DPO Radio
AesirX ComplianceOne | Decree 320/2026/NĐ-CP on eID
ACTIVE
Identity Law Decree 320/2026/NĐ-CP
Comply with a wider electronic identity and authentication regime
Effective 28 September 2026. ComplianceOne helps teams manage, review, and evidence relevant electronic identity, authentication, and account-linkage requirements.
Decree 320/2026/NĐ-CP: Scope and Current Status
Decree 320/2026/NĐ-CP was issued by the Government on 13 August 2026, effective 28 September 2026. It amends and supplements Decree 69/2024/NĐ-CP on electronic identification and authentication, proposed by the Minister of Public Security and issued on the basis of the Law on Identification as amended by Law 118/2025/QH15 and the Law on Data.
Decree 320 amends Decree 69. It does not replace it. Most of its twenty articles are replacement text for numbered articles that continue to live in Decree 69, so an obligation cited to one alone is untraceable; the two are read together. Decree 320 is also a separate thing from the 2026 draft law on electronic identification and authentication, which remains a draft.
What the amendment changes commercially: agencies and organisations may no longer demand a document already integrated into the National Identification Application; foreigners lawfully in Vietnam and organisations registered here may now hold electronic identification accounts; documents synchronise automatically from connected databases; access history is retained and shown back to the identity subject; and electronic transaction accounts across twelve named sectors must be linked and authenticated with an electronic identification account.
How Decree 320 Relates to the Vietnam Data Law
The Law on Identification remains the parent statute. Decree 69/2024/NĐ-CP is the operative decree on electronic identification and authentication, and Project 06 is the population-data programme the application and databases sit within. Decree 320 attaches to Decree 69 as its amending layer.
Reading the amendment alone gives an incomplete picture. Its Điều 3 is the new text of Decree 69's Điều 7; its Điều 10 is the new text of Điều 18; its Điều 19 adds two clauses to Điều 40. A practitioner needs to know both the amending article and the article it changes, because the surrounding provisions of Decree 69 continue to apply unaltered.
The amendment also reaches outside the identity stack. It amends Decree 77/2020/NĐ-CP, as already amended by Decree 67/2024/NĐ-CP, on automated border-control gates, and repeals that decree's Điều 11.
Technical Provisions and Compliance Obligations
| Provision | What It Requires | Operational Implication |
|---|---|---|
| Điều 2, amending Điều 4 khoản 4 | Agencies and organisations may not require an original or copy of a document already integrated into the National Identification Application; fees and charges for online public services through it are reduced or waived | Name the integrated document types in the intake procedure rather than deciding at the counter |
| Điều 3, amending Điều 7 | Foreigners lawfully entering or residing in Vietnam, and organisations established or registered in Vietnam, may hold accounts with no distinction by level | Foreign-invested entities and their staff become eligible; record which category each subject falls into |
| Điều 4, amending Điều 8 | Non-state-secret documents synchronise automatically from connected databases; updates immediately on change, within 24 hours where objectively delayed, within 5 minutes on citizen request in the application | Instrument the update path so the elapsed time is measurable |
| Điều 4, amending Điều 8 khoản 6 | Looking up another subject's integrated information requires that subject's consent, or a lawful representative's or heir's where they lack capacity, are under 14, are declared missing or have died | Record the consent basis with every third-party lookup |
| Điều 10, amending Điều 18 | Connection requires a cybersecurity plan meeting information-system security level 3 or above, a written request stating scope and purpose, and a security inspection; access history is retained and displayed to the subject; extracted information may not be shared onward | Hold the level 3 evidence before requesting connection; log documents, purpose, count, time and accessor |
| Điều 19, adding Điều 40 khoản 9 | Electronic transaction accounts on digital platforms in twelve named sectors must be linked and authenticated with an electronic identification account | Inventory accounts by sector and by creation date |
| Điều 19, adding Điều 40 khoản 10 | For other sectors, the relevant minister issues the specific list of online transactions in scope | Watch for ministerial lists; assert nothing about a sector before one is issued |
| Điều 15, adding Điều 34 khoản 13 | The Ministry of Public Security inspects, periodically or ad hoc, whether platform accounts have been linked and authenticated before use | Hold a per-account linkage record |
Sectors Named in the Linkage Obligation
Education; mass digital literacy; securities; telecommunications; banking; e-commerce, covering sellers, livestream sellers and affiliate marketers as the Law on E-Commerce defines them; e-invoices; transport business; tourism business; pharmacy business; medical examination and treatment; and social networks in Vietnam.
