ALIAT – September 2026

Skylink Studio partners with PvX to boost Vietnamese mobile games globally

The partnership aims to tap into the growing global market for simple, intuitive titles that retain users over the long term through accessible gameplay and lasting entertainment value. Capturing this trend, Skylink Studio, a Vietnam-based tech company, has focused its resources on researching and publishing a diverse portfolio aimed squarely at the international market.

Skylink Studio secures up to $12 million funding facility from PvX Partners for global outreach (PR)

Photo: Skylink Studio

The company’s flagship titles – Tile Pyramid, Tile Bloom, Tiles 2D, Tile Candy, Ocean Tiles and Snake Go – are all built around data optimisation, applied technology, and game-design capability to achieve growth at scale.

Alongside its core Tile Match line up, the company is also expanding into new genres such as Jigsawart and Way Escape to explore new long-term opportunities.

In today’s mobile gaming industry, creating a good product only decides part of the outcome. To reach millions of players at a global scale, studios must have distribution capability, run disciplined User Acquisition campaigns, and be able to continuously reinvest in products with proven potential.

Skylink Studio partners with PvX to boost Vietnamese mobile games globally

Typical titles in Skylink Studio’s classic game lineup, such as Tile Pyramid, Jigsawart, and Way Escape. Photo: Skylink Studio

To strengthen its international distribution capability, on August 22 Skylink Studio has entered into a growth-financing arrangement through PvX, a user acquisition financing platform for gaming and consumer apps.

Under the arrangement, PvX Partners has committed to provide Skylink Studio with access to a growth financing of up to $12 million. The company expects to use the facility to support User Acquisition, commercial scaling of its existing products, and continued development of its new game portfolio for global markets.

The collaboration with PvX is set to give Skylink Studio more flexibility to pursue market opportunities with a long-term, sustainable development strategy.

This large-scale financing deal is more than a commercial springboard – it affirms the data-driven operating capability of Vietnam’s engineering and tech talent. The model of combining domestic production capability with an international distribution system is becoming a strategic direction that gives local tech companies the confidence to compete fairly on the global stage.

Speaking about the company’s development direction, Nguyen Ngoc Tuan Loi, founder and CEO of Skylink Studio, said, “Our ambition isn’t just to create a few successful games. Skylink wants to build a global gaming company from Vietnam – one with the capacity to continuously create, develop and bring quality products to players around the world. This collaboration with PvX is an important step that helps us accelerate that journey.”

Skylink Studio leadership: Founder and CEO Nguyen Ngoc Tuan Loi (left) with creative director Dang Tuan Vinh. Photo: Skylink Studio

Looking to the long term, the company aims to build a data-optimised game development and publishing platform, positioning itself as a leading developer and publisher of classic mobile games and bringing more Vietnamese-made tech products to international users.

Vietnamese gaming businesses extend reach to international markets

More than 60 entrepreneurs and small and medium-sized businesses in the gaming industry joined a regional networking event to explore the opportunities to expand into international markets.

Digital leverage for Vietnamese gaming industry

The Gaming On TikTok Hanoi Summit 2025, held on April 24, showcased how the platform is supporting Vietnam’s gaming community and driving growth in the local and global markets.

Gaming industry eyes billion-dollar revenue

Vietnam’s gaming industry is rapidly solidifying its position as a key player in the global development landscape.

Vietnam’s gaming industry levels up for global expansion

Vietnam’s gaming industry is entering a new growth phase as local developers expand beyond the domestic market, supported by rising digital capabilities, stronger investment, and growing international demand for online entertainment.

E-commerce growth raises pressure on legal compliance

News

Organised by the Centre for Legal Support for Small and Medium-sized Enterprises under the Department of Civil and Economic Law of the Ministry of Justice in coordination with Vietlink Law Firm, the conference brought together experts to discuss practical legal issues arising from the growing use of e-commerce and digital platforms.

Hoang Ninh, deputy director of the Vietnam E-commerce and Digital Economy Agency under the Ministry of Industry and Trade, said the rapid growth of e-commerce platforms, social media and livestreaming was allowing businesses and household businesses to reach wider markets and scale up sales, but is also placing greater demands on internal controls.

“Sellers must provide information for identity verification, while intermediary e-commerce platforms are responsible for electronic verification before allowing sellers to conduct business. On platforms that provide online ordering functions, sellers must use their own payment accounts,” Ninh said.

Businesses consequently need clear internal arrangements covering product listings, pricing, promotions, account management and cash flows. Moving sales online does not remove requirements applicable to the goods themselves, with products requiring business licences or subject to specific conditions remaining subject to those rules when sold through e-commerce platforms.

E-commerce growth raises pressure on legal compliance

An overview of the workshop. Photo: Vietlink Law Firm

Product information has also emerged as a significant compliance issue. Online consumers often rely on images, videos, descriptions, advertising and sellers’ claims when making purchasing decisions, making accurate information on product functions, origin, quality, prices, promotions and warranties particularly important.

“Sales content can no longer be treated solely as a marketing function. It needs to form part of a company’s broader compliance and control process,” Ninh said.

The concern is particularly relevant to livestreaming and the growing use of KOLs and KOCs as sales channels. Businesses need to control information provided to promoters, establish clear guidance on permitted content and ensure prices and promotional programmes can be updated promptly, Ninh added.

The compliance burden comes as e-commerce platforms, social media and multi-channel business models enable SMEs and household businesses to reach customers far beyond their traditional markets. Small manufacturers and retailers can promote products, receive orders, process payments and arrange delivery through digital platforms without major investment in conventional distribution networks.

