Vietnam Regulatory Update: Three Key Changes Foreign Invested Businesses Should Know

Decrees 296, 320 and 330 introduce new requirements relating to beneficial ownership, electronic identification and personal data enforcement.

Vietnam strengthens transparency digital administration and data enforcement

Vietnam has introduced three regulatory developments that may affect the day-to-day operations of foreign investors and foreign-invested enterprises. Although the measures address different areas, they share a common direction: greater transparency over who owns and controls businesses, wider use of electronic identification in administrative procedures, and stronger enforcement of cybersecurity and personal data protection obligations.

Decree No. 296/2026/ND-CP focuses on enterprise registration and beneficial ownership. Decree No. 320/2026/ND-CP expands access to VNeID accounts for foreign nationals. Decree No. 330/2026/ND-CP introduces a dedicated sanctions framework for cybersecurity and personal data protection violations. For foreign-invested businesses, the practical question is not only what has changed, but whether their ownership records, foreign workforce procedures and data governance controls can demonstrate compliance.

Contact Ascentium Vietnam’s experts for a consultation at vietnam@ascentium.com or visit ascentium.com/vietnam.

1 Enterprise registration and beneficial ownership under Decree 296

The Government issued Decree No. 296/2026/ND-CP on 23 July 2026. The Decree took effect on the same date and amends Decree No. 168/2025/ND-CP on enterprise registration. Its key changes concern nominee capital contribution arrangements, beneficial ownership identification and the use of information held in interconnected state databases.

Nominee capital contribution arrangements are expressly prohibited

Decree 296 clarifies that company owners, members and shareholders must be responsible for the legality, truthfulness and accuracy of the information contained in enterprise registration dossiers. They must not hold or contribute capital in their own names on behalf of another person.

This express restriction is particularly relevant where the person recorded as the legal shareholder or member is not the person who provided the capital or ultimately controls the ownership interest. Businesses using informal nominee arrangements should not assume that a private agreement will resolve the regulatory risk created by inconsistent registration and ownership information.

Beneficial ownership requires a look through assessment

Enterprises may need to review their full ownership and control structures to identify the individuals who ultimately own or exercise effective control over the business. This may require ownership to be traced through intermediary companies or other legal arrangements rather than stopping at the first corporate shareholder.

The principal tests include:

• Ownership test: an individual directly or indirectly owns at least 25% of the enterprise’s charter capital or voting rights.
• Control test: an individual has the authority to determine or exert decisive influence over significant corporate matters, even if the individual does not satisfy the ownership threshold.
• Fallback test: where no individual is identified through ownership or control, the individual holding the highest managerial authority and acting on behalf of the enterprise may be identified as the beneficial owner.

1.1 What Decree 296 means for foreign-invested businesses

Foreign-invested enterprises often sit within regional or global group structures. The direct shareholder recorded in Vietnam may itself be owned through several holding companies. Accordingly, identifying the beneficial owner may require a documented layer-by-layer assessment that connects the Vietnamese entity to the relevant individual owners or controllers.

The change is also relevant to investment vehicles, family or contractual ownership groups and structures in which control rights arise through agreements rather than equity alone. Incomplete or inconsistent information may lead to supplementary filing requests, delays or compliance exposure when the enterprise carries out registration procedures.

1.2 What businesses should do

Establish an internal process for monitoring and updating beneficial ownership information when required.

Review shareholder, member and capital contribution arrangements for possible nominee structures.

Prepare an ownership chart tracing interests through intermediary entities to the ultimate individuals.

Assess contractual and governance rights that may give an individual effective control without 25% ownership.

Check that enterprise registration records and information in relevant government databases are accurate and consistent.

Read Related: Nominee Director in Vietnam: Legal Risks, Compliance Rules, and 2025 Regulatory Updates

2 Expanded VNeID access for foreigners under Decree 320

The Government issued Decree No. 320/2026/ND-CP on 13 August 2026. The Decree amends Decree No. 69/2024/ND-CP on electronic identification and authentication and takes effect on 28 September 2026.

Eligibility is no longer tied only to residence cards

Under the expanded framework, foreigners who lawfully enter or lawfully reside in Vietnam may apply for an electronic identification account. Eligibility is therefore no longer restricted to foreign nationals holding a Permanent Residence Card or Temporary Residence Card. Registration remains subject to the individual’s request and the applicable identity verification procedures.