Accounts on platforms serving national defence, security or cross-border services link and authenticate before use, once the platform meets the conditions and is connected, a trigger, not a dated deadline, and it should not be planned as one.
| Obligation | Timeline | Reference |
|---|---|---|
| Decree takes effect | 28 September 2026 | Điều 20 khoản 3 |
| National digital platforms integrate electronic identification for authentication, login and transactions | 30 December 2026 | Điều 20 khoản 3 |
| Covered non-banking accounts created before the effective date are linked and authenticated | 30 December 2026 | Điều 20 khoản 3 |
| Banking-sector accounts created before the effective date are linked and authenticated | 29 June 2027 | Điều 20 khoản 3 |
| Update a changed document where immediate update is not possible | 24 hours | Điều 4 |
| Update on citizen request in the application | 5 minutes | Điều 4 |
| Process an integration request where the issuer has no database | 5 working days | Điều 4 |
| Issue a foreigner account where biometrics are already held | 2 working days | Điều 7 |
| Issue a foreigner account where they are not | 5 working days | Điều 7 |
| Issue an organisation account needing verification | 10 working days | Điều 7 |
| Connect a system after the security inspection completes | 5 working days | Điều 10 |
| Notify an incomplete authentication-service dossier | 2 working days | Điều 11 |
| Seek ministry opinions on a complete dossier | 2 working days | Điều 11 |
| Ministries examine, appraise and reply | 7 working days | Điều 11 |
| Appraise, inspect on site and issue the confirmation | 20 working days | Điều 11 |
Forms and Reference Lists
The decree prescribes no new form. The application, amendment, confirmation, revocation and reporting forms issued under Decree 69 continue to apply, and the eligibility confirmation the Ministry of Public Security issues is still on form XT03. What changed is the procedure that produces them.
Its appendix carries two official reference lists rather than forms: Danh mục 1, the 57 document types issued to individuals that are integrated on the National Identification Application, and Danh mục 2, the 140 document types issued to agencies and organisations. Each row names the managing ministry, the field, the document and the document type. Nothing on either list is filled in or submitted.
How ComplianceOne Supports Decree 320 Compliance
The amendment is carried as a child framework beneath Decree 69, with its effective date recorded. Each of its twenty requirements names both the amending article and the article of Decree 69 it changes, which is what makes an obligation traceable when the operative text lives in the older instrument.
The two dated deadlines are held separately, because they apply to different populations and missing that distinction is the likeliest planning error here: 30 December 2026 for national digital platforms and for covered non-banking accounts created before the effective date, and 29 June 2027 for banking-sector accounts created before it. The conditional defence, security and cross-border case is held as a trigger rather than being given a date it does not have.
The two appendix lists are held as official reference lists, counted reference data with a stated row count, rather than as 197 form records. A catalogue row is not something a customer fills in, and modelling it as a form would say otherwise.
The existing Decree 69 forms were annotated rather than duplicated: TK01, XT01, XT02 and XT03 each carry a note describing the revised procedure and timetable, so a filer sees the form from one instrument and the clock from the other in the same place.
Related Modules
Program Governance
Runs the linkage applicability assessment and tracks the two deadlines to their separate populations.
Explore Program Governance
Access and Accountability
Holds the per-account linkage records and the account lifecycle events.
Explore Access and Accountability
Data Mapping
Records which integrated document types the intake process may no longer demand.
Explore Data Mapping
Compliance Forms
Keeps the Decree 69 forms current with the revised procedure, and the appendix lists distinguishable from them.
Explore Compliance Forms
Audit Trail
Preserves the access history retained and shown back to the identity subject.
Explore Audit TrailCompliance Checklist
Organizations operating under Decree 320 should confirm:
See Decree 320 Compliance in Action
See how ComplianceOne helps structure evidence, ownership, and review for this framework.
Ronni K. Gothard Christiansen - Technical Privacy Engineer & CEO
Technical Compliance Expert, 32+ Years Open Source Advocate, X-BoD Open Source Matters Inc.
Frequently Asked Questions
No. It amends and supplements it. Decree 69 remains the operative decree, and most of Decree 320's articles are replacement text for articles that continue to live in it. Every obligation should be cited to both the amending article and the article it changes.
No. The 2026 Draft Law on Electronic Identification and Authentication is a separate instrument. Decree 320 is a government decree amending an existing decree, and the two should not be conflated in planning material.
Electronic transaction accounts on digital platforms in twelve named sectors. Accounts outside banking that were created before 28 September 2026 must be linked by 30 December 2026, the same date by which national digital platforms must integrate electronic identification for authentication and login. Banking-sector accounts created before 28 September 2026 have until 29 June 2027. Accounts created on or after 28 September 2026 are linked before use.
For other sectors, the relevant minister must issue the specific list of online transactions that must be linked. Sector obligations should be assessed against the applicable ministerial list.
No. They are official reference lists of document types integrated on the National Identification Application, 57 rows for individuals and 140 for agencies and organisations. Their operational use is to tell an intake process which documents may no longer be demanded on paper.
Generally no. Disbursement through the social welfare account is required of state agencies and political and socio-political organisations paying from the state budget. A private organisation is reached only where it operates payment, banking, wallet or welfare-disbursement systems.
Next Steps
Start a Compliance Pilot
Test scoped workflows, evidence, and review with your compliance team.
Discuss Your Compliance Needs
Review applicability, evidence sources, and operating-model requirements.
The evolution of Aesir is Aesir + 
(the Norse symbol for Necessity)"Needed in order to achieve a particular result"
♥Join the AesirX Privacy Newsletter. Stay Informed. Stay Compliant.
