Most legal risk in a business does not appear suddenly. It builds up through operating habits that seem harmless: signing on the counterparty’s template, using freelancer contracts for full-time staff, using a logo for years without filing for it, chasing overdue debts only by phone. Only when an inspection, a dispute or an investor’s due diligence arrives does the business see the cost. This article sets out 7 warning signs, each linked to one pillar: internal governance, contracts, employment and social insurance, personal data, intellectual property, licences and receivables. For each, it gives the legal basis, the possible consequences and what to do now.
- Legal risk in a business usually shows through operating signs: it is unclear who may sign what, contracts are not reviewed, debts are only chased verbally.
- Commercial contracts: the contractual penalty must not exceed 8% of the value of the breached part of the obligation (Article 301, Commercial Law 2005), except for assessment (giám định) services.
- The Law on Social Insurance 2024 (in force from 1 July 2025) requires payment in full of late or evaded contributions, plus 0.03% per day calculated on the amount and the number of days of the breach.
- The Law on Personal Data Protection (Law No. 91/2025/QH15) is in force from 1 January 2026; the general maximum fine is VND 3 billion, and for cross-border data transfer up to 5% of the previous year’s revenue.
- The limitation period for a commercial dispute is 2 years (Article 319, Commercial Law), and for a civil contract dispute 3 years (Article 429, Civil Code).
- If just 2–3 signs appear together, the business should carry out a full review rather than dealing with each issue separately.
1. Why is legal risk usually found late?
Legal risk rarely causes harm when it first arises. The consequences only appear when something triggers them: a counterparty breaches, an employee leaves and complains, a state authority inspects, a competitor files a trademark application first, or an investor asks for due diligence.
So rather than waiting for an incident, managers should learn to recognise the operating signs that risk is building up. The 7 signs below are not a full list of every compliance obligation. They are the signals we see most often in our advisory practice.
2. Sign 1: Nobody can say for sure “who may sign what, and up to what amount”
Pillar: internal governance and authorisation. Common symptoms:
- The charter is a template; powers of attorney do not state the scope, value or term, or have expired but are still used to sign.
- The company seal and the digital signature token are held by one person, with no written rules.
- Transactions with related persons (a member’s company, a manager’s relatives) are not approved through the required procedure.
- Charter capital has not been fully contributed after the legal deadline, and no change has been registered.
- Civil Code 2015, Articles 142 and 143: a transaction made by a person without authority to represent, or beyond the scope of representation, does not create rights and obligations for the person represented (for the part beyond the scope), unless the person represented accepts it, knows of it and does not object within a reasonable time, or is at fault.
- Law on Enterprises 2020 (as amended by Law No. 76/2025/QH15): contracts and transactions with related persons must be approved by the competent body under Article 67 (multi-member limited liability companies), Article 86 (single-member limited liability companies) and Article 167 (joint stock companies).
- Law on Enterprises 2020, Articles 47, 75 and 113: members, owners and shareholders must contribute the full capital within 90 days from the date of the enterprise registration certificate; if they do not, the company must register an adjustment of its charter capital following the legal procedure.
Unclear signing authority creates risk in both directions: the business may be bound by a transaction its leaders did not want, or it may be unable to make the counterparty perform because the counterparty’s signatory had no authority. A related-party transaction made without the proper procedure may be challenged and declared invalid. Failing to adjust the capital after the contribution deadline may lead to an administrative penalty; members and shareholders who have not contributed in full also remain liable, in proportion to their committed capital, for financial obligations that arose before the adjustment was registered.
- Prepare a one-page authority matrix: type of transaction, value threshold, approver, signatory. Withdraw expired powers of attorney.
- Issue rules on managing the seal and digital signatures, with a usage log.
- Compare the capital actually contributed with the registered charter capital. See also Authority to sign commercial contracts.
3. Sign 2: Contracts are signed on the counterparty’s template without legal review
Pillar: contracts and commercial transactions. Common symptoms:
- There is no set of contract templates; each department drafts its own or signs whatever the counterparty sends.
- Sale and service contracts between two businesses set penalties of 10%, 20% or “based on the contract value”.
- Nobody checks the authority of the counterparty’s signatory.
- Civil Code 2015, Article 418: the parties may agree on a contractual penalty; the amount is agreed by the parties, unless a relevant law provides otherwise.
- Commercial Law 2005, Article 301: the penalty for a breach of a contract obligation, or the total penalty for several breaches, is agreed by the parties but must not exceed 8% of the value of the breached part of the obligation, except in the case in Article 266 (assessment services).
For contracts of a commercial nature, the part of the penalty above 8% is very likely not to be accepted by the dispute resolution body. When you sign on the counterparty’s template, the clauses on limitation of liability, payment and governing law usually favour the drafting party. Contract errors rarely cause immediate harm, but they decide your position when a dispute arises.
