DPO Radio
AesirX ComplianceOne | Decree 319 Vietnam Journey Monitoring
UPCOMING
Decree 319/2026/NĐ-CP Journey Monitoring Devices
Journey-monitoring, driver-image and compartment-image devices
Signed 13 August 2026, effective 1 July 2027. Know which of your vehicles need which device and by when, keep recorded data for as long as the decree requires, and treat driver and passenger footage as the personal data it is. Installation runs on four dates, the last in 2030.
Decree 319/2026/NĐ-CP: Scope and Current Status
If you run commercial road vehicles in Vietnam, or an own-account fleet, Decree 319/2026/NĐ-CP tells you which monitoring devices to fit and what to do with their data. It was signed on 13 August 2026 and takes effect on 1 July 2027.
The Ministry of Public Security is the lead ministry. The decree has 4 chapters and 14 articles. It details the Road Traffic Order and Safety Law (Law 36/2024/QH15, as amended by Law 118/2025/QH15).
Who is covered.
Commercial transport automobiles, tractor-trucks, ambulances, road-traffic rescue vehicles and internal transport vehicles. Army and police vehicles on national-defence and security duty are excluded.
What they must carry.
Three device types, each conforming to the National Technical Regulation issued by the Minister of Public Security:
- a journey-monitoring device;
- a driver-image recording device;
- a passenger-compartment-image recording device.
Two points are easy to miss:
- Own-account fleets are in scope. A manufacturer's or trader's internal transport vehicles are covered, not only licensed transport operators.
- Running your own telematics backend makes you a service-server provider. You then carry that role's full set of duties as well.
Explore the Logistics, Cross-Border Trade and Customs Data overlay
The Four-Date Phase-In
All in-scope vehicles enter the decree's baseline regime on 1 July 2027. Article 12(2)–(4) delays only the specified device-installation duties, not entire vehicle classes. Plan each vehicle's baseline duties and later device installations separately; Article 13 preserves the stated legacy-device transition.
| Date | What Begins | Vehicle Classes | Reference |
|---|---|---|---|
| 1 July 2027 | The decree takes effect. Installation, technical, recorded-data, transmission, retention and processing rules apply, and device data can be used as a basis for handling law violations | All in-scope vehicles; only the specific device-installation duties in Article 12(2)–(4) start later | Article 12(1) |
| 1 January 2028 | Driver-image recording devices must be installed | Commercial passenger vehicles under 8 seats (excluding the driver's seat), commercial freight vehicles (except tractor-trucks), internal transport vehicles | Article 12(2) |
| 1 January 2029 | Passenger-compartment-image recording devices must be installed | Commercial passenger vehicles over 29 seats (excluding the driver's seat) | Article 12(3) |
| 1 January 2030 | Passenger-compartment-image recording devices must be installed | Commercial passenger vehicles from 8 seats up to 29 seats (excluding the driver's seat) | Article 12(4) |
Devices already fitted
Journey-monitoring and driver-image devices installed before 1 July 2027 may keep running under the old rules until the end of 31 December 2029 (Article 13(1)). The old rules are QCVN 06:2024/BCA and Circular 71/2024/TT-BCA.
This covers existing hardware only. It is not a grace period. Any replacement or new installation must meet the new decree and its technical regulation straight away (Article 13(2)).
The old-device window closes on 31 December 2029, the day before the final 8-to-29-seat tier begins. The largest buses get compartment cameras first.
How Decree 319 Relates to Its Family
Decree 319 is a Government decree under the Road Traffic Order and Safety Law. It binds transport businesses, vehicle owners, service-server providers and drivers, including manufacturers' and traders' own fleets. That is why it sits with the logistics and transport overlay.
Its data rules matter as much as its transport rules:
- Personal data. Driver images, compartment images and journey traces identify employees and passengers. Article 6(4) puts every storage, transmission, use, sharing and processing step under the data law and the personal data protection law. It also bars using the data to infringe honour, dignity, private life, personal secrets or family secrets.
- AI. Where an artificial-intelligence system performs a device's automatic-detection and safety-warning functions, Article 5(3) makes those functions subject to the AI legislation.
