Many businesses only look at their legal records when there is already a dispute, an inspection team at the door or an investor asking for due diligence. By then, a resolution passed in the wrong order, a template contract with a penalty above the legal cap or unregistered work rules can become a weak point that is hard to fix. A Legal Health Check (khám sức khỏe pháp lý doanh nghiệp) helps you find these gaps early, while they are still cheap to fix and you are still in control. The period 2025–2026 matters even more because several important laws have changed. This article explains what a Legal Health Check is, how it differs from legal due diligence, when to do one, which six areas it reviews, the standard process and what your business receives at the end.
- A Legal Health Check is a systematic review of a company’s records, contracts, internal rules and actual practice against current law, to find risks early.
- Unlike Legal Due Diligence, which serves a buyer or investor, a Legal Health Check is started by the business itself to prevent problems and standardise its documents.
- When to do one: every year, before raising capital, borrowing or an M&A deal, when the owner or legal representative changes, when opening a new line of business and when a new law takes effect.
- Six core areas: governance and capital; contracts; employment and social insurance; personal data; intellectual property; tax, accounting, records and receivables.
- The most valuable output is not a list of errors. It is a risk map with priorities and an action plan with owners and deadlines.
- Several new legal milestones need attention: the amended Law on Enterprises 2025 (from 1 July 2025), the Law on Personal Data Protection (from 1 January 2026) and the Law on Tax Administration 2025 (from 1 July 2026).
1. What is a Legal Health Check?
A Legal Health Check is a systematic review of the whole “legal body” of a business: incorporation and governance records, contracts, internal rules, employment records, data, intellectual property, accounting records and receivables. Each group of documents is checked against current law and against how the business actually operates.
Like a regular medical check-up, the aim is not to treat an “illness” that has already appeared. It is to find hidden gaps early: a resolution passed in the wrong order, a template contract with a penalty above the legal cap, work rules that were never registered, or an outsourced design contract that did not transfer the rights. These points rarely cause harm at once, but they can turn into a dispute, a penalty decision or a weak point in negotiations with investors.
A Legal Health Check differs from ad hoc advice (answering each question as it arises) because it looks at the whole system at one point in time. It differs from a financial audit because it focuses on the legality, validity and enforceability of documents and processes, not on the accuracy of the figures. This article covers the full Legal Health Check. If your business only needs to review personal data, see Personal data compliance check: a 20-point Legal Health Check across 6 pillars.
How does a Legal Health Check differ from Legal Due Diligence?
The two use similar techniques (requesting documents, reading records, interviewing staff), but their purpose and the party that benefits are fundamentally different:
| Criterion | Legal Health Check | Legal Due Diligence |
|---|---|---|
| Who starts it | The business itself (owners, management) | A buyer, investor, bank or partner |
| Purpose | Prevent risk, standardise records and processes | Assess the target to make a transaction decision |
| Timing | Regularly, or before internal turning points | Tied to a specific deal (M&A, fundraising, lending) |
| How the results are used | Plan fixes, revise templates, train staff | Negotiate price, conditions precedent, warranties and indemnities |
| Confidentiality | The report is for the business’s internal use | The results serve the assessing party |
Treat a Legal Health Check as a “self-check first” when you know a Legal Due Diligence is coming. A business that fixes its weak points before the investor finds them keeps control of the negotiation, instead of having to explain or accept unfavourable terms.
2. When should a business have a Legal Health Check?
A Legal Health Check works best when it follows the business cycle and key turning points, rather than being done at random. Times to consider:
- Every year, ideally before year-end finalisation and before the annual General Meeting of Shareholders or Members’ Council meeting. At this point the year’s contracts, invoices and payment records need to match, and the validity of sector licences should be checked.
- Before raising capital, taking a large bank loan or preparing for M&A. Investors will look closely at capital contributions, the ownership structure, intellectual property rights and possible labour disputes.
- When members or shareholders, the legal representative or the founding team change. You need to separate responsibilities between management periods and check that transfer and appointment documents are valid.
- When opening a new line of business, especially a conditional business line. Identify in advance the licences and the conditions on facilities, staff, fire safety and the environment.
- When the legal framework changes significantly, or during digital transformation: digitising customer data, automated marketing, using cloud services abroad.
- After an incident: a dispute, an inspection or audit, or when key staff leave.
If you are not sure whether your business “has a problem”, the article 7 warning signs that your business is carrying legal risk in the same section helps you spot the warning signals quickly.
