DPO Radio
AesirX ComplianceOne | Vietnam Data Law Decree 347/2026/NĐ-CP
Active
Decree 347/2026/NĐ-CP on Data Products and Services
Vietnam's decree on data-services notification, reporting and licensing amendment
Determine the notification and certification requirements for each data offering, notify the National Data Centre where required, and maintain BC01 reporting and certificate records.
Decree 347/2026/NĐ-CP: Scope and Current Status
If you provide data analysis or aggregation, or run a data exchange, in Vietnam, Decree 347/2026/NĐ-CP changes what you must file and when. The Government issued it on 8 September 2026, and it took effect on 15 September 2026.
What changes for your business:
- Notify before you operate. Providers of data analysis and aggregation products or services notify the National Data Centre before operating. Providers already operating have 20 working days after 15 September 2026.
- Report every year. The same providers report on form BC01 to the Ministry of Public Security, through the Centre, before 20 December, or on request.
- One licensed category is wider. The licensed intermediary category now covers analysis and aggregation. The separate business certificate (GCN03) and its associated forms are abolished, while the certificate for provision of analysis and aggregation (GCN04) remains.
- Data exchanges need qualified staff. Operators must hold at least five university-qualified personnel, at least 40 % permanent and 30 % certified in a listed field.
- Existing certificates still count. A certificate issued before the decree took effect stays usable until it expires.
This is not deregulation of data analytics. The decree moves the line between licensed intermediary activities and a notification and reporting pathway, and it leaves one boundary open.
The decree has five chapters. Chapter I amends Decree 169/2025/NĐ-CP, a single decree under the Data Law on science, technology and innovation activity concerning data, and on data products and services. Chapters II to IV amend three fire-safety and administrative-sanction decrees unrelated to data. Chapter V holds the transitional and commencement rules.
Decree 347 amends Decree 169; it does not replace it. The amended articles still sit in Decree 169, so read the two together.
How Decree 347 Relates to the Vietnam Data Law
To know what applies, you need both the amending article and the Decree 169 article it changes. The Data Law is the parent statute. Decree 169 is the working decree on data products and services, and Decree 347 amends it. Both sit under the Data Law beside Decree 165, Decision 20 and Decree 314.
How the two decrees fit together:
| Decree 347 | What it does to Decree 169 |
| Article 1 | Becomes the new text of Article 31(5) |
| Article 3 | Replaces Article 36 |
| Article 9 | Repeals provisions and forms that Decree 169 would otherwise still carry |
Decree 314/2026/NĐ-CP, on operating data platforms, sits beside the data-exchange pathway. Decree 347 sets the personnel condition for the exchange operator; Decree 314 governs the venue.
Technical Provisions and Compliance Obligations
| Provision | What It Requires | What You Need |
|---|---|---|
| Article 1, amending Article 31(5) | Providers of data analysis and aggregation products or services notify the National Data Centre before operating. They report each year on form BC01 to the Ministry of Public Security through the Centre, before 20 December (period 15 December to 14 December), or on request. Filing can be direct, by post or online | A notification record with its receipt before your first day of operation, and a BC01 schedule starting from that day |
| Article 1, second paragraph | Providers already operating on 15 September 2026 notify within 20 working days after that date | The working-day count from 15 September, and the receipt |
| Article 2(2), amending Article 34(2)(b) | Data-exchange operators hold at least five university-qualified personnel. At least 40 % are permanent and 30 % certified in data science, data analysis, data governance, consulting, brokerage, trade promotion, asset management or data valuation | A personnel record with degree, employment and certificate evidence, with both percentages rechecked on every change |
| Article 3, replacing Article 36 | The Ministry of Public Security issues three certificates: data-exchange business; intermediary, analysis and aggregation business; and provision of analysis and aggregation | Each certificate you hold or seek, mapped to one of the three kinds |
| Article 4, amending Article 37 | Applications use TK01, TK02 or TK04, which remain Decree 169 forms. The authority decides within 5 working days of receiving all comments, and refuses in writing with reasons | The filing date and, where known, the date all comments were received. The period binds the authority, not you |