Technical Provisions and Compliance Obligations
| Provision | What It Establishes | What It Means for You |
|---|---|---|
| Article 1, Article 2 | Scope: commercial transport automobiles, tractor-trucks, ambulances, road-traffic rescue vehicles and internal transport vehicles. Army and police vehicles on defence and security duty are excluded | Own-account fleets are in scope, so screening cannot stop at licensed operators |
| Article 4 | Installation of the three device types, conforming to the National Technical Regulation issued by the Minister of Public Security. One integrated unit is allowed if it fully meets every device type's functions | Test acceptance function by function for each device type, and require conformity evidence when you buy |
| Article 5(1) | What must be recorded: route, operating speed, number and duration of stops and parking, continuous driving time, and driver and compartment images recorded continuously in all lighting conditions | The device becomes the evidence for driver-hours compliance. Night and backlit capture is a hard requirement |
| Article 5(2), Article 3(3) | Automatic detection of, and safety warnings for, law-violating or dangerous behaviour, kept on until the behaviour ends. The list of behaviours is in the technical regulation | Watch for the technical regulation and use it as your acceptance baseline |
| Article 5(3) | Functions performed by an artificial-intelligence system must comply with the AI legislation | For each device model, record whether warnings are AI-performed and who holds that compliance file |
| Article 6(1) | Real-time transmission through service servers to the Traffic Police Department server. Journey data goes in full; image data only for violations and unsafe behaviour | Transmitted images are event-based. Streaming full cabin video off the vehicle goes beyond the decree and enlarges your personal-data exposure |
| Article 6(2) | Minimum retention periods (see the table below) | The device and service-server minimums are yours to meet. They are floors, not ceilings, and longer retention still needs a personal-data-protection basis |
| Article 6(3) | Deletion or destruction when the period ends. Data needed for an ongoing case stays on the Traffic Police Department server until the case closes | The case hold applies to the authority's server. If you keep your own data longer, you need a data-protection basis |
| Article 6(4) | All processing of device data falls under the data law and the personal data protection law. Using the data to infringe dignity, private life or personal and family secrets is barred | Legal basis, notice, processing records, security measures and impact assessment for employee monitoring all apply in full |
| Article 6(5) | Device data can be used as a basis for handling law violations from the decree's effective date | Your fleet data is enforcement evidence against you and your drivers. Review it internally first |
| Article 11 | Duties on data integrity (no falsification), continuity, immediate incident remediation, an administration account for the Traffic Police Department, and device access for traffic police on request | Set these up as standing controls with owners and evidence before the first request arrives |
| Articles 7–10 | Who oversees what: the Ministry of Public Security and the Traffic Police Department run the system. The Ministry of Construction, the Ministry of Finance and provincial People's Committees have inspection and funding roles | Expect two inspection fronts plus local authorities, all reading the same transmitted data |
| Data | On the device | On the service server | On the Traffic Police Department server |
|---|---|---|---|
| Journey data | At least 30 days | At least 1 year | At least 3 years |
| Driver images | At least 3 days | — | — |
| Compartment images | At least 10 days | — | — |
| Violation and unsafe-behaviour data | — | At least 3 months | At least 3 years |
Forms and Data Requirements
There are no official forms to file under this decree. It has no appendix, and the text ends at Article 14. It sets no dossier, filing or registration duty: the duties are installation, transmission, retention and access. Any record ComplianceOne supplies for it is an internal preparation record and is labelled as one.
The decree itself sets no fines. Device and device-data offences are addressed separately by the road-traffic penalty regime in Decree 168/2024/NĐ-CP, as amended by Decree 238/2026/NĐ-CP, among others. Missing or non-functioning required devices, falsified data, and failures to transmit or retain required data are separate offences. The applicable provisions depend on the actor: driver, transport business, device provider or related-service provider (including Articles 20, 21 and 26). Misuse of personal data also falls under the personal data protection laws and their penalty rules. Match the offence, role and applicable commencement date to the current penalty text; Decree 319's phase-in does not defer existing duties under other instruments.
How ComplianceOne Supports Decree 319 Compliance
Once Decree 319 is added to your workspace, it shows as final law with its effective date of 1 July 2027 and its phase-in dates. It is never shown as a draft, and never as in force early.
Each role sees its own duties. Transport businesses, vehicle owners, service-server providers and drivers each see the duties that bind them. If you hold two roles, such as a fleet operator with its own telematics backend, you see both sets side by side.
Surveillance data is recorded as personal-data processing. You record driver and passenger data categories, the legal basis and notice for employee monitoring, and your device supplier and service-server provider as vendors. Each retention period is held against the data type and location it applies to.
