SaaS Agreement in Vietnam: Template, Key Clauses and Local Law (2026)

A software-as-a-service (SaaS) agreement gives a customer the right to access hosted software over the internet for a subscription fee, rather than a copy to install. It is a licence-plus-service contract covering uptime, support, data, security and renewals. Vietnam has no SaaS-specific statute, but it has an active set of digital laws (on e-transactions, personal data and cybersecurity) that bear heavily on a SaaS deal, especially the 2023 Personal Data Protection Decree. This guide explains the framework, the clauses that matter and a skeleton. It is general information, not legal advice; take Vietnamese counsel before you sign. ## What is a SaaS agreement? In a SaaS model the provider hosts and operates the software and the customer subscribes to use it. Nothing is installed and nothing is sold outright. That shapes the contract: the customer cares about availability, support, data and continuity; the provider cares about scope of use, payment and liability limits. A good SaaS agreement reads as a service contract with a licence inside, not a software sale. ## The law that governs SaaS in Vietnam | Area | Governing source | |------|------------------| | Contract formation and performance | Civil Code 2015 (Law No. 91/2015/QH13) | | Electronic contracting | Law on E-Transactions 2023 (Law No. 20/2023/QH15) | | Personal data | Decree 13/2023/ND-CP on Personal Data Protection | | Cybersecurity and data | Law on Cybersecurity 2018; Law on Information Technology | Two of these shape SaaS terms most: - Law on E-Transactions 2023 (Law No. 20/2023/QH15). It modernised and replaced the 2005 e-transactions law and underpins the validity of electronic contracts and signatures, which matters for online sign-up and acceptance.

• Decree 13/2023/ND-CP on Personal Data Protection (PDPD). Issued on 17 April 2023 and effective 1 July 2023 with no general transition period, it is Vietnam's first comprehensive data-protection instrument and is influenced by the European GDPR. ## Why the 2023 data decree changes SaaS terms The PDPD applies to Vietnamese and foreign organisations that process personal data in Vietnam, which captures a SaaS vendor serving Vietnamese customers. Its practical demands for a SaaS deal include: - Data subject rights. Individuals can access, correct and delete their data, and organisations must honour those requests.
• Security and breach handling. Appropriate security measures are required, with notification duties on breaches.
• Impact assessment dossiers. Controllers and processors must prepare personal-data-processing impact assessment dossiers and submit them to the Department of Cybersecurity within 60 days of starting processing, and keep them available.
• Cross-border transfer. Transferring Vietnamese personal data abroad carries its own assessment and documentation duties. A short grace period after incorporation is available only to micro-enterprises, small and medium enterprises and start-ups. For most SaaS providers, the data-processing schedule is a core, not an optional, part of the contract. ## Key clauses in a Vietnam SaaS agreement ### 1. Access and licence A non-exclusive, non-transferable right to access the service for the term, scoped to named users or usage limits. Make clear nothing is sold and no source code is delivered. ### 2. Subscription, fees and renewal Fees, billing cycle, currency, taxes and renewal. Cross-border payments may involve foreign-exchange rules, so address currency and withholding. ### 3. Service levels and support Uptime commitment, maintenance windows, support hours and response targets, and a proportionate service-credit remedy. ### 4. Data protection and security The data-processing schedule: roles, purposes, security measures, breach notification, assistance with data-subject requests, impact-assessment cooperation and cross-border transfer terms, aligned with the PDPD. ### 5. Intellectual property The provider keeps all IP in the software; the customer keeps its data and content. Address ownership of feedback and configuration. ### 6. Warranties and disclaimers A limited performance warranty with a clear disclaimer of implied warranties, within Civil Code limits. ### 7. Liability A cap (often tied to fees paid) with carve-outs (for data breaches or IP infringement). ### 8. Term, termination and exit Term, renewal, termination for cause, and data return and deletion on exit. A customer that cannot retrieve its data is trapped and exposed under the PDPD. ### 9. Governing law and disputes Vietnamese law and a forum (Vietnamese courts or arbitration such as VIAC) and language. ## A short SaaS agreement skeleton 1. Parties and recitals

2. Definitions
3. Access rights and licence scope
4. Subscription, fees, taxes and renewal
5. Service levels and support
6. Customer responsibilities and acceptable use
7. Data protection schedule (roles, security, breach, impact assessment, transfers)
8. Intellectual property
9. Confidentiality
10. Warranties and disclaimers
11. Limitation of liability
12. Term, suspension and termination
13. Data return and deletion on exit
14. Governing law and dispute resolution
15. Signatures Use this as a structure to adapt with Vietnamese counsel, not a finished contract. The data decree is recent and guidance is still developing, so confirm the current position before relying on any clause. ## Common mistakes - Treating data terms as boilerplate when the PDPD imposes impact assessments and transfer duties.

• Assuming the PDPD does not reach you because you have no Vietnamese entity.
• Missing the 60-day impact-assessment dossier timeline.
• Leaving data return and deletion vague, which traps the customer and raises data-law risk. ## Keeping SaaS contracts and their renewals in one place A SaaS business is a portfolio of near-identical contracts with different data schedules, service levels and renewal dates, and a new regime like the PDPD means every data schedule may need a fresh look. The work of drafting each contract from a master template, checking the data and liability terms, and tracking every auto-renewal is exactly what an AI contract workspace is meant to carry in one place: generate each agreement from your approved template, see each clause flagged where it drifts from standard or carries risk, edit in plain language, and keep a live timeline of renewals and obligations. On jurisdiction depth, Adira is India-first today with other jurisdictions on its roadmap, so for Vietnam-specific drafting it supports the workflow while local-law depth is built out; you can read more at Adira. One source of truth across a stack of subscriptions beats scattered files when a new data law lands.