A Business Process Outsourcing (BPO) arrangement without a well-structured contract is one of the most common sources of operational and legal risk for businesses in Vietnam. Clear documentation of the scope of services, performance standards, data protection obligations and remedies is essential to help prevent disputes and establish clear responsibilities between the parties.
These considerations have become even more important in 2026. Vietnam's new Personal Data Protection Law (PDPL, Law 91/2025/QH15) and Decree 356/2025/ND-CP took effect on 01 January 2026, replacing Decree 13/2023. For BPO arrangements involving personal data, including payroll, HR, accounting and customer service contracts, they now need to reflect the updated data protection framework and its significantly higher penalties.
What is a BPO Contract and What Business Functions can be Outsourced in Vietnam?
A BPO contract is a legal agreement between a client company and a BPO service provider in Vietnam, authorising the provider to manage specific non-core business functions. The provider acts as an agent of the client company in the operational chain, with payments typically contingent on meeting agreed performance standards.
Common functions outsourced in Vietnam include:
- Payroll processing and Personal Income Tax (PIT) compliance
- Bookkeeping and accounting (monthly, quarterly, annual)
- Human resources administration and recruitment support
- IT support and software development
- Customer service and call centre operations
- Data entry, document management, and back-office processing
- Sales support, appointment setting, and marketing operations
What are the Four Main Types of BPO Contracts in Vietnam?
BPO contracts fall into four main categories, each suited to different project characteristics and risk appetites:
|
Contract type |
Payment mechanism |
Key advantage |
Best for |
|
Time & Materials (T&M) |
Billing based on actual time spent and materials used at pre-agreed hourly rates. |
Flexible; ideal when project scope may evolve; transparent cost tracking. |
Software development, IT support, ongoing consulting. |
|
Fixed Price |
Set price for the entire project agreed upfront by both parties. |
Predictable cost; defined scope and timeline; easier to budget. |
Marketing campaigns, standardised back-office services. |
|
Flexible Scope (DSDM) |
Agile framework — scope adapts while timeline and quality remain fixed. |
Strong collaboration; adaptive planning; continuous delivery of value. |
Complex implementations, software products. |
|
Pain Share / Gain Share |
Payments tied to predefined performance metrics, both parties share upside and downside. |
Aligns incentives; encourages partnership mindset; performance-driven compensation. |
Customer service operations, sales outsourcing. |
Strategic Note: For payroll and HR BPO, a Fixed Price contract with clearly defined monthly deliverables is the most common structure, providing cost certainty and measurable SLAs.
Why is a BPO Contract Important?
A well-drafted BPO contract serves three core functions:
- Defines scope and expectations precisely: Preventing "scope creep" and ambiguity about what is and is not included in the service.
- Creates legal protection: Documenting responsibilities, remedies, IP ownership, and exit rights that courts or arbitrators can enforce.
- Ensures regulatory compliance: Addressing data protection (PDPL 2026), tax treatment of outsourcing fees (Foreign Contractor Tax for offshore BPO), and statutory labour obligations.
What are the Key Elements Every BPO Contract in Vietnam Must Include?
To protect your business in 2026, ensure your BPO contracts cover the following elements:
|
Contract element |
What to include |
2026 Update / Practical Note |
|
Scope of services |
Clear definitions of outsourced processes, expected deliverables, and explicit exclusions. |
If covering HR/payroll, specify compliance obligations for 2026 changes (minimum wage, new PIT brackets, e-contracts). |
|
Service Level Agreements (SLAs) |
Measurable performance standards (response times, error rates) and escalation procedures. |
Include specific SLAs for payroll processing dates and tax filing accuracy, as errors trigger direct financial penalties. |
|
Pricing and payment terms |
Pricing model, billing frequency, currency, and handling of scope changes. |
For cross-border BPO, address Vietnam's Foreign Contractor Tax (FCT) implications for offshore providers. |
|
Confidentiality & IP |
Definitions of confidential information, protection methods, and IP ownership. |
Must align with PDPL. Bank account details, ID documents, and transaction history are now classified as sensitive data. |
|
Data protection & PDPL compliance |
Specify data controller vs. processor roles, processing purposes, breach notification, and DPO appointment. |
A formal Data Processing Agreement (DPA) is mandatory. Penalties for non-compliance can reach up to VND 3 billion. |
|
Term, renewal & termination |
Initial duration, renewal conditions, notice periods, and exit assistance obligations. |
Include provisions for regulatory-triggered amendments to renegotiate terms if new laws affect service delivery. |
|
Dispute resolution & governing law |
Governing law and mechanism (negotiation, mediation, arbitration, or litigation). |
The Vietnam International Arbitration Centre (VIAC) is commonly used and enforceable under the New York Convention. |
|
Compliance & audit rights |
Client’s right to audit the provider’s operational and regulatory compliance. |
Under Decree 356, data controllers must ensure processors comply with PDPL. Audit rights should reflect this. |
How does the new PDPL Affect BPO Contracts in Vietnam?