- Law No. 76/2025/QH15 amending and supplementing the Law on Enterprises No. 59/2020/QH14, in force from 1 July 2025 (including the requirement to collect, update, keep and provide information on beneficial owners).
- The Law on Personal Data Protection (Law No. 91/2025/QH15), in force from 1 January 2026; Decree No. 356/2025/ND-CP guides its implementation and replaces Decree No. 13/2023/ND-CP.
- The Law on Tax Administration No. 108/2025/QH15 replaces the Law on Tax Administration No. 38/2019/QH14 from 1 July 2026.
Schedule a full Legal Health Check once a year and add “event-based” reviews (before fundraising, when the legal representative changes, when a new law takes effect). Small businesses can start with the 2–3 highest-risk areas and expand step by step.
3. Which areas does a Legal Health Check review?
A full Legal Health Check usually covers six areas. The table below summarises the core question and the main documents for each area. The following sections cover the most important legal points in each.
| Area | Core question | Documents usually needed |
|---|---|---|
| Corporate governance and capital | Has capital been contributed on time? Were resolutions and decisions made with the right authority and procedure? | Enterprise registration certificate, charter, register of members/shareholders, meeting minutes, resolutions |
| Commercial contracts | Who may sign? Are the penalty, damages, termination and dispute resolution clauses enforceable? | Template contracts, major contracts in force, powers of attorney, approval rules |
| Employment and social insurance | Do employment contracts, work rules, disciplinary and termination procedures comply with the law? Are social insurance contributions paid in full? | Employment contracts, work rules, collective agreement, payroll, disciplinary files, social insurance records |
| Personal data | On what basis does the business collect, share and store customer and staff data? | Privacy policy, consent forms, contracts with data processors |
| Intellectual property and confidentiality | Do the brand, software and content really belong to the business? | Protection titles and applications, outsourced creative contracts, NDAs with staff and partners |
| Tax, accounting, records and receivables | Do contract, acceptance, invoice and payment match? Is there enough evidence to recover receivables? | Records of major transactions, receivables reconciliation statements, previous inspection files |
1. Corporate governance and capital contributions
This area establishes the “standing” of every internal decision. Three points often create risk: charter capital that was registered but not fully contributed and not adjusted; resolutions passed in the wrong order or without the authority required by the charter; and transactions between the company and related persons without proper approval. In addition, a charter drafted long ago may not reflect the changes in the amended Law on Enterprises 2025, for example on beneficial owner information.
- Law on Enterprises 2020 (Articles 47, 75, 113): members, owners or shareholders must contribute the full capital within 90 days from the date of the enterprise registration certificate. If the capital is not fully contributed, the company must register a change of charter capital to the amount actually contributed within 30 days from the last day for full contribution (for multi-member limited liability companies under Article 47).
- Article 151, Law on Enterprises 2020: a shareholder or group of shareholders under Clause 2, Article 115 (holding 5% or more of total ordinary shares, or a smaller percentage set by the charter) may ask a court or arbitration to review and cancel a resolution of the General Meeting of Shareholders within 90 days from receiving the resolution or the minutes, if the procedure for convening the meeting and making decisions seriously breached the rules, or if the content of the resolution breaches the law or the charter.
- Articles 67, 86 and 167, Law on Enterprises 2020 (as amended): contracts and transactions between the company and related persons must be approved by the competent body following the procedure set by law.
Prepare a reconciliation of “registered capital, capital actually contributed, contribution evidence” for each member or shareholder, and a list of key resolutions with checks: who convened the meeting, how notice was given, what the voting ratio was. A major transaction based on a resolution with a procedural defect should be a priority.
2. Commercial contracts
Contracts generate revenue, but they are also the most common source of disputes. A Legal Health Check does not re-read every contract. It focuses on standard templates and on high-value contracts in force, with four questions: does the signatory have enough authority; are the contractual penalty and damages clauses enforceable; are the termination and force majeure conditions clear; and is the dispute resolution mechanism (court or arbitration) suitable?
A common mistake is agreeing a very high penalty (for example 15–20% of the contract value) in a commercial contract without noticing the penalty cap in the Commercial Law. In a dispute, the part above the cap may not be accepted by the dispute resolution body. For more detail, see Contract Health Check: 12 signs your company’s contract system needs a review and Authority to sign commercial contracts.
- Civil Code 2015, Articles 142 and 143: a transaction made by a person without authority to represent, or beyond the scope of representation, does not create rights and obligations for the person represented, except in cases set by law (such as later approval).