Yet an online transaction can involve obligations across multiple areas, including electronic contracts, taxation, invoicing, advertising, intellectual property, consumer protection, personal data and sector-specific requirements.

Dr Le Thi Hoang Thanh, deputy director of the Department of Civil and Economic Law under the Ministry of Justice, said many businesses and household businesses still face difficulties in accessing, updating and applying regulations governing e-commerce.

“A lack of information and limited capacity to identify legal risks can lead to violations and disputes, increase compliance costs and affect business reputation and performance,” she said.

“Against the backdrop of continued development of the legal framework for the digital economy, the requirement is not simply to ‘know the law’ or comply when inspections take place, but to actively identify and control risks from the outset of organising business activities in the digital environment.”

She therefore believes that greater legal awareness and stronger risk management capabilities would help businesses reduce disputes, protect their legitimate interests, strengthen competitiveness, and build consumer confidence.

Dr Tran Minh Son, director of the Centre for Legal Support for Small and Medium-sized Enterprises under the Department of Civil and Economic Law of the Ministry of Justice, identified the fragmented legal framework as a particular challenge for SMEs and household businesses.

An online business may have to comply with rules covering business conditions, product origin, advertising, promotions, electronic contracts, taxation, invoices, consumer protection, personal data and intellectual property. For smaller businesses without dedicated legal resources, keeping track of these obligations can be difficult.

Son also warned against waiting until a dispute or inspection occurs before seeking legal advice.

“On the digital environment, an advertising error can quickly reach a large customer base, while a problematic product can be sold simultaneously across several platforms,” he said.

Tax and transaction records require closer management as businesses generate revenue through multiple platforms, payment methods and sales channels. Consistent reconciliation of transaction data can help minimise discrepancies and tax compliance risks.

Consumer protection and intellectual property present further challenges. Information displayed on online shops, including product images, technical specifications, prices, return policies and sellers’ commitments, can affect the rights and obligations of both parties. Digital content and trademarks can also be copied easily, creating risks of infringement and making protection of businesses’ own intellectual property increasingly important.

“The challenge, therefore, is not simply to add more regulations, but to make the existing legal framework more accessible and practical for businesses,” Son said.

He suggested tailoring legal support more closely to the practical needs of SMEs and household businesses. Guidance on setting up online shops, electronic contracts, tax obligations, intellectual property, data protection and complaint handling could be built around situations businesses are likely to encounter.

Electronic handbooks, online Q&A platforms, legal information portals, instructional videos, model contracts and policies could also make legal guidance more accessible and help businesses manage compliance costs.

Multi-channel shopping is vital for e-commerce growth

Multi-channel shopping is on the rise, becoming a vital factor which will help retail businesses expand sales channels, thereby increasing their reach to customers and enhancing the competitive edge given the online shopping boom in Viet Nam.

Vietnam in global top 10 for e-commerce growth

E-commerce in Vietnam has recorded outstanding growth of 16-30 per cent per year over the last ten years, with the market size expected to reach $20.5 billion in 2023.

Barriers remain as firms pursue e-commerce growth with EU

Opportunities for Vietnamese businesses in the EU cross-border e-commerce market are growing, but barriers related to regulations and legal challenges need addressing.

Enablence Technologies and ShunYun Technology complete volume production readiness at Vietnam fab

News

Photo courtesy of Enablence

Enablence is a leading supplier of planar lightwave circuit (PLC) optical chips for datacom, telecommunications, AI, and advanced vision applications while SYT is a semiconductor assembly (OSAT) leader.

“The launch of Enablence’s new production fab in Vietnam provides, an end-to-end optical supply chain alternative, which could mitigate supply chain risk for North American cloud hyperscalers, optical module manufacturers, and telecom customers by reducing their reliance on Chinese-origin supply,” said Todd Haugen, CEO of Enablence Technologies.

Following the strategic OSAT partnership between Enablence and SYT announced in March 2026, all major production-line equipment is now production qualified at SYT’s site in Vietnam. The initial production lines, which include Enablence’s core passive optical component portfolio, have successfully produced qualified samples, which have been released to key North American customers for evaluation.

With the production facility now complete, Enablence’s supply chain integrates chip design in Ottawa, Canada; wafer fabrication, specialised assembly, packaging and test at Enablence’s Silicon Valley Fab in Fremont, California; and advanced, high-volume packaging and assembly at SYT’s facility in Vietnam. This model was purpose-built to mitigate risk for North American cloud hyperscalers and Tier-1 optical module makers who currently source much of their optical chips in China.

SYT has completed installation of all production-line equipment and successfully produced qualified samples at its advanced manufacturing facility in Vietnam. Initial samples have already been released to key customers for evaluation, marking the transition from installation to qualified, production capability.

Optical chip manufacturing takes place in Fremont, CA, while assembly and packaging are now executed via dedicated, qualified production capacity at SYT’s facility in Vietnam, giving the completed platform full supply chain origin compliance outside of China. Having invested in new tooling and infrastructure upgrades at its Silicon Valley Fab, Enablence is now capable of fulfilling production orders for North American and global partners.

The completed platform directly supports high-speed PLC products, including Enablence’s FR4 wavelength management solutions, and custom optical engines which are required for Co-Packaged Optics and Linear Pluggable Optics deployed in AI clusters.

“The completion of our Vietnam production facility with SYT marks the final leg in building a fully compliant, resilient supply chain for the optical components that power AI infrastructure, automotive LiDAR, warehouse robotics and medical imaging,” said Haugen.

“With chip design in Ottawa, wafer fabrication at our Silicon Valley Fab, and now qualified, high-volume packaging and assembly with SYT in Vietnam, Enablence can now provide hyperscalers, module manufacturers, and telecom operators an immediate, qualified, and fully compliant alternative to Chinese-origin supply, including supporting the deployment of 800G and 1.6T optical infrastructure,” he said.