- Standardise the 3–5 contract templates you use most. Contracts above a value threshold, or that depart from the template, must go through legal review.
- Draft the contractual penalty clause and the damages clause separately.
- For a deeper review, see Contract Health Check: 12 signs your company’s contract system needs a review.
4. Sign 3: Full-time staff on “freelancer contracts”, insurance paid below actual salary
Pillar: employment, pay and social insurance. Common symptoms:
- Staff with fixed hours, under management and paid monthly, sign service or freelancer (cộng tác viên) contracts.
- Appendices are used to extend fixed-term employment contracts.
- There are no registered work rules, yet staff are disciplined or “fined” through salary deductions.
- Social insurance is paid on a salary lower than the salary actually paid, or paid late for several periods.
- Labour Code 2019 (No. 45/2019/QH14), Article 13: an agreement with a different name but which covers paid work, salary and management, direction and supervision by one party is treated as an employment contract.
- Labour Code 2019, Article 20: a fixed-term employment contract may only be renewed once; Article 22: an appendix to an employment contract must not change the term of the contract.
- Labour Code 2019, Articles 118 and 119: an employer with 10 or more employees must issue written work rules (nội quy lao động) and register them; Article 127 prohibits fines and salary cuts in place of labour discipline.
- Law on Social Insurance 2024 (No. 41/2024/QH15, in force from 1 July 2025), Articles 38–41: these set out late payment and evasion of contributions and the measures for dealing with them. The employer must pay in full the late or evaded contributions plus an amount equal to 0.03% per day calculated on the amount and the number of days of the breach.
- Penal Code, Article 216: the offence of evading social insurance, health insurance and unemployment insurance contributions for employees. A commercial legal entity can also bear criminal liability when all elements of the offence are met.
The name of the contract does not decide the nature of the relationship; the competent authority looks at the actual content. If the relationship is found to be employment, the business may have to pay back insurance contributions and face administrative penalties under the penalty decree in force for labour and social insurance. A disciplinary decision not based on valid work rules is easily treated as unlawful, leading to compensation obligations if the employee sues.
- Review every case of work done under a contract that is not an employment contract, and reassess its true nature.
- Compare the salary actually paid with the salary used for insurance; resolve any gap step by step.
- Complete and register the work rules before applying any form of discipline.
How many of these signs does your business have?
If you recognise 2 or more signs, a full review will help you see which risks to deal with first. FC Legal can assess your current position with you, based on your actual documents.
5. Sign 4: Customer and staff data is collected but nobody is in charge of data protection
Pillar: personal data protection. Common symptoms:
- Collecting staff ID card photos, fingerprints or facial images; keeping customer lists in shared files without a data processing notice.
- Using software or cloud storage with servers abroad without ever assessing the data transfer.
- No policy and no person in charge; documents still follow Decree No. 13/2023/ND-CP and have not been updated for the new law.
- The Law on Personal Data Protection (Law No. 91/2025/QH15) is in force from 1 January 2026; Decree No. 356/2025/ND-CP provides the details and replaces Decree No. 13/2023/ND-CP.
- Law No. 91/2025/QH15 covers the consent of the data subject (Article 9), cross-border personal data transfer (Article 20) and the personal data processing impact assessment (Article 21).
- Article 8, Law No. 91/2025/QH15: the maximum administrative fine is VND 3 billion in general; up to 5% of the previous year’s revenue for breaches of the rules on cross-border personal data transfer; up to 10 times the revenue from buying and selling personal data.
This is the pillar where the legal framework is changing fastest. Documents prepared under Decree No. 13/2023 need to be reviewed against Law No. 91/2025 and Decree No. 356/2025. VND 3 billion and 5% of revenue are maximum levels; the fine for each specific act is set by the penalty decree for this field. Small businesses and start-ups have some conditional exemptions, but they are not exempt from the duty to process data lawfully.
- Build a data map: what is collected, about whom, for what purpose, where it is stored and who it is shared with. Prioritise sensitive data and software with servers abroad.
- Appoint a person in charge. For a detailed review, see Personal data compliance check: a 20-point Legal Health Check and Appointing a data protection officer (DPO).
6. Sign 5: A logo used for years but never filed, outsourced creative work with no ownership clause
Pillar: intellectual property. Common symptoms:
- The brand name and logo are printed on packaging and the website, but no trademark application has been filed.
- Freelancers or agencies are hired to create logos, software or content only through messages or quotations, with no ownership clause.
- Customer lists, formulas and cost prices have no access controls.
- The Law on Intellectual Property 2005 has been amended and supplemented several times, most recently by Law No. 131/2025/QH15 (in force from 1 April 2026).