The implementation of the PDPL (Law 91/2025/QH15) and Decree 356/2025/ND-CP on 01 January 2026 represents a significant change to Vietnam's data protection framework.
- Data Processing Agreement (DPA): All BPO arrangements involving personal data must have a formal DPA. Without it, the contract is non-compliant, risking fines up to VND 3 billion.
- Data Protection Officer (DPO): Both the client and the BPO provider must appoint a DPO or Data Protection Department, though exemptions apply for small enterprises (≤5 years old) under certain conditions.
- Sensitive Data: Most payroll and HR contracts handle salary data, tax codes, and bank accounts, all now classified as sensitive data requiring enhanced protection measures.
- Breach Notification: Contracts must outline who is responsible for notifying the Ministry of Public Security (A05 Department) and the internal timeline for reporting breaches between the provider and the client.
What are the Risks of Non-Compliance of Contracts in Vietnam?
Failing to maintain a compliant BPO contract exposes both the client and provider to:
- Operational disputes: Ambiguity leads to disagreements over costs and remedies for missed SLAs.
- Data protection penalties: Fines up to VND 3 billion for general violations, and up to 5% of annual revenue for cross-border transfer violations under the PDPL.
- Tax penalties: Incorrect treatment of offshore BPO payments can trigger 20% underpayment fines and 0.03%/day late payment interest.
- Reputational damage: Service failures or data breaches severely damage brand trust and employee satisfaction.
Secure the Right BPO Contract Framework
Ascentium Vietnam supports businesses with BPO contract reviews, Data Processing Agreements (DPAs) and Service Level Agreements (SLAs), helping you address the requirements of Vietnam's 2026 regulatory framework and manage your outsourcing arrangements with greater clarity.
How Can We Help:
Ascentium Vietnam provides comprehensive BPO services and contract advisory support for foreign businesses operating in Vietnam:
- BPO Contract Review: Reviewing existing agreements for PDPL compliance, SLA adequacy, and alignment with 2026 regulations.
- PDPL Compliance Advisory: Preparing Data Processing Agreements (DPAs), supporting DPO appointments, and guiding Cross-Border Data Transfer Impact Assessments (CDTIA).
- Payroll & Accounting BPO: Delivering compliant monthly payroll, bookkeeping, tax finalizations, and financial reporting under Circular 99/2025.
- HR Administration: Managing labor contracts, social insurance, and compliance monitoring.
Let Us Help You Secure Your BPO Partnerships
Frequently Asked Questions
A BPO contract is a legal agreement between a client company and a third-party service provider authorising the provider to manage specific non-core business functions (e.g., payroll, accounting, IT support). It defines the scope, performance standards, pricing, and data protection obligations.
The four main types are Time & Materials (T&M) for flexible billing, Fixed Price for predictable budgets, Flexible Scope (DSDM) for agile projects, and Pain Share/Gain Share where payments are tied to performance metrics.
The implementation of the Personal Data Protection Law (PDPL, Law 91/2025/QH15) and Decree 356/2025/ND-CP on 01 January 2026. BPO contracts processing personal data must now include a formal Data Processing Agreement (DPA) and address strict security and breach notification protocols.
It applies to any BPO arrangement involving the processing of personal data of Vietnamese individuals, which covers almost all payroll, HR, customer service, and accounting BPO contracts.
Fines can reach up to VND 3 billion for general violations, up to 10× revenue for data trading, and up to 5% of annual revenue for cross-border transfer violations. BPO clients bear liability if they fail to ensure their providers comply.
At minimum, it should include the scope of services, SLAs, pricing and payment terms, confidentiality and IP ownership, a DPA aligned with the PDPL, termination clauses, dispute resolution mechanisms, and audit rights.
Parties can choose foreign governing law in commercial contracts, subject to limitations. However, if the BPO involves processing the data of Vietnamese individuals, compliance with Vietnam's PDPL is mandatory regardless of the governing law chosen.
Yes. A BPO contract should establish termination rights, notice periods, renewal conditions and exit assistance obligations. It can also address amendments where regulatory changes affect service delivery.
A BPO contract should specify the governing law and dispute resolution mechanism, which may include negotiation, mediation, arbitration or litigation. The article identifies the Vietnam International Arbitration Centre (VIAC) as a commonly used option.