Vietnam and WEF to strengthen cooperation in AI and semiconductor technology

Vietnam and the World Economic Forum (WEF) have agreed to strengthen cooperation in AI and semiconductor technology, following a meeting in Hanoi.

Regional cooperation crucial as Southeast Asia’s AI boom accelerates

Southeast Asia’s AI boom is attracting data centres, cloud infrastructure, and semiconductor investment, but these gains do not automatically translate into a collective regional win for ASEAN.

Japanese firm inaugurates polysilicon facility in Ho Chi Minh City

Tokuyama Vietnam on August 13 held an inauguration ceremony for its polysilicon manufacturing plant at Phu My 3 Specialised Industrial Park (Phu My 3 SIP) in Ho Chi Minh City.

Official Letter No. 6661/QNG-QLDN1: Determining personal income tax withholding obligations for income paid after the termination of employment contracts

Legal Updates, Resources

On 6 August 2026, the Tax Department of Quang Ngai Province (the “Tax Authority“) issued Official Letter No. 6661/QNG-QLDN1 (the “Official Letter“) guiding personal income tax (PIT) withholding on income paid after the termination of employment contracts.

In this Official Letter, based on the legal grounds governing personal income tax withholding under the Law on Personal Income Tax 2025 and Decree No. 253/2026/ND-CP, the Tax Authority provides guidance that where an enterprise or organization makes payments of salaries, wages, remuneration, or other amounts to individuals whose employment contracts have been terminated, and the income paid is VND 5 million or more per payment, the enterprise or organization is required to withhold and remit PIT at the rate of 10% of the income before making the payment to such individuals.

Furthermore, if the former employee earns income solely subject to the withholding rate mentioned above but estimates that their total taxable income after family circumstance deductions falls below the taxable threshold, the employee may submit a commitment letter to the income-paying organization. This commitment serves as a basis for the organization to temporarily refrain from withholding PIT. The employee assumes full responsibility for their commitment letter; any fraud detected by the managing tax authority will be handled in accordance with the law.

Based on the guidance in this Official Letter, ALIAT recommends that enterprises carry out the following necessary actions:

Review and identify post-termination payments to check whether the enterprise incurs any instances where income must be paid to employees after contract termination.

If applicable, the enterprise must declare and withhold 10% PIT on the income before disbursing it to the employee.

In cases where former employees estimate their total taxable income after family circumstance deductions will not reach the taxable threshold, the enterprise must request a written commitment letter containing all legally required content; and this document must be retained at the company headquarters for future tax declaration and finalization audits.

Official Letter No. 2265/CST-GTGT: Enhanced scrutiny for the application of the 0% VAT rate to exported services

Legal Updates, Resources

On 4 August 2026, the Department of Tax, Fee and Charge Policy Management and Supervision issued Official Letter No. 2265/CST-GTGT (“Official Letter 2265”), providing guidance on supporting documents required to substantiate eligibility for the 0% VAT rate applicable to services supplied to foreign organizations and individuals and consumed outside Vietnam.

The documentation requirements differ depending on when the relevant transactions arise, as follows:

For exported services arising before 1 July 2025

For transactions arising before 1 July 2025, businesses are required to provide:

a service provision agreement;
bank payment documents; and
documents evidencing that the services were performed outside Vietnam.

For exported services arising from 1 July 2025

For transactions arising from 1 July 2025, businesses are required to provide:

a service provision agreement with the relevant foreign organization or individual;
non-cash payment documents; and
other supporting documents as may be required by the competent State authorities.

Accordingly, in certain cases, the tax authorities may require businesses to provide additional documents and information to verify their eligibility for the 0% VAT rate.

Particular attention should be paid where a business supplies digital information content products to a foreign customer, such as text, data, images or audio in digital form that are stored or transmitted over a network environment. For these products, businesses must retain and provide documents and information evidencing that the products are consumed outside Vietnam, including:

information regarding the foreign customer’s residence or location, such as billing address, delivery address, registered office address, residential address or other similar information; and
information evidencing access from outside Vietnam, such as the country calling code associated with the SIM card, IP address, location of a fixed telephone line or other similar information.

Official Letter 2265 therefore indicates increased scrutiny by the tax authorities over the eligibility for the 0% VAT rate applicable to exported services, with greater emphasis on specific and substantive evidence demonstrating that the relevant services are actually consumed outside Vietnam, rather than relying solely on contractual and payment documentation.

In this context, businesses providing services to foreign customers should review the supporting documentation for transactions currently subject to the 0% VAT rate and maintain sufficient records evidencing the provision and consumption of such services outside Vietnam. For digital information content products, businesses should also establish mechanisms to collect and retain information regarding the foreign customer’s residence or location and access from outside Vietnam, so that such information can be readily provided to the tax authorities upon request.

Decree No. 330/2026/ND-CP: Administrative Sanctions for Personal Data Protection Violations Officially Established – Enterprises Need to Take Immediate Action

Legal Updates, Resources

On 19 August 2026, the Government issued Decree No. 330/2026/ND-CP providing for administrative penalties for violations in the fields of cybersecurity and personal data protection (“Decree 330”), which takes effect from 19 August 2026.

