Technology Law Vietnam: Data, AI & Fintech Advisory

We work with founders and boards, general counsel and chief technology officers, platform operators, banks and fintech partners, and foreign investors entering Vietnam. Technology law Vietnam mandates rarely stay inside the legal department, so we write for engineers and finance teams as well as lawyers.

• Start-ups and scale-ups that need a launch plan before the product goes live.
• Multinationals that process Vietnamese user data or sell to Vietnamese consumers.
• Financial institutions partnering with fintech and data providers.
• Investors buying or funding technology businesses.

A product that was compliant in 2024 can be non-compliant today without a single line of code changing.

Our technology law Vietnam practice maps these regimes to your actual product, so that engineering, finance and legal work from one compliance plan instead of five separate memos.

The table is a map, not an opinion. Whether a rule bites depends on your business model, user base and data flows, which is why we start every mandate with a short regulatory scoping exercise.

The AI law Vietnam framework, a core part of technology law Vietnam, took effect on 1 March 2026. It applies a risk-based approach to the research, development, provision and use of AI systems, with human oversight in important decisions and a national AI portal for notifications and serious-incident reports. The in December 2025, and the Government has since added detailed rules.

Classification, notification and the high-risk list

Providers classify their AI systems as high, medium or low risk and notify the Ministry of Science and Technology of the result before deployment. The Prime Minister then issued on 30 June 2026, promulgating the list of high-risk AI systems.

That list changes the practical question from “does the AI law apply to us?” to “is our system on the list, and if not, can we document why?” Both answers need a file that a regulator or enterprise customer can read.

What we do for AI providers and deployers

• Prepare the notification and the supporting technical documentation.
• Draft AI governance policies, human-oversight procedures and incident playbooks.
• Negotiate vendor, model-licensing and data-use terms with foreign AI suppliers.

Systems already in operation benefit from transitional periods that depend on the sector, so the earlier you classify, the more room you keep.

A good classification file is short and specific. It names the system, its purpose, the people it affects, the data it uses, the human oversight that exists and the reasons for the chosen risk level. Enterprise buyers increasingly ask for the same file in procurement, so the work pays back twice.

For any company that handles customer, employee or user data in Vietnam, this part of technology law Vietnam is now the most widely applicable regime in the whole technology stack.

Impact assessments and the 60-day rule

Controllers and processors must prepare a data processing impact assessment, and a transfer impact assessment for cross-border transfers, within 60 days of starting the relevant activity. The dossiers follow prescribed templates and must be kept ready for inspection.

Cross-border transfer: cloud counts

Intra-group sharing, offshore analytics and SaaS tools are therefore in scope even when no one thinks of them as “exporting” data.

In practice, most gaps we find are documentary rather than technical: a missing assessment, an outdated privacy notice, or a processor contract that does not match the data actually shared. These are inexpensive to fix once identified.

Penalties are significant: for cross-border transfer breaches, fines can reach 5% of the violator’s prior-year revenue. That is a board-level number.

For fintech teams, technology law Vietnam starts with licensing. Fintech regulation Vietnam is built around licences held by banks and licensed institutions, with a sandbox for innovation.

What the sandbox covers

The sandbox focuses on three areas: credit scoring, open API data sharing and peer-to-peer lending. P2P lending carries extra restrictions, including a ban on foreign ownership and heavier credit-data reporting duties.

Models outside the sandbox

Payments, wallets, buy-now-pay-later, embedded lending and wealth-tech each touch different licences and partner-bank structures. We advise on the corporate structure, bank partnership contracts and foreign-ownership limits, and we connect this work with our banking and finance practice when the model needs a funding line.

Partner-bank agreements deserve special attention. They decide who holds the customer relationship, who carries credit and fraud losses, who owns the data and what happens if either side loses a licence. Founders often sign them early and regret the terms later, so we negotiate them as part of the technology law Vietnam plan rather than as an afterthought.

Crypto asset licensing Vietnam is now an operational process, not just a policy debate.

From resolution to licence applications

Only licensed Vietnamese companies that meet strict capital and eligibility conditions can operate a trading platform; the minimum capital stated for exchanges is VND 10 trillion.