| Article 8 | Every reference to intermediary data products or services now reads "intermediary, analysis and aggregation". The same kind of wording change reaches nine Decree 169 forms, including TK01, TK02 and BC02 | Any existing scoping decision re-read under the wider category |
| Article 9 | Repeals Article 28(1), Article 29, the separate business-in-analysis certificate, and forms TK03, TK07, GCN03 and QĐ03 | The abolished forms retired for new filings, and a record of where a holder of the abolished certificate now sits |
| Article 40 | Dossiers received before commencement under simplified procedures continue under the previous rules (Article 40(1)). Dossiers under abolished procedures are stopped and returned on request (Article 40(2)). Certificates issued before commencement remain valid until expiry. | Each pre-decree certificate tracked to its own expiry, and the outcome of each pending dossier recorded |
Every data offering now sits in one of three places, and you record which:
| Pathway | Regime |
|---|---|
| Business in data-exchange services | Licensed, with the personnel condition |
| Business in intermediary, analysis and aggregation products or services | Licensed; the category the decree widens |
| Provision of analysis and aggregation products or services | Notification and BC01 reporting under Article 1, although Articles 36–37 still name a certificate of eligibility to provide |
Every data offering now sits in one of three places, and you record which:
The decree does not say where "business in" analysis and aggregation ends and "provision of" it begins. Nor does it say when a provider needs only to notify. Confirm your treatment against the Ministry of Public Security's implementing procedures and your own commercial model.
ComplianceOne records your pathway decision and your reasons. It never makes the decision for you.
| Obligation | Timeline | Reference |
|---|---|---|
| Decree takes effect | 15 September 2026 | Article 41(1) |
| Existing analysis or aggregation providers notify the National Data Centre | 20 working days after 15 September 2026 | Article 1 |
| New providers notify the National Data Centre | Before operating (an order of steps, not a period) | Article 1 |
| Annual BC01 report to the Ministry of Public Security through the Centre | Before 20 December each year, covering 15 December to 14 December | Article 1 |
| Ad-hoc report | On request; the decree sets no period | Article 1 |
| Authority decides a certificate application | 5 working days after receiving all comments (the authority's deadline) | Article 4(2) |
| Transitional cut-off for pending dossiers and pre-decree certificates | 15 September 2026; certificates run to their own expiry | Article 40 |
| Form | Official ID | Purpose | Status under Decree 347 |
|---|---|---|---|
| Annual report on provision of analysis and aggregation products or services | BC01 | The annual report to the Ministry of Public Security | Decree 169 form, cited by the rewritten Article 31(5). Template status pending verification against the official Decree 347 annex |
| Data-exchange service business application | TK01 | Certificate application | Decree 169 form, cited by the rewritten Article 37(1)(a). Wording changed by Article 8(4) |
| Intermediary, analysis and aggregation business application | TK02 | Certificate application | Decree 169 form, cited by the rewritten Article 37(1)(a). Wording changed by Article 8(1) |
| Provision of analysis and aggregation application | TK04 | Certificate application | Decree 169 form, cited by the rewritten Article 37(1)(a). Template status pending verification against the official Decree 347 annex |
| The three certificates | GCN01, GCN02, GCN04 | Issued by the authority | Decree 169 forms, cited by the rewritten Article 37(2)(d). GCN01 and GCN02 reworded by Article 8 |
| Reissue applications and the data-exchange report | TK05, TK06, BC02 | Certificate reissue or change, and the data-exchange service report | Decree 169 forms. Wording changed by Article 8 |
| Business-in-analysis application, reissue, certificate and revocation | TK03, TK07, GCN03, QĐ03 | — | Abolished by Article 9(7)–(10) |
Decree 347 abolished TK03, TK07, GCN03 and QĐ03 under Article 9(7)–(10). It changed wording in several Decree 169 forms under Article 8 and amended provisions referencing TK01, TK02, TK04, GCN01, GCN02, GCN04 and BC01. The official promulgated Decree 347 includes an annex that requires verification against the Công báo version. The applicable forms and templates must be checked against that annex before publishing form guidance or updating ComplianceOne.