Decree 330 was issued to establish a specific penalty mechanism for violations in the field of personal data protection, thereby strengthening the enforcement and deterrent effect of the regulations on personal data protection. This is an important step in further developing the legal framework in the context where regulations on personal data protection have been progressively developed and applied since 2023, but prior to the issuance of Decree 330, there had been no comprehensive and specific administrative penalty mechanism for each group of violations in this field. Some notable points of Decree 330 include:

Violations of regulations on consent of personal data subjects

To strengthen compliance with the requirement to obtain consent from data subjects before processing their personal data, Decree 330 provides for fines applicable to violations of the consent requirements under two principal penalty brackets:

A fine ranging from VND 30 million to VND 50 million applies to acts such as processing data without consent; setting consent as the default option or providing misleading instructions; making service provision conditional upon consent; failing to separately distinguish each processing purpose; obtaining consent without maintaining logs; or failing to provide notification when processing sensitive personal data.

A higher fine ranging from VND 50 million to VND 70 million applies to intentional acts of continuing to process personal data after the data subject has withdrawn their consent or upon a request from a competent State authority, as well as the act of treating a user’s silence as consent without authorization.

In addition to monetary fines, violating organizations and enterprises may also be subject to additional penalties and stringent remedial measures. The competent authorities may confiscate all material evidence and administrative violation instruments used to commit the violation. At the same time, the violating party may be required to destroy or permanently delete all personal data that has been unlawfully collected and processed in a manner that renders such data irretrievable, and to remit all unlawful proceeds or profits to the State budget.

Accordingly, enterprises should pay attention to default options on forms, clearly separate each processing purpose for which consent is sought, and implement management systems capable of evidencing consent in the event of inspection or examination. Upon receiving a request from a user to withdraw consent, enterprises should have procedures in place to automatically update their systems and immediately cease processing the relevant personal data in order to avoid the risk of penalties and being required to destroy the entire accumulated database.

Violations of regulations on personal data processing impact assessments

To strengthen oversight and ensure compliance during data processing activities, Decree 330 introduces specific sanctions for violations of regulations on personal data processing impact assessments.

Specifically, violations of the obligations to prepare, maintain, submit and update the relevant dossiers are subject to fines ranging from VND 20 million to VND 30 million. This penalty bracket applies to cases where an enterprise commences personal data processing activities but fails to prepare or maintain a Personal Data Processing Impact Assessment Dossier at its headquarters; fails to submit one original copy of the dossier to the Department of Cyber Security and High-Tech Crime Prevention under the Ministry of Public Security within 60 days from the date on which personal data processing is first conducted; intentionally fails to complete the dossier as requested by the competent specialized authority; fails to update the dossier every six months when there are changes; or fails to update the dossier within 10 days in cases where an update is required by law.

In particular, a fine ranging from VND 50 million to VND 100 million applies to intentional acts involving falsification or non-cooperation, including: deliberately falsifying data or providing inaccurate information in the Personal Data Processing Impact Assessment Dossier, or refusing to amend or complete the dossier upon receipt of a written request for remediation from the Department of Cyber Security and High-Tech Crime Prevention.

In addition to monetary fines, violating enterprises may also be subject to stringent remedial measures. Accordingly, the violating organization may be required to prepare, complete and submit the dossier in accordance with the applicable regulations and provide evidence of compliance to the competent authority. Notably, where an enterprise fails to prepare or maintain the dossier at its headquarters, it may be required to suspend all personal data processing activities until it has fully discharged its dossier submission obligations and obtained official confirmation from the specialized personal data protection authority.

Accordingly, enterprises should proactively review all internal personal data processing procedures, prepare and maintain the relevant impact assessment dossier at their headquarters, and ensure that the original dossier is submitted to the Department of Cyber Security and High-Tech Crime Prevention within 60 days from the commencement of personal data processing. In addition, establishing a six-monthly review mechanism and a procedure for updating the dossier within 10 days following a change are mandatory steps to mitigate the risk of administrative penalties and, in particular, the risk of being required to suspend all personal data processing activities.

Violations of regulations on cross-border transfer of personal data

To strengthen control over the transfer of personal data outside the territory of Vietnam, Decree 330 introduces stringent sanctions for violations of regulations on cross-border transfers of personal data.

Specifically, a fine ranging from VND 30 million to VND 50 million applies to acts including: failure to prepare or submit the cross-border data transfer impact assessment dossier within 60 days from the date of the first transfer, failure to complete or update the dossier as required, failure to maintain the dossier readily available for inspection, failure to notify the contact details of the representative of the data recipient, or failure to establish control mechanisms resulting in the data being processed beyond the declared scope.

In particular, a fine ranging from VND 50 million to VND 100 million applies to cases involving failure to enter into a contract or data transfer document establishing binding responsibilities; failure to obtain consent from the data subject or notify the data subject of the transfer of their data overseas; failure to apply appropriate security measures; obstruction of an inspection; continuing to transfer data after being ordered to cease by a competent authority; or failure to report and cooperate in preventing or mitigating damage when a data breach or data loss occurs at the recipient’s end.

Notably, Decree 330 establishes a fine calculated as a percentage of the total revenue generated in the Vietnamese market during the immediately preceding financial year for serious violations, such as failure to prepare the relevant dossier, concealment of data flows, or inaccurate declaration of data flows resulting in the disclosure or loss of Vietnamese citizens’ personal data. The applicable fine ranges from 1% to 2% of revenue for incidents affecting between 10,000 and fewer than 100,000 data subjects; from 2% to 3% of revenue for incidents affecting between 100,000 and fewer than 1,000,000 data subjects; and up to 3% to 5% of revenue where 1,000,000 or more data subjects are affected or national defense or security is threatened. Where the violating organization has no revenue in Vietnam or the fine calculated based on the percentage of revenue is lower than VND 3 billion, fixed fines will apply depending on the scale of the violation, ranging from VND 200 million to VND 500 million, from VND 500 million to VND 1 billion, and from VND 1 billion to VND 3 billion, respectively.

