AesirX ComplianceOne | Decision 1830 VNeID ASEAN E-ID Pilot Plan

If your organisation uses VNeID today, your binding duties come from elsewhere:

• the Identity Law 26/2023/QH15;
• Decree 69/2024/NĐ-CP on electronic identification and authentication;
• Decree 320/2026/NĐ-CP, which amends Decree 69 from 28 September 2026.

Decision 1830 does not cite any of them and changes none of them. Its legal bases are the Law on Government Organisation, the Data Law, the Personal Data Protection Law and Decree 165/2025/NĐ-CP. So account linkage, connection security and access history are still read from Decree 69 and Decree 320. A State pilot plan is never read as a private-sector obligation.

See the Plan where it belongs. 

Decision 1830 appears on the Regulatory Frameworks page as a reference record, with its milestones as authority dates and its fifteen outputs as tracked items. It links to the Identity Law, Decree 69 and Decree 320 without borrowing their weight.

Model a flow before you depend on it, if you choose to. 

Cross-Border Identity Exchanges, under Trust & Identity Evidence, is an optional register. It is for an airline, travel, banking or onboarding business that expects to rely on cross-border identity. Decision 1830 does not require it, and the register says so in English and Vietnamese. Each record describes one flow:

• the identity provider and the relying party, each with its country;
• the direction of transfer and the purpose;
• each attribute exchanged, whether it is personal or sensitive personal data, its legal basis and why it is needed;
• the transfer impact assessment the flow rests on, chosen from your Assessments register;
• the formal authorisation relied on, with its document reference;
• how outcomes, reconciliation, transaction logs and retention are handled.

Hold production behind a gate. 

A new record starts as modelled and not authorised. Moving it to production is a separate action behind its own permission. ComplianceOne refuses it until four things are recorded, and names each one that is missing:

• a legal basis for every attribute;
• minimisation confirmed;
• a linked transfer impact assessment that has been approved;
• a formal authorisation, with its document reference.

A flow in production returns to testing, and loses its production approval, when an edit breaks the gate or changes anything that defines the flow. That includes the parties, countries, direction, purpose, attributes and authorisation.

Count outcomes from events, not typing. 

Where a flow links an identity profile, the success, failure and inconclusive counts come from that profile's authentication events. With no profile linked, the register reads No identity profile linked. With a profile but no events, it reads No authentication events recorded.

What ComplianceOne does not do. 

It connects to no identity system and holds only what you record. It is not interoperable with, recognised by or equivalent to VNeID, Singpass or LAeID. It gives you no route into the pilot.