How ComplianceOne Supports Decree 347 Compliance
Once Decree 347 is added to your workspace, ComplianceOne shows it as an amendment to Decree 169, in force from 15 September 2026. Each of its eleven requirements names both the amending article and the Decree 169 article it changes. Decree 169 stays active, with the amendment noted on it.
What you can record:
- Your pathway decision. The offering in the decree's own terms, the pathway chosen, who chose it, why, and any guidance or advice relied on. An offering with no decision shows as not determined, never as out of scope.
- Your National Data Centre notification. The rule that applied, the channel, the date sent, a copy of what was sent, and the receipt.
- Your BC01 reports. The reporting period, the template version, the filing and the receipt.
- Ad-hoc requests. The request and your response.
- Your certificates on the Sector Licences register, under the three consolidated kinds, with number, issue date, expiry and whether each predates the decree.
ComplianceOne keeps the evidence of each filing. It does not submit anything to the National Data Centre or the Ministry of Public Security.
The abolished forms are retired for new filings under Decree 169. The 5-working-day decision period is shown as the authority's, never as your deadline.
Related Modules
Data Mapping
Holds the pathway decision for each data offering, with reasons and the guidance relied on.
Explore Data Mapping
Program Governance
Tracks the 20-working-day notification window and the annual BC01 date against a named owner.
Explore Program Governance
Compliance Forms
Keeps the Decree 169 forms current with the amendment note, retires the abolished ones, and holds your notification, reporting and certificate records.
Explore Compliance Forms
Governance
Records a partner's or customer's data offering and its pathway at onboarding.
Explore Governance
Audit Trail
Keeps every pathway decision, notification, report and certificate change.
Explore Audit TrailCompliance Readiness Checklist
If you are preparing for Decree 347, confirm that:
See Decree 347 Compliance in Action
See how ComplianceOne records a pathway decision, keeps the evidence of the National Data Centre notification and the BC01 report, and tracks certificates under the three consolidated kinds.
Ronni K. Gothard Christiansen - Technical Privacy Engineer & CEO
Technical Compliance Expert, 32+ Years Open Source Advocate, X-BoD Open Source Matters Inc.
Frequently Asked Questions
No. Chapter I amends and supplements it. Decree 169 remains the working decree, and the amended articles still sit in it. Cite every obligation to both the amending article and the article it changes.
No. The decree moves providers of analysis and aggregation onto a notification and reporting pathway. At the same time it widens the licensed intermediary category to cover analysis and aggregation. The separate business certificate (GCN03) is abolished, but the certificate for provision of analysis and aggregation (GCN04) remains. Which pathway an offering sits in depends on what it does and how it is sold. The decree does not draw the line between business in and provision of analysis and aggregation. Notification alone should not be assumed sufficient without confirming the applicable certification requirements.
Any organisation providing data analysis and aggregation products or services must notify before operating. One already operating on 15 September 2026 notifies within 20 working days after that date. Notification can be sent directly, by post or online.
BC01 is the annual report on providing analysis and aggregation products or services. It goes to the Ministry of Public Security through the National Data Centre before 20 December each year. It covers 15 December of the previous year to 14 December of the reporting year.
Decree 347 rewrote the provisions that cite forms such as BC01, TK01, TK02 and TK04, and changed wording in several, including TK01 and TK02. It abolished TK03, TK07, GCN03 and QĐ03. The official promulgated decree includes an annex, which must be checked against the Công báo version to confirm the applicable templates before publishing form guidance. ComplianceOne keeps the verified forms, each with a note on what changed.
It stays usable until it expires. The transitional rule preserves it but does not extend it. A dossier received before that date under simplified procedures follows the previous rules under Article 40(1). A dossier under an abolished procedure, such as an application on TK03 or TK07, is stopped and returned on request under Article 40(2).
Next Steps
Start a Compliance Pilot
Test your offering inventory against the three pathways, your notification evidence and your certificate register.
Discuss Your Compliance Needs
Review which offerings require notification and which need certification under the widened intermediary category.
The evolution of Aesir is Aesir + 
(the Norse symbol for Necessity)"Needed in order to achieve a particular result"
♥Join the AesirX Privacy Newsletter. Stay Informed. Stay Compliant.
