Beyond tax and company law, investors in Vietnam must comply with a new Personal Data Protection Law, in force since 1 January 2026, a strictly first-to-file IP system, and anti-money-laundering, competition and environmental rules. These answers cover the compliance points that most often surprise new entrants.
Re-checked against official Vietnamese sources every month · Reviewed · How we check
What is Vietnam's personal data protection law and who does it apply to?
Law No. 91/2025/QH15 on Personal Data Protection, passed on 26 June 2025, took effect on 1 January 2026 and is implemented by Decree No. 356/2025/ND-CP. It applies to Vietnamese and foreign organisations and individuals in Vietnam, and to foreign organisations abroad that directly process or are involved in processing personal data of Vietnamese citizens and certain residents. The supervisory authority is the Ministry of Public Security's Department of Cybersecurity and High-Tech Crime Prevention (A05). Small enterprises and start-ups have a five-year grace period for some duties, such as appointing a data protection officer, unless they process sensitive data or large volumes, and micro and household businesses are largely exempt. The same rules apply to domestic and foreign-owned companies.
Do I need impact assessments to process or transfer data abroad, and must data be stored in Vietnam?
Yes to impact assessments. Controllers and processors must prepare a processing impact assessment and, before sending personal data abroad, including to offshore cloud servers, a transfer impact assessment, filed with A05 online; Decree No. 356/2025/ND-CP allows 60 days from the start of the transfer. Data localisation is a separate cybersecurity rule. Under Law No. 116/2025/QH15 on Cybersecurity, effective 1 July 2026, and Decree No. 333/2026/ND-CP, domestic online, telecoms and internet service providers must store prescribed user data in Vietnam, while foreign providers must do so, and open a local branch or representative office, only once triggered, for example by a Ministry of Public Security notice.
What are the breach notification, data subject rights and penalty rules?
Under Law No. 91/2025/QH15, a controller must notify A05 within 72 hours of detecting a reportable violation of personal data protection rules, and certain cases, such as breaches at financial service providers or involving biometric data, must also be notified to affected individuals. Individuals have rights to be informed, to consent and withdraw consent, to access, correct and delete their data, to restrict or object to processing, and to complain and claim compensation. Decree No. 330/2026/ND-CP, effective 19 August 2026, sets fines of up to VND 3 billion for organisations (half for individuals), up to 5% of prior-year revenue for unlawful cross-border transfers and up to ten times the revenue from buying or selling personal data. Plan breach responses before launch.
How do I protect trademarks and patents in Vietnam?
Register them with the Intellectual Property Office of Vietnam (IP Viet Nam), under the Ministry of Science and Technology, which applies Law No. 50/2005/QH11 on Intellectual Property as amended, most recently by Law No. 131/2025/QH15 from 1 April 2026. Vietnam is strictly first-to-file, so use or registration abroad gives no protection and trademark squatting is a real risk: file before you launch, appoint distributors or manufacture locally. Patents last 20 years and trademark registrations 10 years, renewable indefinitely, but a mark unused for five years can be cancelled. Foreign applicants without a residence or business establishment in Vietnam must file through a licensed industrial property representative. Copyright arises automatically, though voluntary registration helps with evidence.
Can I extend international filings to Vietnam, and what did the 2025 IP amendments change?
Yes. Vietnam is a member of the Madrid System for trademarks, the Patent Cooperation Treaty (PCT) for patents and the Hague system for industrial designs, so you can designate Vietnam in an international application, although IP Viet Nam still examines it under Vietnamese law and a local agent is needed to answer any refusal. Law No. 131/2025/QH15, effective 1 April 2026, shortens some examination periods and allows fast-track examination in cases the Government specifies, encourages the valuation and use of IP rights for capital contribution and financing, permits limited use of lawfully published works for AI training, and strengthens takedown tools against online infringement. Review your licensing and technology transfer terms against the amended rules.