Readiness is tracked by date. Each vehicle class is mapped to its phase-in date. Each installed device is recorded with its installation date and the rules it runs under, and legacy devices are tracked toward the end of 2029.
ComplianceOne does not connect to any service server or to the Traffic Police Department server; the FAQ below explains what that means.
Built for Phased Surveillance-Data Obligations
Know what arrives when. Each vehicle class carries its own date, and the answer is recorded per vehicle rather than in a spreadsheet nobody audits.
Know which retention floor applies. Floors differ by data type and by location: device, service server or authority server. A retention review answers from the record.
Run surveillance through your privacy programme. Monitoring drivers and passengers is personal-data processing. Processing records, legal basis, notice and impact assessment sit in the same registers as the rest of your privacy work.
Keep both enforcement regimes in view. Decree 319 sets no fines or official forms. Device and device-data offences fall under the road-traffic penalty rules; personal-data misuse also engages personal data protection rules. Internal readiness records are not official filing forms.
Related Modules
Data Mapping
Holds the device, system and data-flow inventory that surveillance data types and retention periods are mapped to
Explore Data Mapping
Program Governance
Assigns the standing duties (integrity, continuity, access provision, retention) to accountable owners
Explore Program Governance
Governance
Tracks device suppliers and service-server providers, with conformity evidence and the provider's duties
Explore Governance
Audit Trail
Keeps retention decisions, access-provision records, incident-remediation history and processing evidence
Explore Audit TrailCompliance Readiness Checklist
If you are preparing for Decree 319, confirm that:
See Decree 319 Compliance in Action
See how ComplianceOne maps a fleet to the phase-in dates, records surveillance data as personal-data processing, and tracks the duties this decree sets.
Ronni K. Gothard Christiansen - Technical Privacy Engineer & CEO
Technical Compliance Expert, 32+ Years Open Source Advocate, X-BoD Open Source Matters Inc.
Frequently Asked Questions
No. It was signed on 13 August 2026 and takes effect on 1 July 2027 under Article 12(1). Only the device-installation duties specified in Article 12(2)–(4) start later; the vehicle classes themselves remain within the baseline regime. Until then it is final law not yet in force, so you can prepare against known dates.
The decree covers commercial transport automobiles, tractor-trucks, ambulances, road-traffic rescue vehicles and internal transport vehicles. The baseline duties start on 1 July 2027. Then:
- 1 January 2028: driver-image devices for commercial passenger vehicles under 8 seats, freight vehicles other than tractor-trucks, and internal transport vehicles.
- 1 January 2029: compartment cameras for commercial passenger vehicles over 29 seats.
- 1 January 2030: compartment cameras for vehicles of 8 to 29 seats.
Devices installed before the effective date may run under the old rules until the end of 31 December 2029.
No. Journey data is transmitted in full and in real time, but only violation and unsafe-behaviour images are sent on, under Article 6(1). Full continuous video stays on the device, with its own short retention floors. Streaming full cabin video off the vehicle goes beyond what the decree requires.
Yes. Driver images, compartment images and journey traces identify employees and passengers. Article 6(4) puts all their storage, transmission, use, sharing and processing under the data law and the personal data protection law. It also bars using the data to infringe honour, dignity, private life, personal secrets or family secrets. Fitting the required devices does not by itself make the surveillance lawful. The personal data protection duties apply in full.
Decree 319 itself sets no fine amounts. Device and device-data offences fall under Decree 168/2024/NĐ-CP, as amended, including by Decree 238/2026/NĐ-CP. The applicable provision depends on the driver's, transport business's or provider's role and the conduct and date involved. Personal-data misuse also engages the personal data protection penalty rules. See the Forms and Data Requirements section above for the distinction.
No. ComplianceOne does not connect to the Traffic Police Department server or to any service server, and it sends and receives no device data. Transmission is the job of the devices, the service servers and their operators. ComplianceOne tracks the duties, your readiness and the evidence: vehicle-class mapping, retention settings, provider oversight and personal-data processing records.
Next Steps
Start a Compliance Pilot
Test fleet phase-in mapping, surveillance-data processing records and provider oversight against the signed decree before it takes effect.
Discuss Your Compliance Needs
Review which of your vehicles the decree reaches, which phase-in dates apply to them, and what the surveillance data means for your personal data protection programme.
The evolution of Aesir is Aesir + 
(the Norse symbol for Necessity)"Needed in order to achieve a particular result"
♥Join the AesirX Privacy Newsletter. Stay Informed. Stay Compliant.