Accordingly, enterprises should review all cross-border personal data transfer activities, prepare and submit the Cross-Border Personal Data Transfer Impact Assessment Dossier using the prescribed form, and ensure timely submission. In addition, reviewing and entering into data transfer agreements containing provisions imposing confidentiality and other responsibilities on the recipient, updating transparent consent mechanisms for data subjects, and establishing procedures for responding to data disclosure or loss incidents occurring at the recipient’s end are mandatory steps to mitigate the risk of fines of up to 5% of revenue or suspension of cross-border data transfer activities.

Violations of regulations on the appointment of personal data protection officer, units

To ensure effective implementation of internal data governance, Decree 330 establishes a legal framework for imposing penalties on violations relating to the appointment of personnel and establishment of personal data protection units.

Specifically, a warning or fine ranging from VND 10 million to VND 20 million applies to acts of failing to enter into confidentiality responsibility agreements with personnel responsible for personal data protection; failing to organize training or professional development; or failing to specify the functions, duties and powers in the appointment document or decision establishing the relevant unit.

In particular, a fine ranging from VND 20 million to VND 30 million applies to more serious violations, including failure to issue a formal document appointing responsible personnel or a decision establishing the relevant unit; appointing personnel who have not received specialized training; or appointing a person who does not satisfy the applicable requirements (i.e., holding at least a college-level qualification or having at least two years of experience in legal affairs, IT, cybersecurity, data security, risk management, compliance control or human resources management).

In addition, violating enterprises may be subject to remedial measures requiring them to issue the necessary appointment documents and regulations specifying the relevant duties, or to replace the responsible personnel with another person who satisfies the applicable legal requirements and submit evidence of such compliance to the competent authority.

A common violation is for enterprises to formally appoint personnel or establish a personal data protection unit without clearly defining its responsibilities, entering into confidentiality agreements, or providing appropriate training. In the event of an inspection, such formalistic appointments may result in penalties and require the enterprise to dismiss the appointed personnel and identify suitable replacements.

Accordingly, enterprises should proactively review all documents relating to the appointment of personnel and establishment of personal data protection units. Issuing a formal decision specifying the functions and duties of the relevant personnel/unit, entering into a separate confidentiality agreement, reviewing the personnel’s qualifications and experience, and proactively organizing professional training and development programs for responsible personnel are mandatory legal steps to prevent the risk of administrative penalties and disruption to internal operations.

Violations of regulations on personal data protection in recruitment and labor management

Under the 2025 Law on Personal Data Protection, enterprises may only require job applicants to provide information that is directly relevant to the recruitment purpose and are required to delete and destroy the personal data of applicants who are not recruited, unless otherwise agreed.

Consistent with this requirement, Decree 330 introduces a detailed penalty framework for violations involving personal data in recruitment and labor management. Specifically, a fine ranging from VND 20 million to VND 50 million may apply to acts of requiring job applicants to provide data that is not relevant to the recruitment purpose, using application data for another purpose without an agreement, processing data beyond the scope of consent, or failing to delete or destroy the data of unsuccessful applicants.

For employees during the employment relationship, the fine increases to between VND 50 million and VND 70 million where an enterprise retains employees’ personal data beyond the statutory or agreed retention period, fails to delete the data upon termination of the employment contract, or unilaterally applies technological measures to monitor or collect data in the workplace, such as installing cameras or device-monitoring software, without providing clear notice to employees. In particular, the act of processing or using data unlawfully collected through technological or technical measures is subject to a fine ranging from VND 70 million to VND 100 million.

In addition to monetary fines, enterprises may be required to permanently destroy or delete all personal data unlawfully collected and remit any unlawful proceeds arising from the violation. Accordingly, automatically retaining applicant records indefinitely or conducting employee monitoring in a non-transparent manner may expose enterprises to significant legal risks.

Accordingly, enterprises should proactively review their internal recruitment and human resources management procedures to ensure legal compliance. During recruitment, the recruitment function should collect only information that is genuinely necessary for the relevant position and establish an agreement allowing the retention of application records for unsuccessful applicants, rather than automatically retaining such records by default. For existing employees, enterprises should issue clear notices or internal regulations governing the use of workplace monitoring technologies, such as cameras and device-monitoring software, and specify the applicable data retention periods and procedures for deleting and destroying personal data upon termination of employment.

Violations involving the unlawful purchase, sale or transfer of personal data

Decree 330 establishes a penalty mechanism based on the amount of unlawful proceeds obtained by organizations engaging in the unlawful purchase or sale of personal data.

Accordingly, a violating organization may be subject to a fine ranging from two to ten times the amount of proceeds obtained from the unlawful purchase or sale of personal data. This means that, if an enterprise unlawfully earns VND 1 billion from secretly selling a customer information list, the fine imposed on that enterprise could be as high as VND 10 billion.

Where the amount of unlawful proceeds cannot be determined, fixed fines ranging from VND 500 million to VND 1 billion apply to unlawful transactions involving basic personal data of 10,000 or more individuals or sensitive personal data of 2,000 or more individuals. A fine ranging from VND 1 billion to VND 3 billion applies to unlawful purchase or sale of personal data that seriously infringes upon core areas such as national defense, national security, social order and safety, foreign affairs or the macroeconomy, or directly threatens the life, health, honor, dignity, property, or lawful rights and interests of other organizations or individuals.

Decree 330 has expanded the regulatory scope to cover most forms of exploitation and trading of information currently occurring in the market. Specifically, providing, sharing or exchanging personal data for material benefit or any other benefit in violation of the law is considered a violation.

