DPO Radio
AesirX ComplianceOne | Vietnam Data Law Decree 165/2025/ND-CP
Data Law Decree 165/2025/NĐ-CP
The operational implementing layer beneath the Vietnam Data Law
Manage Decree 165 procedures, timelines, risk records, guidance, official forms, and supporting evidence in one controlled process.
Decree 165/2025/ND-CP: Scope and Current Status
Decree 165/2025/ND-CP is an active implementing decree under Law 60/2024/QH15. It was issued on 30 June 2025 and has been effective since 1 July 2025.
The decree provides the operational detail required to execute Data Law work. ComplianceOne represents it as a child instrument, not as a separate parent law, so evidence remains connected to the broader data-governance framework.
How Decree 165 Relates to the Vietnam Data Law
The Data Law establishes the parent governance framework. Decree 165 supplies the procedures, timelines, risk treatment, guidance, and official forms that support implementation.
The decree is also distinct from the Draft Decree on Data Exchange Operations. Decree 165 is active; the data-exchange instrument remains a draft. ComplianceOne keeps current execution separate from draft preparation.
Technical Provisions and Compliance Obligations
| Operational Area | Decree 165 Role | Evidence to Maintain |
|---|---|---|
| Data governance | Adds procedures and guidance beneath the parent law | Assigned work, decisions, approvals, and supporting records |
| Time-bound work | Defines operational timelines for relevant procedures | Due dates, completion proof, and escalation history |
| Risk handling | Identifies compliance and operational risk areas | Risk records, controls, findings, and remediation |
| Authority-ready documentation | Provides official Mẫu số forms | Completed forms, source evidence, review, and approval |
| Cross-framework context | Connects to personal data protection and cybersecurity where relevant | Linked evidence with preserved source and ownership |
Official Forms
Decree 165 provides eleven official forms: Mẫu số 01a, 01b, 02, 03, 04a, 04b, 05a, 05b, 06, 07a, and 07b. ComplianceOne retains the official identifiers and connects each form to its supporting evidence.
The operational supplement does not create a second set of forms. It adds procedures, deadlines, risk records, and guidance around the official forms already associated with the Data Law implementation stack.
How ComplianceOne Supports Decree 165 Compliance
Teams can select the relevant official form, assign contributors, collect supporting records, and route the package through review and approval. Form content and evidence remain linked throughout the process.
Procedure and timeline records provide accountable ownership for operational steps. Risk findings can be connected to controls and remediation instead of remaining as narrative warnings.
Audit history captures changes, contributions, reviews, and approvals. Evidence packages can be prepared for internal review or authority interaction without reconstructing the history from email and file shares.
Related Modules
Data Mapping
Data Classification
Program Governance
Maintains Records of Processing Activities aligned with Phu luc I data structure requirements.
Explore Program Governance
Compliance Forms
Audit TrailCompliance Readiness Checklist
Organizations implementing Decree 165 compliance should confirm:
See Decree 165 Compliance in Action
See how ComplianceOne connects official forms to procedures, risk records, evidence, and approval.
Ronni K. Gothard Christiansen - Technical Privacy Engineer & CEO
Technical Compliance Expert, 32+ Years Open Source Advocate, X-BoD Open Source Matters Inc.
Frequently Asked Questions
It is active and represented separately from draft, roadmap, or neighboring framework layers.
It adds a narrower operational layer beneath the parent while retaining its own code, status, evidence, and review context.
Authority-issued forms keep their official identifiers and source labels; Decree 169's ten verified forms (TK01 through TK08 and BC01 through BC02) are marked as official filings with source metadata. Platform-prepared inventory, provenance, and evidence templates are labelled as internal working documents and are never presented as prescribed forms.
Ten, all source-verified. TK01 through TK04 are the business or service eligibility-certificate applications – for data exchange business, data intermediary business, data analytics business, and data analytics service respectively. TK05 through TK08 are the matching applications to reissue or amend each of those certificates. BC01 and BC02 are the data-analytics-products-and-services report and the data-exchange-service report.
No. It structures evidence, ownership, workflow, and review; organizations remain responsible for legal interpretation.
Yes. Related records can be cross-linked while preserving their original framework ownership and audit history.
Next Steps
Start a Compliance Pilot
Test Decree 165 forms, evidence, procedures, and review gates with your team.
Discuss Your Compliance Needs
Review your Decree 165 evidence sources, owners, and authority-readiness process.
The evolution of Aesir is Aesir + 
(the Norse symbol for Necessity)"Needed in order to achieve a particular result"
♥Join the AesirX Privacy Newsletter. Stay Informed. Stay Compliant.