- Industrial property rights in a trademark are established by a decision granting a protection title, and the first-to-file principle applies: where several applications are filed for identical or confusingly similar subject matter, the protection title is granted to the valid application with the earliest priority date or filing date.
- An organisation that assigns creative work to an author, or contracts with an author, owns the economic rights in the work, unless otherwise agreed.
- Information is protected as a trade secret only if it meets the legal conditions, including that the owner keeps it confidential through necessary measures.
Long use does not replace filing. If a third party files first for an identical or similar trademark, the business may spend a lot of time and money opposing it, or even have to rebrand. For outsourced work, the risk is that there is no sufficiently clear written contract, or that the agency subcontracted to other individuals, breaking the chain of rights. For trade secrets, if the business does not apply confidentiality measures itself, it will be very hard to seek protection when departing staff take data with them.
- Search and file applications for the trademarks and logos in use.
- Add a clause confirming ownership to contracts with agencies and freelancers.
- Set access rights for business data; sign confidentiality agreements with key positions.
7. Sign 6: New business lines, branches or factories opened without checking business conditions
Pillar: sub-licences and business conditions. Common symptoms:
- Adding a new service without checking whether it is a conditional business line.
- No register tracking licences, their terms and the conditions to keep them.
- Putting a new warehouse or workshop into operation before completing fire safety or environmental procedures.
- The Law on Investment 2025 (No. 143/2025/QH15) is in force from 1 March 2026 and replaces the Law on Investment 2020. The list of conditional business lines is issued with the Law; the specific conditions are set by laws and sector-specific instruments. Some provisions on business conditions take effect from 1 July 2026.
- Law on Fire Prevention, Firefighting and Rescue 2024 (No. 55/2024/QH15), in force from 1 July 2025: works that require fire safety design appraisal may only be put into use once the competent authority has issued written approval of the acceptance results.
The common weakness is not failing to obtain a licence, but failing to maintain the conditions after it is granted: a certified staff member leaves, the site moves, the premises are renovated, the licence expires. Depending on the sector, the consequences may be penalties or a forced pause or suspension of operations under sector law, and the risk spreads to contracts when the business cannot deliver.
- Keep a licence register: issuing authority, term, conditions to maintain, person in charge.
- Before opening a new business line or site, check the business conditions and the fire safety and environmental procedures; review the list under the Law on Investment 2025.
8. Sign 7: Overdue debts only chased verbally, with no reconciliation statement
Pillar: receivables management and disputes. Common symptoms:
- Receivables are months overdue, and are chased mainly by phone or message.
- Delivery, acceptance and receivables reconciliation records signed by an authorised person of the customer are missing.
- Nobody tracks the limitation period for each debt.
- Commercial Law 2005, Article 319: the limitation period for bringing a commercial dispute is 2 years from the time the lawful rights and interests are infringed (except in some cases set by law).
- Civil Code 2015, Article 429: the limitation period for a contract dispute is 3 years from the date the person with the right to claim knew or should have known that their lawful rights and interests were infringed.
- Civil Code 2015, Article 157: the limitation period restarts when the obligor acknowledges part or all of the obligation, performs part of it, or the parties settle by mediation; Article 149, Clause 2: the court only applies a limitation period at the request of a party, made before the first-instance court issues its judgment or decision.
- Law on Accounting 2015 (No. 88/2015/QH13) and Decree No. 174/2016/ND-CP: accounting records must be kept for at least 5 years, 10 years or permanently, depending on the type.
When a debt is past the limitation period and the debtor asks for the limitation period to be applied, the business may lose the right to ask a court or arbitration to order payment. A receivables reconciliation statement confirmed by the debtor is both evidence and a possible basis for the limitation period to restart. By contrast, a message from one of the counterparty’s employees promising to pay is often hard to prove as an acknowledgement of the obligation by that business.
- Sign receivables reconciliation statements regularly (for example every quarter) with customers that have large balances.
- Keep a list of overdue debts with their expected limitation dates; prioritise those about to expire.
- Keep delivery and acceptance records in one place, both originals and electronic copies.
9. Summary table: 7 signs, self-check questions and possible consequences
| Sign | Quick self-check question | Possible consequences |
|---|---|---|
| 1. Unclear signing authority | Do you have a written authority matrix and rules on the seal and digital signatures? | Transactions beyond the scope of representation; related-party transactions challenged as invalid; penalties relating to charter capital |
| 2. Contracts not reviewed | Do your commercial contracts set penalties above 8%? Who approves them before signing? | The part of the penalty above the cap is not accepted; a weaker position in disputes |
| 3. Employment and social insurance not matching reality | Does anyone work full time on a freelancer contract? Does the salary used for social insurance match the salary actually paid? | Back payment plus 0.03% per day; administrative penalties; possible criminal liability if all elements of evasion are met |
| 4. Nobody in charge of personal data | Do you have a data map, a policy and a person in charge under Law No. 91/2025? | Penalties up to the maximum in Article 8 of Law No. 91/2025; disruption of data processing |
| 5. Intellectual property not secured | Has the main trademark been filed? Do outsourcing contracts have an ownership clause? | Loss of trademark priority; copyright disputes; difficulty protecting trade secrets |
| 6. Licences not tracked | Is there a register of licences, terms and maintenance conditions? | Penalties; a pause or suspension of operations under sector law |
| 7. Debts only chased verbally | Which debts are close to the 2-year or 3-year limitation period? | Loss of the right to sue if the debtor relies on the limitation period; lack of evidence |