In addition, transferring personal data for a fee without a lawful agreement or consent from the data subject, or entering into a data transfer agreement without clearly specifying the purpose or processing the data for a purpose different from the original purpose, is also classified as unlawful purchase or sale of personal data.

Accordingly, enterprises should urgently review all existing activities involving the sharing, exchange or commercialization of customer or partner databases. All data transactions generating revenue or commercial benefits must be based on the user’s clear consent and must apply data de-identification techniques when the data is placed on data trading platforms.

Compliance recommendations

In the context where violations may result in various levels of penalties, and the aggregate amount of fines may become significant if an enterprise simultaneously violates multiple obligations, the enterprise should proactively review and strengthen its compliance system through the following steps:

Determine the scope of application, processing roles and exemptions

Clearly determine whether the enterprise acts as the Data Controller, Data Processor or Third Party for each processing activity; and review cases eligible for exemption from or reduction of obligations, particularly exemptions applicable to small enterprises and cases exempt from preparing a cross-border data transfer impact assessment dossier.

Establish a data map and legal basis map

Prepare a data map to fully identify personal data flows throughout the entire processing lifecycle, including collection, use, storage, sharing and transfer of data. On this basis, determine the corresponding legal basis for each processing activity, such as consent, performance of a contract, compliance with a legal obligation, or other legal bases as prescribed by law.

Review the consent mechanism and procedures for exercising data subject rights

Remove “pre-ticked box” mechanisms or any default assumption that silence constitutes consent. The enterprise should establish a comprehensive tracking table for the deadlines applicable to requests to exercise data subject rights, including cases where such requests are made through a Data Processor or Third Party, the applicable processing period and any extension period. At the same time, the enterprise should maintain complete logs and evidence demonstrating the collection of consent.

Establish a personal data incident-response playbook

Develop a standardized procedure covering the process from detection, recording and classification of incidents to harm assessment, reporting/escalation mechanisms and fulfilment of notification obligations within the statutory time limits. In particular, the enterprise should establish mechanisms for controlling and handling incidents within 72 hours to mitigate the risk of penalties.

Complete the DPIA and cross-border data transfer assessment dossier (CTIA)

Review, complete and maintain the Personal Data Processing Impact Assessment Dossier (DPIA) and the Cross-Border Personal Data Transfer Impact Assessment Dossier (CTIA) in accordance with the forms and requirements under Decree No. 356/2025, while establishing a mechanism for updating the dossiers when there are changes to processing activities, systems, data recipients or other relevant factors.

Review the DPO, DPA and vendor governance mechanism

Ensure that the DPO/personnel responsible for personal data protection fully satisfies the applicable criteria, avoiding merely formal appointments. At the same time, review the Data Processing Agreements (DPAs) and vendor governance mechanisms to ensure that the responsibilities, rights and obligations of the parties in relation to personal data protection are clearly allocated and consistent with the requirements of Decree No. 356/2025.

Decree No. 320/2026/ND-CP: New regulations on electronic identification and authentication

Legal Updates, Resources

On 13 August 2026, the Government issued Decree No. 320/2026/ND-CP amending and supplementing a number of provisions of Decree No. 69/2024/ND-CP dated 25 June 2024 on electronic identification and authentication (“Decree 320”).

Decree 320 does not replace Decree No. 69/2024/ND-CP in its entirety, but amends and expands the mechanisms for electronic identification, data integration and the use of electronic identification accounts in administrative procedures, public services and transactions in the digital environment. Below are some notable provisions of Decree 320:

No requirement to resubmit documents already integrated into VNeID

Decree 320 requires agencies, organizations and individuals, when receiving and handling administrative procedures, public services, civil transactions and other activities, to access and use electronic identities, information and documents already integrated into VNeID; at the same time, individuals and organizations must not be required to submit or present originals or copies of documents and materials that have already been integrated.

This provision has significant practical implications for the digitalization of documents relating to administrative procedures. Where documents have actually been integrated and can be accessed from the system, continuing to require a duplicate set of paper documents is, in principle, no longer appropriate.

However, enterprises need to distinguish between not having to resubmit documents that have already been integrated and obligations to inspect, appraise or retain documents under sector-specific laws. The fact that documents integrated into VNeID do not have to be presented under Decree 320 does not automatically abolish the obligation to retain such documents in accordance with law.

Foreigners may be issued electronic identification accounts without classification by level

Under the previous provisions of Decree No. 69/2024/ND-CP, electronic identification accounts of foreigners were classified into Level 1 and Level 2 accounts, with different conditions, scopes of use and issuance procedures. Eligible persons were basically foreigners who had been issued permanent residence cards or temporary residence cards in Vietnam.

Decree 320 abolishes the classification of electronic identification accounts of foreigners by level, while expanding the eligible persons to foreigners who lawfully enter Vietnam or lawfully reside in Vietnam and have a need to obtain an account.

The procedure for issuance of electronic identification accounts to foreigners is carried out in person at the provincial-level immigration authority. Foreigners present their passports or international travel documents, complete the application form under Form TK01, provide a mobile phone number registered in their own name, an email address (if any), and have their facial images and fingerprints collected. The processing time is shortened to no more than 02 working days if the National Database on Immigration already contains facial image and fingerprint information, or no more than 05 working days if such biometric data is not yet available.

For enterprises having foreign investors, legal representatives, experts or managers, this change may expand the ability to use VNeID in administrative procedures and electronic transactions.

Organizations may be issued electronic identification accounts without classification by level

Agencies and organizations established or registered to operate in Vietnam may also be issued electronic identification accounts upon request without classification by level.

At the same time, the time limit for issuing an account where the organization’s information needs to be verified because it is unavailable in a national database or specialized database is also shortened from no more than 15 days to no more than 10 working days from the date of receipt of a complete and valid application.

