used).
- Send a written demand to stop the infringement and to return or destroy the data.
- Choose a lawsuit, a competition complaint or a criminal report that fits the evidence.
Clause 2, Article 21: where an employee’s work is directly related to trade secrets or technology secrets as provided by law, the employer may agree in writing with the employee on the content and duration of protection of the trade secrets or technology secrets, and on the employee’s entitlements and compensation in case of breach.
Clause 2, Article 125: dismissal as a disciplinary measure applies where the employee discloses the employer’s trade secrets or technology secrets, or infringes its intellectual property rights.
Analysis: Disciplinary dismissal applies only while the employment relationship still exists, and only if the disciplinary procedure and the work rules (nội quy lao động) are followed. If the person has already left, the business relies mainly on the confidentiality agreement already signed and on the civil law rules on compensation for damage.
As for post-employment non-compete agreements, labour law currently has no direct rule on them, and whether they are recognised depends on their content and scope. Your business should not rely on this type of clause alone. It needs a tightly drafted confidentiality agreement.
Demand letters to the former employee and the competitor should cite a specific legal basis and avoid threatening language.
- Do not delete or change logs or the employee’s computer before backing up the evidence.
- Record the time of discovery, to work out the notification deadline.
- Consult a lawyer before filing a criminal report or sending a warning letter, to choose the right route and prepare your business’s own compliance file.
FC Legal reviews access rights, confidentiality agreements and incident procedures to find the gaps before a dispute arises.
6. Where should your business start?
The most effective measure is to prepare before anyone leaves. Once data has been taken, the chance of restoring the original position is usually very limited. A sensible roadmap:
- Take stock of customer data: where it is (CRM, ERP, shared files, personal phones) and who can access it.
- Put the necessary security measures in place: role-based access, limits on data export, access logs, marking of confidential information.
- Standardise employment documents: trade secret protection agreements under Article 21 of the Labour Code 2019 for staff who access the data; update the work rules on disclosure of secrets.
- Align with personal data compliance: data protection policy, incident response procedure and breach notification within 72 hours.
- Leaver procedure: withdraw accounts and devices, confirm handover, and remind the employee of the confidentiality obligations that remain in force.
This set of documents helps you meet the conditions for trade secret protection and also shows that your business has met its obligations as data controller.
Start with a quick review of your sales and technical staff, the roles that hold the most data, to see which documents are missing and which access rights should be narrowed.
7. Frequently asked questions
Is a customer list automatically a trade secret?
No. A list is protected only if it meets all three conditions in Article 84 of the Law on Intellectual Property: it is not common knowledge, it gives a business advantage, and it is kept secret with the necessary measures. A list that anyone can access, with no confidentiality commitment, is very hard to have recognised.
Can an employee who has already left be dismissed as a disciplinary measure?
No. Labour discipline applies only while the employment relationship exists. After the employee has left, the business may claim compensation under the signed confidentiality agreement and under civil law, or use the mechanisms under the Law on Intellectual Property, the Law on Competition or the Law on Personal Data Protection, depending on the evidence.
Is the competitor that receives the data liable?
It may be. Article 127 of the Law on Intellectual Property treats using or disclosing a trade secret while knowing, or being obliged to know, that it was obtained unlawfully as an infringement. Article 45 of the Law on Competition 2018 also prohibits disclosing or using confidential business information without permission.
Can taking customer data lead to criminal liability?
Only if all the elements of the offence are present. Article 288 of the Penal Code applies to unlawfully buying, selling, exchanging or making public private information on a computer network or telecommunications network when the statutory thresholds for illegal gain, damage or consequences are met. Many cases remain civil or administrative matters.
Must the business notify the authorities when an employee has taken data?
You need to assess this straight away. Article 23 of Law No. 91/2025/QH15 requires the data controller to notify the specialised authority no later than 72 hours after discovering a breach in the cases set by law. Consult a lawyer early to determine your obligations and prepare the content of the notice.
8. Legal basis and references
- Law on Personal Data Protection No. 91/2025/QH15 (passed on 26 June 2025, in force from 1 January 2026): Articles 2, 7, 8 and 23.
- Decree No. 356/2025/ND-CP detailing certain articles of, and measures to implement, the Law on Personal Data Protection (in force from 1 January 2026, replacing Decree No. 13/2023/ND-CP).
- Law on Intellectual Property No. 50/2005/QH11 (as amended): Clause 23 of Article 4, Article 84, Article 127.
- Law on Competition No. 23/2018/QH14: Clause 1, Article 45.
- Penal Code No. 100/2015/QH13 (as amended): Article 288.
- Labour Code No. 45/2019/QH14: Clause 2 of Article 21, Clause 2 of Article 125.
- Civil Code No. 91/2015/QH13 (rules on compensation for damage).
- Information on the draft amended Penal Code proposing an offence of infringing personal data: Dân trí newspaper, July 2026.
Review your personal data protection compliance with an FC Legal lawyer
Find out what data your business processes, where it is, which risks to deal with first and which dossiers you must prepare.
- Data map and compliance gap assessment
- Impact assessment dossiers (DPIA) and cross-border transfer dossiers
- Standard policies, vendor contracts and incident response procedures
Please do not send confidential documents or personal data through the form.
This article is for reference. It reflects the rules in force at the time of publication. For legal advice on a specific case, please contact an FC Legal lawyer.
Prepared by the FC Legal legal team and reviewed by FC Legal’s Managing Lawyer. Updated 4 October 2026.