- Civil Code 2015, Article 418: the contractual penalty is agreed by the parties, unless a relevant law provides otherwise.
- Commercial Law 2005, Article 301: the penalty for breach of a commercial contract obligation must not exceed 8% of the value of the breached part of the obligation (except in the case in Article 266).
- Commercial Law 2005, Article 319: the limitation period for bringing a commercial dispute is 2 years from the time the lawful rights and interests are infringed; Civil Code 2015, Article 429: the limitation period for a contract dispute is 3 years.
Issue a signing authority matrix (who may sign which type of contract, up to what amount), review the penalty clauses in your commercial contract templates, and track the limitation period of large receivables against the 2-year mark so you do not lose the right to sue.
3. Employment, pay and social insurance
Employment relationships are checked by several authorities and can easily lead to collective complaints. In a Legal Health Check, check that offer letters, employment contracts and appendices are consistent; check that the work rules (nội quy lao động) have been issued and registered correctly; review recent disciplinary and termination files; and compare the salary used for social insurance contributions with the salary actually paid.
The largest financial risk usually comes from a termination made without the correct procedure. The obligation is not only compensation. It also covers salary and social insurance for the whole period the employee was not allowed to work. For social insurance, late or underpaid contributions over a long period can have consequences beyond administrative penalties.
- Labour Code 2019, Articles 118 and 119: an employer with 10 or more employees must have written work rules and register them with the provincial labour authority; the registration file must be submitted within 10 days from the date the work rules are issued.
- Labour Code 2019, Article 41: when an employer unilaterally terminates an employment contract unlawfully, it must take the employee back, pay salary and social, health and unemployment insurance for the days the employee was not allowed to work, and pay at least 2 additional months’ salary under the contract. The article also sets the additional payments if the employee does not want to return or the parties agree not to continue.
- Penal Code 2015 (amended 2017), Article 216: the offence of evading social insurance, health insurance and unemployment insurance contributions for employees. It applies when deception or other tricks are used to avoid paying, or to underpay, for 6 months or more and the quantitative thresholds of the article are met. A commercial legal entity can also bear criminal liability for this offence.
Check three files first: the work rules (registered or not, updated for the Labour Code 2019 or not), the termination and disciplinary procedure (minutes kept, correct grounds or not), and a comparison of the salary actually paid with the salary used for social insurance. Specific administrative penalty levels must be checked against the penalty decree in force at the time of the review.
4. Personal data protection
From 1 January 2026, personal data protection is governed at the level of a law. Any business that holds data on customers, staff, job applicants or app users falls within the scope of the review. In a full Legal Health Check, the main questions are: what types of data does the business process, on what legal basis, who does it share them with (including cloud service providers and a parent company abroad), and does it already have a policy and a person in charge?
The detailed checklist for this area is in Personal data compliance check: a 20-point Legal Health Check across 6 pillars and Appointing a data protection officer (DPO).
- Law on Personal Data Protection (Law No. 91/2025/QH15), in force from 1 January 2026; Decree No. 356/2025/ND-CP provides guidance and replaces Decree No. 13/2023/ND-CP.
- Article 8 of the Law sets the maximum fines: up to VND 3 billion in general; up to 5% of the previous year’s revenue for breaches of the rules on cross-border personal data transfer; up to 10 times the revenue earned from buying and selling personal data.
5. Intellectual property and business confidentiality
Brands, software, content and customer databases are often the most valuable assets, but the least checked. Three questions need answers:
- Have the trademarks and logos in use been filed for protection, in the right name (the company or a founder personally) and for the right classes of goods and services?
- Do outsourced design, programming and content contracts clearly transfer the rights to the business, or does the contractor still hold them?
- Have staff who hold know-how, source code or customer lists signed a non-disclosure agreement (NDA), and is there a process to remove their access when they leave?
The Law on Intellectual Property applies the first-to-file principle when granting protection titles for industrial property such as trademarks. Where several applications are filed for identical or confusingly similar trademarks, the protection title is granted only to the valid application with the earliest priority date or filing date.
Do not leave your main brand in a founder’s personal name or unfiled. Add a rights-transfer clause to every outsourced creative contract and keep acceptance and payment records as evidence.
6. Tax, accounting, records and receivables
This area links legal matters to cash flow. The review focuses on whether the chain “contract, acceptance or delivery record, invoice, payment record” matches for major transactions; whether records are kept for the periods required by law; and the quality of receivables files. A receivables reconciliation statement signed by someone without authority, or where the signatory cannot be identified, will seriously weaken your position if you have to recover the debt through a court or arbitration.
