Vietnam is introducing a new regulatory framework for data-related businesses with the release of a draft decree on data products and services (the “Draft Decree”). As part of the implementation of the recently enacted Data Law,[1] the Draft Decree sets out comprehensive requirements for businesses operating in data-intensive sectors. These proposed regulations mark a significant shift in how data-related services are governed and should be carefully reviewed to manage compliance obligations, mitigate operational risks, and identify new business opportunities.
Regulating Data-Related Businesses as Conditional Sectors
Following the enactment of Vietnam’s Data Law, the Investment Law has also been amended, regulating several data-related business activities as conditional sectors. Specifically, the data-related activities now classified as conditional businesses include (i) data intermediation, (ii) data aggregation and processing, (iii) data platform, and (iv) e-authentication.
Under the Data Law, data platform and e-authentication services are only permitted to be provided by public service units or state-owned enterprises. Meanwhile, data intermediation and data aggregation and processing have been opened for participation by private or non-state enterprises. According to the Draft Decree, providers of data intermediation products and services between users and state agencies, as well as those engaged in data aggregation and processing activities, must satisfy certain business conditions. These conditions cover aspects such as entity status, personnel qualifications, financial commitments, facility and business plan and licensing.
Entity Status
Providers of data intermediation or data aggregation and processing businesses must be established and operate in Vietnam. Notably, the third version of the Draft Decree explicitly includes the term “established”, clarifying that foreign entities cannot offer these services cross-border without establishing a local entity.
Personnel Qualifications
The Draft Decree imposes qualifications for personnel holding the legal representative or head of entities conducting data intermediation as follows:
- must be a Vietnamese citizen with permanent residence in Vietnam;
- hold at least a university degree;
- have a minimum of three (3) years’ experience in data management; and
- have no criminal prosecutions, convictions, or administrative sanctions in the data sector.
Additionally, data intermediation providers must employ at least five (5) personnel with university degrees, ensuring that at least 40% of these personnel have official employment contracts and at least 30% possess certified training in data science, analytics, consulting, or related fields. These stringent personnel criteria reflect governmental intent to build domestic expertise, though such conditions may present challenges due to Vietnam’s current shortage of qualified data professionals.
For data aggregation and processing providers, personnel requirements are comparatively less restrictive. Providers only need to demonstrate that their management teams have relevant expertise and key technical staff hold certifications in data-related disciplines. The absence of strict requirements for the legal representative or minimum personnel number aims to encourage market entry, thereby promoting innovation in areas such as artificial intelligence (AI), big data analytics, cloud computing, and other data-related technology products.
Financial Commitments
Entities engaged in data aggregation and processing activities are required to deposit a minimum of VND5 billion (approximately USD200,000) with a Vietnamese commercial bank. This financial deposit acts as a safeguard against potential liabilities arising from operational risks. Importantly, this deposit requirement replaces a previously suggested minimum charter capital threshold, highlighting a regulatory preference for security measures over initial capital injections.
Conversely, the deposit requirement has been eliminated for data aggregation and processing activities in the latest Draft Decree. This revision significantly lowers barriers for startups and smaller enterprises, fostering an environment conducive to innovation and competition in data-driven businesses.
Facility and Business Plan Conditions
Providers of data intermediation products and services must comply with comprehensive standards related to facilities, technical infrastructure, management procedures, and security measures. Facilities and equipment must be physically located in Vietnam and comply with legally mandated information security and safety standards. Providers must also prepare a detailed Operational Plan covering, among others, a description of the IT systems, a technology solution plan; a data storage strategy; data protection measures; data verification and assessment framework.
The facility and business plan conditions for data aggregation and processing providers are comparatively less stringent, requiring alignment of equipment, facilities, and technologies with their Business Plan. Under the Draft Decree, the Business Plan for data aggregation and processing services must detail (i) the scope of target users; (ii) types of products and services; (iii) compliance with relevant technical standards and regulations; and (iv) basic technical features of the products and services.
Licensing Requirements
Certain data businesses must obtain certifications or approvals from the Ministry of Public Security (MPS). Providers of data intermediation products and services between users and state agencies are required to register and obtain certification from the MPS. Providers engaged in data aggregation and processing activities must obtain the certification if: (i) they process nationally significant data in level 3 or 4 (automated decision-making, with or without human supervision), (ii) they utilize government or specialized databases, or (iii) they utilize data included in list of core or important data. To be granted certification, applicants must fully comply with the business conditions outlined above.
Opportunities for Incentives
The Data Law stipulates that providers of data intermediation and data aggregation and processing may be eligible for incentives similar to those offered to enterprises operating in high-tech, innovation, start-up ecosystems, and the digital technology sector. Key incentives may include corporate income tax reductions (e.g., a 10% CIT rate for the first 15 years) and financial support for research and development (R&D) activities (e.g., subsidies covering up to 30% of R&D expenses from the national investment fund). In addition, providers may also benefit from other supportive policies currently being developed for the high-tech and digital sectors.
Providers of data intermediation products and services not involving state agencies (i.e., user-to-user) may be entitled to incentives. However, in terms of data aggregation and processing, preferential treatment is limited to certain activities, including:
- Virtual assistants, generative AI systems, and automated content analysis tools (e.g., for video, images, news, and articles) that directly interact with users and may potentially influence them with misleading content;
- Products or services involving sensitive personal data from one million individuals or more;
- Automated data aggregation and processing systems (Level 3 or 4) used in industrial or manufacturing sectors that represent 20% or more of the sector’s operational capacity; and
- Data aggregation and processing models trained on datasets of 10 TB or more.
To qualify for these incentives, providers of data intermediation, and data aggregation and processing must undergo assessment by the MPS and obtain certification for providing data intermediation or data aggregation and processing.
Epilogue
The Draft Decree is expected to significantly impact Vietnam’s data products and services market by establishing a regulatory framework that will shape market entry, compliance, and operational strategies. While its licensing, entity, personnel, and financial requirements may raise the threshold for participation, they also reflect the government’s intent to promote responsible and sustainable growth.
At the same time, targeted incentives (such as tax reductions and R&D support) present meaningful opportunities for eligible providers, particularly those aligned with Vietnam’s priorities on innovation and digital transformation. In light of the evolving regulatory landscape, closely monitoring legal developments and adapting business strategies will be essential to navigating compliance challenges while capitalizing on opportunities in Vietnam’s emerging data economy.
For further information, please contact:
Ngo Dang Loc, Indochine Counsel
loc.ngo@indochinecounsel.com
____________________
[1] Further discussion on the Draft Implementation Decree is available in our Special Alert Vietnam’s Data Law: Key Insights from the Draft Implementation Decree.