10. Where should your business start?
Not every business needs to deal with all 7 pillars at once. A sensible order is: first the risks that could disrupt operations or create personal liability for managers (licences, fire safety, social insurance, sensitive data); then the risks of losing money (debts close to the limitation period, high-value contracts); and finally standardising the system (internal rules, contract templates, work rules).
- Mark the signs your business has
- Collect the original records for the relevant pillars
- Check them against current rules and list the points of non-compliance
- Set priorities: disruption of operations, then loss of money, then standardisation
- Assign owners and deadlines for the fixes, and review again regularly
For a detailed self-score, you can use Legal health self-check for businesses: 20 criteria in the same section. If you need an objective view, FC Legal’s Legal Health Check service reviews your actual records across the pillars above, classifies the level of risk and proposes an order of action that fits your resources.
11. Frequently asked questions
Do small businesses need to care about these 7 signs?
Yes. Most obligations on contracts, employment, social insurance and limitation periods apply to businesses of every size. Small businesses often have few dedicated staff, so risk builds up more easily. Some fields, such as personal data protection, have conditional exemptions for small businesses, but these do not remove the duty to process data lawfully.
Is a 10% penalty in a sale contract between two companies a problem?
For commercial contracts, Article 301 of the Commercial Law 2005 caps the penalty at 8% of the value of the breached part of the obligation (except for assessment services). The part above the cap is very likely not to be accepted in a dispute. The business should adjust the penalty and draft a separate damages clause.
Does signing a freelancer contract instead of an employment contract help the business avoid social insurance?
Not reliably. Under Article 13 of the Labour Code 2019, an agreement that covers paid work, salary and management, direction and supervision is treated as an employment contract, even if it has another name. In that case, the business may have to pay back insurance contributions and face penalties.
Can a debt more than 2 years old still be recovered?
It depends on the case. The limitation period can restart if the debtor has acknowledged the obligation, paid part of the debt, or the parties have settled by mediation (Article 157, Civil Code 2015). The court also only applies the limitation period when a party asks for it. The business should consult a lawyer early, with a full set of records.
If several signs appear at once, which should be dealt with first?
Prioritise the signs that could disrupt operations or create serious liability: licences, fire safety, social insurance, sensitive data. Next come debts close to the limitation period and high-value contracts. Standardising internal rules and contract templates can follow a roadmap.
12. Legal basis and references
- Civil Code 2015 (No. 91/2015/QH13): Articles 142, 143, 149, 157, 418, 429.
- Commercial Law 2005 (No. 36/2005/QH11): Articles 301, 319.
- Law on Enterprises 2020 (No. 59/2020/QH14), as amended by Law No. 76/2025/QH15: Articles 47, 67, 75, 86, 113, 167.
- Labour Code 2019 (No. 45/2019/QH14): Articles 13, 20, 22, 118, 119, 127.
- Law on Social Insurance 2024 (No. 41/2024/QH15): Articles 38–41.
- Penal Code 2015 (as amended and supplemented): Article 216.
- Law on Personal Data Protection 2025 (No. 91/2025/QH15) and Decree No. 356/2025/ND-CP.
- Law on Intellectual Property 2005, most recently amended and supplemented by Law No. 131/2025/QH15.
- Law on Investment 2025 (No. 143/2025/QH15).
- Law on Fire Prevention, Firefighting and Rescue 2024 (No. 55/2024/QH15).
- Law on Accounting 2015 (No. 88/2015/QH13) and Decree No. 174/2016/ND-CP.
- Sources for legal texts: vbpl.vn, congbao.chinhphu.vn, thuvienphapluat.vn, luatvietnam.vn.
Review your business’s legal health with an FC Legal lawyer
Identify the legal gaps in each area and a prioritised plan that suits your business.
- Review of governance, contract, employment, data and intellectual property records
- A risk report by priority level, with proposed fixes
- Support in standardising internal documents and processes
Please do not send confidential documents or personal data through the form.
This article is for reference. It reflects the rules in force at the time of publication. For legal advice on a specific case, please contact an FC Legal lawyer.
Prepared by the FC Legal legal team and reviewed by FC Legal’s Managing Lawyer. Updated 4 October 2026.
