Vietnam Data Law | AesirX ComplianceOne

Decree 165 turns the Data Law into procedures, timelines and forms. In ComplianceOne you work through its procedures, deadlines, risk areas and guidance, and prepare its eleven official forms, with the Data Law kept as the parent.

• Explore Decree 165 Compliance

Decree 169 governs data products and data services. It covers inventories, provenance, quality, update controls, customer and recipient governance, and verified official forms.

• Explore Decree 169 Compliance

Decree 347 amends the first chapter of Decree 169. It was issued on 8 September 2026 and has been in force since 15 September 2026. You read the two together, and Decree 169 stays in force. The main changes:

• Providers of data analysis and aggregation products or services notify the National Data Centre before operating.
• The same providers report annually on form BC01 before 20 December.
• Intermediary licensing now covers analysis and aggregation.
• The separate business-in-analysis certificate and its forms are abolished.
• Data-exchange operators must meet a personnel condition.
• Certificates issued before commencement remain usable until they expire.
• Explore Decree 347

Decree 363 is the Data Law's own administrative-sanctions decree. It was issued on 19 September 2026 and takes effect on 11 November 2026. It sanctions failures in:

• collection and creation, classification, storage, governance and access;
• sharing, analysis and aggregation, publication and encryption;
• cross-border transfer of core and important data;
• data exchanges, intermediaries, the National Data Development Fund and controlled testing.

Stated amounts are individual levels, and an organisation is fined twice that, except in five provisions stated for organisations. The individual maximum is 100 million VND. Suspending an exchange, a database or a certificate can cost more than the fine.

Decree 363 excludes conduct covered by the cybersecurity and personal-data sanctions decree. It is a separate track from Decree 330, and the two are never added together.

• Explore Decree 363

Decree 386 sets breakthrough mechanisms for national data creation and exploitation, and for the Data Creation and Exploitation Centre under the National Data Centre. It was issued on 12 October 2026 and takes effect on 1 December 2026. Its duties fall on organisations that exploit data through the routes it creates:

• a request to a data-owning agency or the National Data Centre, kept within the subject, purpose, scope and authority granted;
• data protection, prompt notice of incidents and violations, full logs, and return, deletion or destruction at the end of purpose or term;
• the Centre's controlled testing mechanism, with a contract, the Data Law's conditions, a risk-management plan and audit at the authority's request.

It is not an exemption: personal data protection, cybersecurity, state-secret and Data Law obligations continue to apply. It has no official form and states no fine.

Seven registers are ready now, before the duties apply, to hold the evidence: the route of each activity, requests and grants, controlled testing at the Centre, incident notices, end-of-purpose disposal, incubator participation and foreign-cooperation risk assessments. ComplianceOne records them; it connects to neither the National Data Centre nor the Centre, and decides nothing.

• Explore Decree 386 Readiness

Decision 20 is the list you screen your data against to decide whether it is important or core, and when to escalate. It is an official reference list, not a set of forms.

• Explore Decision 20

Decree 314 governs how data platforms operate, including the National Data Platform. It has been in force since 25 September 2026 and covers:

• information-system security level 3;
• participant and data eligibility, and listing review;
• controlled testing and electronic contracting;
• transaction traceability, pricing and revenue sharing;
• risk management and dispute support.

It has one official form, Form ĐK01.

• Explore Decree 314

Decree 326 gives each identified location one stable 12-digit code. The code is assigned by the state's Location Identification Database under the Ministry of Public Security, across 71 annex object classes. The decree took effect on 1 September 2026, with no fines and no official forms.

Location owners have nothing to file. The duties fall on data exploiters and connected organisations. It is a Government decree based on the Data Law and the Personal Data Protection Law, and it belongs with the Data Law instruments because it builds national-database and data-use machinery.

• Explore Decree 326

The draft that became Decree 314. It no longer states current law. Evidence you built against it, and references that name it, still lead to the right record.