Vietnam’s Data Regulations: Part 2- Draft Decree on Data-related Activities

Posted by Written by Vu Nguyen Hanh Reading Time: 6 minutes

In this series about data regulation in Vietnam, we explore the key aspects of the proposed regulations and their potential impact on data-related businesses in the country. This article focuses on the draft Decree on Data-related Activities that guides the management and development of different data business models in Vietnam.

Following the introduction of Law No. 60/2024/QH15 on Data (“Data Law”) in November 2024, Vietnam’s government has yet to officially introduce detailed regulations to guide the actual implementation of this milestone law. However, a series of new regulatory instruments will soon address the void, whose drafts were released in January 2025.

These documents include:

FIND BUSINESS SUPPORT
Identify Business Risks with Entity Health Checks and Partner Review Services
  • Draft decree on detailed regulations and implementation measures for the Data Law (“Implementation Decree”);
  • Draft decree on scientific, technological, and innovative activities and data-related services (“Decree on Data-related Activities”);
  • Draft decree on the National Data Development Fund (“NDDF Decree”); and
  • Draft decision on core and critical data classification.

Vietnam is currently preparing four legal documents to facilitate the enforcement of its new Data Law, set to take effect on July 1, 2025. In this series on Vietnam’s data regulation, we examine the key aspects of these proposed regulations and their potential impact on data-related businesses in Vietnam.

Also read: Vietnam’s Data Regulations: Part 1- Draft Decree for Data Law Implementation

What does the draft Decree on Data-related Activities encompass?

The draft decree establishes regulatory guidelines and requirements governing the management, development, and controlled testing of research activities. It also covers the application of science, technology, and innovation in the construction, development, protection, administration, processing, and utilization of data, as well as the provision and usage of data products and services.

It contains 41 articles, which are divided into eight chapters, that prescribe the following key aspects:

  • General rules;
  • Scientific, technological, and innovative activities in construction, development, protection, management, processing, and use of data;
  • Data intermediation products and services;
  • Data analysis and aggregation products and services;
  • Data exchange platforms;
  • State management responsibilities for scientific and technological activities, innovation, and data products and services; and
  • Implementation provisions.

The draft decree stipulates that providers of data intermediation products and services between users and state agencies, as well as those involved in data analysis and aggregation, must meet specific business requirements. These requirements include criteria related to entity status, personnel qualifications, financial obligations, facilities, business plans, and licensing. Moreover, the draft decree includes 27 forms addressing licensing, reporting, and certification for data-related services.

Under the Data Law, Vietnam’s government recognizes three data business models, including:

  • Data intermediation products and services: These involve establishing commercial relationships between data subjects, data owners, and data users. The goal is to facilitate the exchange, sharing, and access to data through agreements that ensure the rights of data subjects and owners are respected;
  • Data analysis and aggregation products and services: This model focuses on the process of analyzing and synthesizing data into useful, in-depth information tailored to the needs of the data service user. It involves activities that transform raw data into actionable insights; and
  • Data exchange platforms: These platforms serve as resources for data-related activities, supporting research, entrepreneurship, and innovation. They facilitate the provision of data products and services aimed at socio-economic development and create an environment for data exchange and transactions.

Local entity requirement for cross-border data transfer services

The proposed decree mandates that data intermediation, aggregation, and processing companies must be created and function within Vietnam. The third version of the draft decree clearly states the term “established”, specifying that foreign companies cannot provide these services across borders without setting up a local entity.

The recognition of data exchange platforms

For the first time, the recognition of data exchange platforms in Vietnamese laws marks a notable improvement in the accessibility of data for research and development (R&D) and high-tech initiatives. By creating clear legal frameworks, the chances of illegal data trading will be diminished, ensuring secure and ethical data exchanges.

FIND BUSINESS SUPPORT
Seamlessly Manage Your Operations across Multiple Countries in Asia

Experts anticipate that the change will enhance innovation and technological advancement by providing researchers and developers with easier access to essential data. The regulatory framework is designed to protect the interests of both data providers and users, thereby fostering a reliable environment for data transactions.

Stringent requirements for different data businesses

In general, all data services must adhere to these common requirements, including:

  • All providers must ensure leaders/staff are not convicted of national security crimes or under administrative penalties;
  • Only Vietnamese-established entities, or state-approved exceptions, qualify to provide these products and services; and
  • All require approvals and licenses from the Ministry of Public Security (MPS) or the National Data Center.

In comparison to data analysis and aggregation businesses, providers of data intermediation services and data exchange platforms face a more complex set of requirements concerning personnel qualifications, financial capacity, and standards for infrastructure, technical equipment, service provision management processes, as well as security and order assurance plans.

Criteria

Data intermediation (Article 26)

Data analysis and aggregation services (Article 30)

Data exchange platforms (Article 35)

Legal Entity
  • Must be a legal entity established and operating in Vietnam.
  • Must be a legal entity established and operating in Vietnam.
  • Must be a state-owned enterprise or public institution established under Vietnamese law.

Leadership Requirements
  • Leader/legal representative must be a Vietnamese citizen residing in Vietnam;
  • Minimum 3 years of experience in data management; and
  • No criminal record or administrative violations related to data.
  • No specific requirement.
  • Leader/legal representative must be a Vietnamese citizen residing in Vietnam;
  • Minimum 3 years of experience in data management; and
  • No criminal record or administrative violations.