What anti-money-laundering obligations apply to my business?
Law No. 14/2022/QH15 on Anti-Money Laundering, in force since 1 March 2023, applies to financial institutions and to designated non-financial businesses, including real estate businesses, casinos and prize-gaming operators, dealers in precious metals and gems, lawyers, notaries, accountants and trust or company service providers. These reporting entities must identify customers and beneficial owners, apply risk-based due diligence, report suspicious and large-value transactions to the State Bank of Vietnam's Anti-Money Laundering Department, adopt internal AML rules and keep records for five years. Even if your business is not a reporting entity, expect banks and counterparties to verify you and your owners, and keep your beneficial ownership filing under the Law on Enterprises accurate.
Does Vietnam have merger control and consumer protection rules?
Yes. Law No. 23/2018/QH14 on Competition prohibits anti-competitive agreements and abuse of dominance and requires notice of economic concentrations, such as mergers, acquisitions and joint ventures, above set thresholds to the National Competition Commission before completion. Under Government Resolution No. 66.18/2026/NQ-CP, from 1 July 2026 to 28 February 2027 the general thresholds are doubled to VND 6,000 billion in Vietnamese assets or turnover or a VND 2,000 billion deal value, alongside a 20% combined market share test, with separate thresholds for banks, insurers and securities firms. Failing to notify can cost up to 5% of relevant turnover. Law No. 19/2023/QH15 on Protection of Consumer Rights, effective 1 July 2024, regulates standard contracts, remote selling and large digital platforms.
Law No. 36/2018/QH14 on Anti-Corruption, amended by Law No. 132/2025/QH15 from 1 July 2026, mainly targets public officials but also requires private enterprises to adopt codes of conduct and internal controls, with extra transparency duties for public companies and credit institutions. The Penal Code criminalises giving bribes both to public officials and to office-holders in private organisations, from a VND 2 million threshold, but only individuals, not companies, can be convicted of bribery, so managers carry the personal risk. Companies can face criminal liability for offences such as money laundering and tax evasion. The US Foreign Corrupt Practices Act and UK Bribery Act may also apply. Adopt a written policy, train staff and screen agents and intermediaries.
Law No. 72/2020/QH14 on Environmental Protection, guided by Decree No. 08/2022/ND-CP as amended by Decree No. 05/2025/ND-CP, classifies projects by environmental risk. Higher-risk projects need an environmental impact assessment (EIA) approved before construction, projects discharging waste generally need an environmental licence before operation, and lower-risk ones register locally. Appraisal is shared between the Ministry of Agriculture and Environment (which replaced the Ministry of Natural Resources and Environment in 2025) and provincial People's Committees. Law No. 146/2025/QH15, effective 1 January 2026, simplified permitting, and a wider overhaul of the 2020 law was published in draft in June 2026. Start early, because the EIA sits on the critical path.
Are electronic signatures and online contracts valid in Vietnam?
Yes. Law No. 20/2023/QH15 on Electronic Transactions, effective 1 July 2024, gives data messages and electronic contracts legal effect and, unlike the 2005 law, no longer excludes whole areas such as land use certificates. Decree No. 23/2025/ND-CP, effective 10 April 2025, regulates digital signatures and trust services, and secure digital signatures backed by a licensed provider's certificate carry the most weight. Foreign electronic signatures can be recognised if they meet Vietnamese or recognised international standards. Whether a particular document may be signed electronically still depends on the sector law, and some transactions, such as land and property transfers, need notarisation or registration steps. E-commerce businesses must also comply with data protection, consumer and tax rules.
Ask the Be Vietnam Wise advisor. It checks official Vietnamese sources and points you to the governing law, or read how to find and check a Vietnamese lawyer.
This page gives legal and tax information, not legal advice. Rates, thresholds and procedures change; the answers are re-checked against official sources every month, but you should confirm anything important with the relevant authority or a licensed Vietnamese lawyer before you act.