VNeID becomes a focal point for carrying out administrative procedures and electronic communications

Decree 320 clarifies the legal validity of electronic information in electronic identification and authentication activities. Accordingly, the use of electronic identity information and information and documents integrated into electronic identity cards, electronic identification accounts or electronic identification and authentication systems has the same legal validity as providing the corresponding information or presenting the corresponding documents when carrying out administrative procedures, public services, transactions and other activities.

An electronic identity holder may use VNeID to create and submit an application for settlement of administrative procedures. The application is transmitted from VNeID to the National Public Service Portal; the processing result is transmitted back from the National Public Service Portal to VNeID for notification to the individual, agency or organization.

In addition to login and authentication functions, Decree 320 also establishes a communication channel on the National Electronic Identification Application for citizens holding Level 2 accounts, foreigners, agencies and organizations holding electronic identification accounts. State agencies, political organizations and socio-political organizations may send notifications and receive feedback and petitions through this channel. Enterprises should therefore consider VNeID as an official information-receiving channel that needs to be assigned for monitoring, rather than merely as a login tool.

Expansion of document integration and data updates on VNeID

Decree 320 establishes a mechanism for automatic synchronization and updating of documents that do not constitute State secrets and are issued by competent agencies or organizations if the database of the issuing agency has been connected to the electronic identification and authentication system. In principle, when information or documents change, the issuing agency must immediately update them. If the document-issuing agency does not yet have a connected database, the electronic identity holder may submit a request for integration through VNeID. Within 05 working days from the date the system receives the request, the competent document-issuing agency must receive, process and approve the integration request in accordance with the guidance of the Ministry of Public Security.

The Appendix enclosed with Decree 320 adds 206 types of documents that may be integrated, including 66 types of documents issued to individuals and 140 types of documents issued to agencies and organizations. For enterprises, this list includes many commonly used documents such as Enterprise Registration Certificates, Certificates of Registration of Branch/Representative Office Operations, Tax Registration Certificates and many sector-specific licences and certificates of satisfaction of business conditions.

The inclusion of a type of document in the list of documents eligible for integration does not mean that the data will immediately be available on VNeID at all times. Actual accessibility still depends on whether the database of the issuing agency has been connected, whether the data has been accurately synchronized and whether the specific document has been updated to the account of the relevant holder.

Mandatory linkage and authentication of electronic transaction accounts with electronic identification accounts

One of the notable changes under Decree 320 is the addition of a requirement to link and authenticate electronic transaction accounts with electronic identification accounts for certain activities on digital platforms.

Accordingly, electronic transaction accounts as prescribed by the law on electronic transactions on digital platforms serving activities in the following sectors must be linked and authenticated with electronic identification accounts:

education and digital literacy;
securities, telecommunications and banking;
e-commerce, including accounts of sellers, livestream sellers and affiliate marketers as prescribed by the Law on E-Commerce;
electronic invoices, transport business, tourism business, pharmaceutical business and medical examination and treatment; and
social networks in Vietnam.

For electronic transaction accounts on digital platforms serving national defence and security activities or providing cross-border services, linkage and authentication with electronic identification accounts must be completed before use.

Decree 320 provides important transitional deadlines for accounts created before 28 September 2026:

No later than 31 December 2026: accounts in the above-mentioned sectors, except for the banking sector, must complete linkage and authentication with electronic identification accounts.
No later than 30 June 2027: accounts in the banking sector must complete linkage and authentication.

For this purpose, national digital platforms must integrate the use of electronic identification accounts for authentication, login and transaction purposes no later than 31 December 2026. Enterprises in the regulated sectors should promptly review their login architecture, customer identity verification/authentication processes, terms of use, consent mechanisms and migration plans for existing accounts to avoid concentrating the work at the end of the transitional period.

Enhanced requirements on cybersecurity, transparency in data access and restrictions on data sharing

For agencies and organizations eligible to directly connect their information systems to the electronic identification and authentication system, Decree 320 requires the cybersecurity protection plan of the information system to meet at least Level 3. The connection dossier must clearly state the scope and purpose and include documents evidencing satisfaction of cybersecurity conditions; the system management authority may conduct cybersecurity and information security inspections before connection.

Agencies and organizations connected to, accessing and using information and documents in the system must also retain and provide access histories for display to electronic identity holders. Such history includes the type of information and documents accessed, the purpose, number of accesses, time and accessing party. At the same time, information and documents authenticated or accessed from the system must not be further shared with another party, unless requested by the data subject or otherwise provided by law.

Accordingly, enterprises that connect to or use data from the identification system need to simultaneously review access control mechanisms, system logs, personal data protection policies, purposes of data processing and data-sharing flows to service providers or companies within the same group. Successful authentication of data on VNeID does not create a right to use such data for purposes beyond the permitted scope.

Some other changes to note

In addition to the above contents, Decree 320 also adds a social welfare account on VNeID, allowing the integration of one payment account, e-wallet or mobile money account registered in the holder’s own name to receive support payments, pensions and social welfare payments.

Decree 320 also expands the conditions for using automated immigration control gates for Vietnamese citizens and foreigners whose immigration data or electronic identification accounts satisfy the prescribed conditions.

Overall, Decree 320 promotes the use of electronic identification accounts as a common authentication layer for the public sector and many digital transactions in the private sector. Decree 320 is considered to take the National Electronic Identification Application (VNeID) a further step from an electronic identification tool to shared infrastructure for accessing documents, carrying out administrative procedures, receiving notifications and authenticating electronic transaction accounts.