Staff Qualifications
  • At least 5 employees with university degrees; and
  • 40% full-time, 30% certified in data science, analysis, or related fields.
  • Technical staff must have certifications in data science, analysis, or related fields; and
  • Number of staff must align with business scale.
  • At least 5 employees with university degrees; and
  • 40% full-time, 30% certified in data science, analysis, or related fields.

Technical Infrastructure
  • Infrastructure and equipment must be located in Vietnam; and
  • Must pass information security audits.
  • Must have equipment and technology suitable for the proposed business plan; and
  • No specific location requirement.
  • Infrastructure and equipment must be located in Vietnam; and
  • Must pass information security audits.

Operational Plan
  • Required to submit a detailed business plan including:
    • Technical solutions;
    • Data security measures; and
    • Risk management.
  • Required to submit a business plan covering:
    • Target audience;
    • Product/service types; and
    • Compliance with technical standards.
  • Required to submit a detailed business plan including:
    • Technical solutions;
    • Data security measures; and
    • Risk management.

Financial Requirements
  • Must deposit at least VND 5 billion (approx. US$200,000) in a Vietnamese bank to cover potential risks and compensations.
  • No specific financial deposit requirement.
  • Must deposit at least VND 5 billion (approx. US$200,000) in a Vietnamese bank to cover potential risks and compensations.

Additional Conditions
  • Must comply with data protection laws; and
  • Must ensure transparency in operations.
  • Must comply with data accuracy and security standards; and
  • Must ensure no harm to national security or public interests.
  • If operating data auctions, must have a valid auction service license; and
  • Must comply with data protection and security laws.

Licensing Authority
  • Ministry of Public Security (for services involving state agencies).
  • Ministry of Public Security (for high-risk services); or
  • National Data Center Director (for general services).
  • Ministry of Public Security.

Reporting Obligations
  • Regular reporting to authorities on service provision and compliance.
  • Annual or ad-hoc reporting on service provision and compliance.
  • Biannual and annual reporting on platform operations and compliance.

Promulgation of different data analysis and aggregation levels

Under the draft decree, providers conducting data analysis and aggregation in Vietnam will be governed by specific levels of their products and services, outlined as follows:

  • Level 1: Humans perform data analysis and synthesis directly;
  • Level 2: Humans carry out data analysis and synthesis, with partial assistance from artificial intelligence (AI);
  • Level 3: AI conducts data analysis and synthesis completely, with human oversight during implementation; and
  • Level 4: Data analysis and synthesis are fully managed by AI, without any human oversight.

Specified licensing criteria for data analysis and aggregation activities

Providers involved in data analysis and aggregation must secure a certification for the following activities:

  • Handle nationally significant data at level 3 or 4;
  • Access government or specialized databases; or
  • Use data categorized as core or important.

Preferential policies

Possible incentives for data innovation

The draft Decree on Data-related Activities states that entities engaged in data-focused science, technology, and innovation activities are entitled to incentives comparable to those provided to enterprises in high-tech, innovation, start-up ecosystems, and the digital technology sector. They are also prioritized for the highest specific support regimes within the industry and fields similar to those of the high-tech industry.

Additionally, these entities can receive a bonus of 5 percent on the value of approved innovative solutions after acceptance and practical implementation, applicable for a maximum of two years from the National Data Development Fund.

Enterprises engaged in science, technology, and innovation activities related to data are given priority for funding, support, loans, and loan guarantees from the following funds:

FIND BUSINESS SUPPORT
Scale Your Operations with AI Cloud Accounting, ERP, and Office Automation
  • The National Data Development Fund;
  • The National Technology Innovation Fund;
  • The Small and Medium Enterprise Development Fund; and
  • Other legal funding sources to perform activities according to the provisions of the law.

Conditions for preferential treatment

Providers of data intermediation products and services, not involving state agencies, may be eligible for incentives as prescribed under this draft decree. However, preferential treatment for data analysis and aggregation is limited to specific activities, including:

  • Virtual assistants, which are AI systems that generate and analyze content (videos, images, news, and articles) automatically while interacting directly with users, but carry the risk of providing incorrect information;
  • Products and services that analyze and synthesize sensitive personal data involving a minimum of 1 million individuals;
  • Level 3 and Level 4 products and services used in industrial and production systems that represent 20 percent or more of the sector’s operational capacity; and
  • Attaining a data scale of 10 TB or more to train data analysis and synthesis models.

Takeaway

The draft Decree on Data-related Activities presents both opportunities and challenges for businesses in the data sector. Companies must adapt to stringent local entity requirements and compliance measures while leveraging the favorable environment created by recognized data exchange platforms. By aligning with these regulations, businesses can enhance their credibility and foster innovation, ultimately positioning themselves for success in a rapidly evolving data landscape.

About Us

Vietnam Briefing is published by Asia Briefing, a subsidiary of Dezan Shira & Associates. We produce material for foreign investors throughout Asia, including ASEAN, China, and India. For editorial matters, contact us here and for a complimentary subscription to our products, please click here. For assistance with investments into Vietnam, please contact us at vietnam@dezshira.com or visit us at www.dezshira.com.

Dezan Shira & Associates assists foreign investors throughout Asia from offices across the world, including in Hanoi, Ho Chi Minh City, and Da Nang. We also maintain offices or have alliance partners assisting foreign investors in China, Hong Kong SAR, Dubai (UAE), Indonesia, Singapore, Philippines, Malaysia, Thailand, Bangladesh, Italy, Germany, the United States, and Australia.