With the new Law on Tax Administration in force from 1 July 2026, this is a good time to review internal processes for invoices, records and responsibility for tax filing, rather than waiting for the finalisation period.
- Law on Accounting No. 88/2015/QH13 and Decree No. 174/2016/ND-CP: accounting records must be kept for at least 5 years, 10 years or permanently, depending on the type of record.
- The Law on Tax Administration No. 108/2025/QH15 replaces the Law on Tax Administration No. 38/2019/QH14 from 1 July 2026.
Select a sample of the 10–20 largest transactions of the year and check the full chain of records. Standardise the receivables reconciliation template (state the full name, title and basis of authority of the counterparty’s signatory).
Administrative penalty levels in each field (enterprises, employment, social insurance, tax, invoices, intellectual property) are set in separate penalty decrees and change over time. This article does not list specific fines. In an actual review, check the instruments in force at the time of the assessment.
4. What are the steps of a standard Legal Health Check?
6 steps of a business Legal Health Check- Define the scope and priority areas, and sign a confidentiality undertaking
- Send the document request list and collect the records
- Review the records and interview the departments
- Classify the findings and build a risk map
- Hand over the report and action plan
- Follow up on fixes and re-check regularly
Step 1: Define the scope. Not every business needs to review all six areas in the same depth. A manufacturer with many workers will prioritise employment and safety; a technology company will prioritise intellectual property and data; a business preparing to raise capital will prioritise capital and governance. A clear scope from the start helps control time and cost.
Step 2: Collect documents. The reviewer sends a document request list for each area, adapted to the size and business model. The quality of the conclusions depends directly on whether the documents are complete and are the versions actually in use.
Step 3: Review and interview. Reading the records only shows what the business has written. Interviewing the chief accountant and the heads of HR, operations and sales shows what the business actually does. The gap between the two is often where the largest risk lies.
Step 4: Build a risk map. Instead of a long list of errors, each finding is assessed on two axes, likelihood and impact, and placed in one of three priority zones.
Step 5: Report and action plan. Present to the owners and management; agree what to do first and who is responsible.
Step 6: Follow up and re-check. A Legal Health Check only has value if its recommendations are carried out. A re-check after one cycle shows how much has improved.
| Risk zone | How to recognise it | Common examples | How to handle it |
|---|---|---|---|
| Red: serious | A direct breach that may lead to suspension of operations, heavy penalties, criminal liability or invalidity of a core transaction | Running a conditional business line without meeting the conditions; long-overdue social insurance contributions; a major transaction based on a resolution passed without authority | Act immediately with a specific plan and report directly to management |
| Amber: medium | Defects in procedure, contract wording or internal rules that may cause financial loss or a disadvantage in a dispute | A penalty clause above the cap in a commercial contract template; unregistered work rules; an outsourcing contract without a rights-transfer clause | Plan the changes within a set period and re-standardise the templates |
| Green: low | Technical drafting or record-keeping errors, or not yet following good governance practice | An incomplete resolution register; a bilingual version with wording differences that do not change the substance | Include in the regular improvement plan |
The business should set the deadline for each zone itself, based on its resources and level of exposure, rather than applying a fixed timetable. What matters is that every red-zone finding has one responsible person and a specific completion date.
5. What does the business receive after a Legal Health Check?
A good Legal Health Check report must be usable straight away by decision-makers, not only by lawyers. The outputs usually include:
| Output | Content | Who uses it |
|---|---|---|
| Executive summary | The overall picture, red-zone risks, recommended priorities | Owners, Board of Directors / Members’ Council, Director |
| List of findings | Each issue, its legal basis, related documents and risk level | Management, heads of departments |
| Risk map / matrix | Red, amber and green zones by likelihood and impact | Management, internal control |
| Action plan | Tasks, owners, deadlines, resources | The departments that carry out the work |
| Proposed templates | Contract templates, internal rules and forms to amend or add | Legal, HR, sales |
| Proposed maintenance mechanism | How to monitor compliance after the review (contact person, update schedule, regular reporting) | Management |
The final output usually leads to the question “who will keep all this going?”. The choice between building an in-house legal function or outsourcing it, and the right legal model for a business with 20–200 staff, are covered in two articles in the same series: In-house or outsourced legal function and A legal function model for businesses with 20–200 staff.