These changes have a direct impact on enterprises operating digital platforms, enterprises in the sectors listed under Decree 320, enterprises having foreign employees or managers and organizations that regularly carry out online public administrative procedures. In this context, enterprises should prioritize determining whether they fall within the sectors subject to mandatory account linkage, reviewing the electronic identification accounts of the organization and its foreign representatives/managers, and assessing technical integration capabilities and data protection requirements ahead of the transitional deadlines at the end of 2026 and in mid-2027.

Circular 38/2026/TT-NHNN: New Foreign Exchange Rules for Foreign Investment in Vietnam

Legal Updates, Resources

Circular No. 38/2026/TT-NHNN: Completing the foreign exchange transaction management mechanism to align with changes in Vietnam’s investment laws

On 31 July 2026, the State Bank of Vietnam issued Circular No. 38/2026/TT-NHNN on foreign exchange management for foreign investment activities in Vietnam (“Circular 38”), replacing Circular No. 06/2019/TT-NHNN (“Circular 06”), and taking effect from 18 August 2026.

Circular 38 was issued to align foreign exchange management regulations with the current investment laws, while clarifying the mechanisms for capital contribution, opening and use of investment capital accounts, transfer of capital, profits and lawful revenues, payment of transfer prices and other transactions related to foreign investment activities in Vietnam. Some notable points of Circular 38 include:

Changes to the concept of “Foreign investment capital account in Vietnam”

Circular 38 replaces the term “direct investment capital account” under Circular 06 with “foreign investment capital account in Vietnam”. This change aims to broaden the scope of application, covering not only foreign investment activities into Vietnam but also investment activities from the International Financial Center in Vietnam (“IFC”) into the rest of Vietnam.

The updates below focus on foreign exchange management regulations applicable to cases where foreign investors being foreign organizations or individuals outside the territory of Vietnam conduct investment activities in Vietnam. For enterprises that are members of the IFC investing into the rest of Vietnam, foreign exchange management regulations are basically applied similarly to foreign investors, but with differences in cash flows as there is no transfer of funds from abroad into Vietnam.

Principles for transferring investment capital contributions into Vietnam

Investors may make capital contributions in foreign currency or Vietnamese dong on the basis of documents evidencing the capital contribution in accordance with the law, including the Enterprise Registration Certificate, Investment Registration Certificate, approval for capital contribution, purchase of shares or purchase of contributed capital, BCC contract, PPP contract and other relevant documents (collectively, “Documents Evidencing Capital Contribution”).

Notably, investors may transfer funds into the investment capital account to make capital contributions, change the contributed capital or the ratio of contributed capital before the enterprise completes the procedures for registration of changes to its charter capital or ownership structure in accordance with the laws. This provision facilitates capital increase and ownership restructuring transactions, while being consistent with the mechanism for registering changes after actual changes have occurred.

In addition, where the Documents Evidencing Capital Contribution specify multiple currencies, investors may select one currency to convert and determine the total value of the capital contribution. The selected currency must be used consistently throughout the entire capital contribution process, and the total value of the capital contribution after conversion must not exceed the capital contribution amount recorded in the Documents Evidencing Capital Contribution.

The applicable exchange rate shall be the exchange rate determined by the authorized bank where the investor opens the investment capital account at the time the funds are credited to the investment capital account.

Transfer of funds for investment preparation activities

Before the competent authority issues the Documents Evidencing Capital Contribution, foreign investors are permitted to transfer funds from abroad into Vietnam or from a payment account opened at an authorized bank in Vietnam to pay lawful expenses incurred during the investment preparation stage. Where the investor chooses to establish an economic organization before carrying out investment registration procedures, the investor is also permitted to open an investment capital account before the Investment Registration Certificate is issued or amended to make such payments.

After the Documents Evidencing Capital Contribution are issued, the amount transferred into Vietnam for investment preparation purposes may be handled under one of the following options:

Convert into capital contribution: part or all of the amount may be converted into the investor’s capital contribution;
Convert into a foreign loan: part or all of the amount may be converted into a foreign loan of the foreign-invested economic organization, subject to compliance with the laws on foreign borrowing and repayment; or
Return to the investor: where the Investment Registration Certificate is not issued or amended, the amount transferred shall be returned to the investor after deducting lawful expenses incurred during the investment preparation process in Vietnam.

The conversion or return of the above amount must be carried out on the basis of valid documents and vouchers evidencing the amount transferred and lawful expenses incurred, while ensuring compliance with regulations on foreign exchange management, investment, accounting and relevant laws.

Transfer of funds for payment of transfer prices

Payment of the transfer price for shares or contributed capital in a foreign-invested economic organization shall be made as follows:

Not through the investment capital account: transactions between non-resident investors or between resident investors.
Must be made through the investment capital account: transactions between a non-resident investor and a resident investor.

For transfer of investment projects under BCC contracts and PPP projects, payment must be made through the investment capital account in both cases: (i) between a non-resident investor and a resident investor; and (ii) between non-resident investors.

For petroleum contracts, payment of the transfer price for investment projects or transfer of participating interests, rights and obligations of contractors must be made through the investment capital account for transactions between a non-resident investor and a resident investor.

Currency for pricing and payment of transfer prices

The pricing and payment of the transfer price for capital or investment projects may be made in foreign currency for transactions between non-resident investors.

For transactions related to petroleum contracts, the pricing and payment of the transfer price for investment projects, participating interests, rights and obligations of contractors under petroleum contracts may be made in foreign currency for transactions between non-resident investors or between a foreign investor and a resident investor.

Except for the transfer transactions in the petroleum sector mentioned above, the pricing and payment of the transfer price for capital or investment projects must be made in Vietnamese dong for transactions between a resident investor and a non-resident investor or between resident investors.