Enforcement is now in force

Offshore exchanges and token issuers that serve Vietnamese users should treat this part of technology law Vietnam as a compliance deadline.

We advise token issuers, exchanges, custodians and investors on characterisation, licensing eligibility, structuring and risk allocation, and we say clearly when a business model falls outside the pilot.

It sets duties for intermediary platforms, social-media commerce, livestream sellers and affiliate marketers.

Foreign platforms and local presence

A foreign platform that does direct business with online ordering must appoint an authorised legal entity in Vietnam before it enables a Vietnamese-language interface, uses a .vn domain, or reaches the prescribed transaction threshold. We combine this with company incorporation work when a local vehicle is needed.

What we prepare for online sellers

• Website and app terms, privacy and cookie notices.
• Seller and merchant agreements, platform operating rules and dispute procedures.
• Livestream and affiliate agreements with clear liability allocation.
• Registration or notification with the competent authority.

Investors in Vietnamese technology companies ask the same three questions: who owns the code and the data, which licences are held, and what happens if a regulator looks closely. Technology law Vietnam diligence answers those questions before signing, not after closing.

Technology due diligence

We review intellectual property ownership, open-source use, software and cloud licences, data-sharing agreements, privacy documentation and regulatory filings. Gaps found here translate into price adjustments, conditions precedent or specific indemnities in the transaction documents, which we negotiate through our mergers and acquisitions team.

Contracts that carry the risk

Software development, SaaS, data processing, API and white-label agreements allocate the real technology risk. We draft and negotiate them with clear service levels, data-protection clauses, liability caps, audit rights and exit assistance, so that a regulatory change does not turn into a contract dispute.

For founders raising capital, we align the shareholder agreement, option plan and data room with what investors will test, which shortens the diligence timetable.

Use this technology law Vietnam sequence if you are starting from zero. It follows the order in which authorities and enterprise customers usually ask for evidence.

1. Inventory. List every product, AI feature, data store, vendor and cross-border data flow.
2. Classify. Decide which regimes apply: AI, personal data, fintech, digital assets or e-commerce.
3. Document. Prepare impact assessments, AI risk classification files and platform terms.
4. Contract. Update vendor, processor and customer agreements to match the documents.
5. File. Submit the notifications, registrations or licence applications that your model requires.
6. Monitor. Assign an owner for new decrees, circulars and lists, because secondary legislation is still arriving.

Common mistakes we see

• Treating a foreign cloud provider as outside the data-transfer rules.
• Launching an AI feature without a documented risk classification.
• Assuming a crypto or token activity is allowed because competitors offer it offshore.
• Opening a marketplace to Vietnamese users before appointing a local legal entity where one is required.

Each of these is cheaper to fix in design than after a complaint or inspection. A short technology law Vietnam review usually surfaces them within a week.

Most technology law Vietnam clients fall into one of the models below. Each row shows where we usually start and what the first deliverable looks like.

If your model blends several rows, the regimes stack. A lending app with AI scoring and a marketplace front end touches all of them, and the sequencing of filings then matters more than any single rule.

Our technology law Vietnam mandates follow four steps, and we keep each one short.

1. Regulatory map

We identify which laws apply to the product, which licences or registrations are needed, and where the largest risks sit.

2. Remediation plan

We deliver a prioritised plan with owners and deadlines, so that engineering and legal teams can work in parallel.

3. Documents and filings

We draft the policies, contracts and dossiers, and we handle filings with the competent authority where needed. For corporate set-up and shareholder terms we work with our corporate and commercial team.

4. Ongoing counsel

Fast-moving products change monthly. Many clients keep us as outsourced regulatory counsel after launch. This page is general information, not legal advice on your specific facts.

Pick the one area of technology law Vietnam that worries you most and bring us the product description. In a short call we will confirm which of the five regimes apply, what you owe first, and what it will cost to close the gaps. That is the fastest way to turn technology law Vietnam from a risk list into a launch plan.

Official information: Ministry of Science and Technology.