6. What are the risks of skipping regular reviews?
The usual reasons for delay are “nothing has happened yet” or concern about cost. But legal risk usually builds up quietly and shows itself at the worst possible moment:
- Financial risk: administrative penalties, back taxes, liability for damages, or failing to recover losses because the contract clauses were poorly drafted.
- Governance risk: a resolution may be challenged and cancelled, which then raises disputes over the validity of transactions based on it.
- Deal and partner risk: legal defects slow down or break fundraising and loan negotiations; large partners in the supply chain increasingly ask for evidence of compliance.
- Personal risk for managers: the legal representative and managers may be personally liable in some cases set by law, including criminal liability for certain acts such as evading social insurance contributions for employees.
Not every mistake leads to serious consequences. The level depends on the nature of the issue, how long it has lasted and how the business fixes it. That is exactly why finding it early and fixing it yourself always puts your business in a better position.
7. Where should your business start?
You do not need to wait for a full review to start. You can follow three steps:
- Quick self-assessment: use the 20 criteria for an SME legal health self-check in the same section to see which areas are on “amber” or “red”.
- Gather the core records: the charter, the enterprise registration certificate, the register of members or shareholders, resolutions from the last 12 months, the main contract templates, the work rules, the data policy and IP protection titles.
- Book an independent review of the 2–3 highest-risk areas, then expand according to an annual plan.
If tomorrow an investor, a bank or an inspection team asked to see your capital contribution records, resolutions, employment contracts and sales contract templates, could your business produce them within a week, complete and consistent?
Know how “healthy” your business is before the risks speak up
FC Legal reviews the scope your business chooses, builds a risk map and a prioritised action plan so management can make decisions.
8. Frequently asked questions
Is a Legal Health Check required by law?
No. The law does not require private businesses to carry out a Legal Health Check. It is a voluntary risk management activity. However, the obligations checked in the review (capital contributions, registering work rules, paying social insurance, protecting personal data, keeping records and so on) are all mandatory, so a review shows how far the business is complying.
How often should a business have a Legal Health Check?
A reasonable practice is a full review once a year, plus event-based reviews: before fundraising, a large loan or M&A; when the owner or legal representative changes; when opening a new line of business; or when an important new law takes effect, such as the Law on Personal Data Protection from 1 January 2026.
Does a small business need a Legal Health Check?
Yes, but with a narrow scope. Small businesses often have no dedicated legal staff, so mistakes can remain for a long time without anyone noticing. You can start with the self-check, then have an independent review of the 2–3 highest-risk areas, such as capital and governance, contracts and employment.
How does a Legal Health Check differ from Legal Due Diligence?
A Legal Health Check is started by the business itself to prevent problems and standardise its documents, and the results are for internal use. Legal Due Diligence is carried out by a buyer, investor or lender on a target business to support a transaction decision and the negotiation of terms.
What should be prepared before a Legal Health Check?
Set the objective (regular review, preparing to raise capital, after an incident and so on), appoint one internal contact person, and gather the core records: the enterprise registration certificate, the charter, the register of members or shareholders, resolutions, contract templates, employment files, the data policy, IP protection titles and the records of major transactions.
9. Legal basis and references
- Law on Enterprises No. 59/2020/QH14, as amended and supplemented by Law No. 76/2025/QH15 (in force from 1 July 2025): Articles 47, 67, 75, 86, 113, 115, 151, 167.
- Civil Code No. 91/2015/QH13: Articles 142, 143, 418, 429.
- Commercial Law No. 36/2005/QH11: Articles 301, 319.
- Labour Code No. 45/2019/QH14: Articles 41, 118, 119.
- Penal Code 2015 (amended and supplemented 2017): Article 216.
- Law on Personal Data Protection No. 91/2025/QH15 (in force from 1 January 2026): Article 8; Decree No. 356/2025/ND-CP.
- Law on Intellectual Property (first-to-file principle).
- Law on Accounting No. 88/2015/QH13; Decree No. 174/2016/ND-CP.
- Law on Tax Administration No. 108/2025/QH15 (in force from 1 July 2026).
Review your business’s legal health with an FC Legal lawyer
Identify the legal gaps in each area and a prioritised plan that suits your business.
- Review of governance, contract, employment, data and intellectual property records
- A risk report by priority level, with proposed fixes
- Support in standardising internal documents and processes
Please do not send confidential documents or personal data through the form.
This article is for reference. It reflects the rules in force at the time of publication. For legal advice on a specific case, please contact an FC Legal lawyer.
Prepared by the FC Legal legal team and reviewed by FC Legal’s Managing Lawyer. Updated 4 October 2026.
