Vietnam: technology regulation at a glance

Framework: Law on Digital Technology Industry (Law No. 71/2025/QH15, effective 1 Jan 2026); Government Resolution No. 05/2025/NQ-CP (9 Sept 2025) on the 5-year Crypto Asset Market Pilot; MoF Circulars 32/2026/TT-BTC and 41/2026/TT-BTC (tax); State Bank of Vietnam remains the payment-services regulator (OL 5747/NHNN-PC bans crypto as means of payment). Primary authorities: Ministry of Finance (licensing/oversight of the crypto pilot), State Bank of Vietnam (payments, AML/CFT), Ministry of Public Security (cyber/data).

Vietnam moved from a regulatory grey zone to a dedicated legal framework in 2026: the Law on Digital Technology Industry (in force 1 Jan 2026) formally recognises digital and crypto assets as property, and Resolution 05/2025/NQ-CP launched a 5-year pilot regime under which only Ministry of Finance-licensed Vietnamese enterprises may operate crypto trading, custody and issuance. Cryptocurrencies remain prohibited as a means of payment (all settlement must be in VND), fiat- and securities-backed crypto assets cannot be issued, and licensed activity is subject to strict capital (VND 10 trillion), ownership (≥51% Vietnamese, ≤49% foreign), KYC/AML, data-localisation and market-integrity requirements. Crypto-specific tax rules (0.1% PIT on transfers via licensed platforms; 20% CIT on corporate gains; no VAT on transfers) took effect via MoF circulars in Q2 2026.

Framework: Law on Artificial Intelligence No. 134/2025/QH15 (passed 10 December 2025, in force 1 March 2026), administered by the Ministry of Science and Technology; underpinned by National AI Strategy Decision No. 127/QĐ-TTg (2021)

Vietnam enacted its first standalone AI law on 10 December 2025 (Law No. 134/2025/QH15), which entered into force on 1 March 2026, making it one of the earliest comprehensive national AI laws in Southeast Asia. The law adopts a risk-based framework classifying AI systems into high, medium, and low risk tiers, with prohibited 'unacceptable-risk' uses banned outright. The Ministry of Science and Technology serves as the principal regulatory authority, with a National Single-Window AI Portal established for incident reporting and compliance.

Framework: Law No. 91/2025/QH15 on Personal Data Protection (effective 1 January 2026), implemented by Decree No. 356/2025/ND-CP; supervised by the Ministry of Public Security (Department of Cybersecurity and Prevention of Cybercrimes)

Vietnam enacted its first standalone comprehensive Personal Data Protection Law (Law 91/2025/QH15) on 26 June 2025, which came into force on 1 January 2026, elevating the previous decree-level framework (Decree 13/2023) to full statutory law. The law imposes GDPR-influenced obligations on data controllers and processors, including consent, breach notification, and impact assessments. Decree 356/2025/ND-CP, also effective 1 January 2026, provides detailed implementing rules and replaces Decree 13.

Framework: State Bank of Vietnam (SBV) under the Law on Credit Institutions 2024 and Decree No. 52/2024/ND-CP on non-cash payments (in force 1 July 2024), implemented by Circular 40/2024/TT-NHNN as amended by Circular 41/2025/TT-NHNN; Decree 94/2025/ND-CP establishes a fintech regulatory sandbox.

Vietnam has a dedicated, in-force licensing regime for payments and e-money administered by the State Bank of Vietnam. Decree 52/2024 (effective 1 July 2024) introduced the country's first legal definition of e-money and governs licensing of intermediary payment service providers (IPSPs), including e-wallets, payment gateways, switching and clearing; over 40 non-bank entities are licensed. Open banking and P2P lending are only being piloted under the 2025 fintech sandbox, and BNPL still lacks a dedicated framework.

Framework: Law No. 47/2014/QH13 on Entry, Exit, Transit and Residence of Foreigners in Vietnam (amended by Law No. 51/2019/QH14); Decree No. 221/2025/ND-CP on Limited-Term Visa Exemption for Socio-Economic Development Contributors (in force 15 Aug 2025, 14 Aug 2028); administered by the Immigration Department, Ministry of Public Security

Vietnam has no dedicated digital nomad or remote-work visa category as of May 2026. The primary practical route for remote workers is the 90-day multiple-entry e-visa, which does not explicitly authorize working for overseas clients, a legal grey zone that authorities tolerate but have not formalised. Longer-term legal residency is possible via a work-permit-backed Temporary Residence Card (TRC), obtainable through an Employer of Record arrangement, while a proposed investor 'golden visa' remains in draft form with no enacted legislation.

Framework: Law on Cybersecurity No. 116/2025/QH15 (effective 1 Jul 2026, consolidating Laws 86/2015 and 24/2018); Decree 147/2024/ND-CP on Internet Services and Online Information (effective 25 Dec 2024); Law on Personal Data Protection (effective 1 Jan 2026); Ministry of Information and Communications / Ministry of Public Security as co-regulators

Vietnam operates one of the most restrictive internet regulatory regimes in Southeast Asia, using a layered body of cybersecurity and platform laws to mandate content removal on government demand, prohibit anti-state online speech, require real-name user authentication, and compel data localisation. The December 2025 Law on Cybersecurity (No. 116/2025/QH15), effective July 2026, consolidates prior laws and expands Ministry of Public Security powers over digital identity and content policing. Major platforms including Meta and Google now comply with over 90-95% of Vietnamese government content-removal requests.

Framework: Law on Cybersecurity No. 116/2025/QH15 (effective 1 July 2026, replacing Law No. 24/2018/QH14); Decree 53/2022/ND-CP; Decree 13/2023/ND-CP on Personal Data Protection; enforced by the Ministry of Public Security (A05, Department of Cybersecurity and Prevention of High-Tech Crimes)

Vietnam operates a comprehensive cybersecurity legal regime. The foundational Law on Cybersecurity (No. 24/2018/QH14), supplemented by implementing Decree 53/2022, imposes obligations on operators of critical information infrastructure, domestic and foreign internet/telecom service providers (including data localisation), and mandates incident reporting to the Ministry of Public Security. A sweeping replacement law (No. 116/2025/QH15), passed December 2025, takes effect 1 July 2026, consolidating the 2018 cybersecurity law and the 2015 cyber information-security law into a single unified statute with strengthened obligations on platforms, AI-generated content, and critical infrastructure operators.

Framework: Law on Investment 2020 (No. 61/2020/QH14), Law on Enterprises 2020 (No. 59/2020/QH14), Decree 31/2021/ND-CP, and Law on Investment 2025 (No. 143/2025/QH15, effective 1 March 2026)

Foreign investors can establish a 100% foreign-owned company in Vietnam across a wide range of sectors, but must navigate a multi-step licensing process requiring an Investment Registration Certificate (IRC) and an Enterprise Registration Certificate (ERC). A new Law on Investment (No. 143/2025/QH15, in force 1 March 2026) reversed the traditional order, allowing incorporation (ERC) to precede investment registration (IRC), streamlining the process. Certain sectors remain prohibited or subject to conditional market access, and foreign-document notarisation/legalisation requirements add friction.