The broader approach may cover foreign investors, company representatives, business travellers, secondees, short-term assignees, experts and dependants who did not qualify under the earlier residence-card-based criteria.

Integrated documents may support digital procedures

Information and documents integrated into the national digital identification application may be used for administrative procedures, public services and eligible civil transactions. Subject to the applicable rules and technical availability, users should not be required to repeatedly submit originals or copies of information already available through the integrated system.

Relevant documents may include passports, visas, visa exemption certificates, residence cards, work permits, driving licences, judicial record certificates and tax registration certificates. Foreign users may also use their accounts to access electronic public services and, where the applicable immigration requirements are satisfied, automatic immigration control gates. National digital platforms are expected to integrate electronic identification accounts for authentication and transactions no later than 31 December 2026.

2.1 What Decree 320 means for foreign-invested businesses

The change may reduce an administrative barrier for foreign personnel who need to interact with digital government systems before obtaining a residence card. However, expanded eligibility does not mean that every procedure will immediately become available to every foreign account holder. Practical access may still depend on registration, system integration and the requirements governing the specific public service.

2.2 What businesses should do

Retain alternative procedural arrangements while government systems complete their technical integration.

Identify foreign investors, legal representatives, employees, assignees and dependants who may be eligible.

Review registration procedures and prepare the necessary identity and immigration documents.

Determine which tax, employment, immigration and corporate processes already use or are expected to use VNeID authentication.

Provide practical registration support to eligible foreign personnel after the Decree takes effect.

Contact Ascentium Vietnam’s experts for a consultation at vietnam@ascentium.com or visit ascentium.com/vietnam.

3 Cybersecurity and personal data sanctions under Decree 330

Decree No. 330/2026/ND-CP was issued and took effect on 19 August 2026. It prescribes administrative penalties and remedial measures for violations in the fields of cybersecurity and personal data protection.

The underlying data protection obligations were already established under Vietnam’s Law on Personal Data Protection and its implementing regulations. Decree 330 is important because it links those obligations to a more specific enforcement framework. It is relevant to organisations that collect, store, use, disclose, share or transfer personal data, as well as businesses operating information systems, digital platforms and online services.

Penalties may be substantial

The applicable sanction depends on the conduct, the organisation’s role, the scale of the processing, the number of affected individuals and whether sensitive personal data is involved. Depending on the violation, organisations may face fines calculated by reference to unlawful proceeds, revenue-based penalties for qualifying cross-border transfer violations, or fixed administrative fines.

At the upper end of the framework, unlawful personal data trading may attract fines of up to 10 times the revenue obtained from the violation. Qualifying cross-border transfer violations may attract revenue-based fines of up to 5% of the preceding financial year’s revenue in the Vietnamese market. Other personal data protection violations may be subject to a general maximum of up to VND 3 billion. These figures are statutory ceilings or calculation mechanisms; they do not apply automatically to every breach.

Common operational risks

Conduct that may create exposure includes:

• Using default opt-ins, unclear consent requests or silence as consent.
• Processing personal data beyond the purposes communicated to the data subject.
• Failing to respond to access, correction, deletion or restriction requests within the applicable period.
• Failing to notify the competent authority within 72 hours of discovering a qualifying personal data breach.
• Failing to prepare, retain, submit or update a Data Processing Impact Assessment or Cross-Border Data Transfer Impact Assessment as required.
• Transferring personal data abroad without the required notices, consent, agreements or security measures.
• Failing to comply with an applicable data localisation requirement or regulator direction.

In addition to monetary fines, authorities may impose remedial measures such as deletion of unlawfully processed data, submission of missing assessments, disgorgement of unlawful gains, public correction, notification to affected individuals, suspension of processing or cross-border transfers, and suspension or revocation of relevant licences or operations where legally applicable.

3.1 What Decree 330 means for foreign-invested businesses

Foreign-invested enterprises commonly transfer employee, customer, supplier or user data to regional headquarters, group companies, cloud platforms and overseas service providers. These arrangements should be assessed as operational data flows, not merely described in policies. A locally compliant privacy notice will not be sufficient if systems, vendor contracts, access controls and incident procedures do not reflect the stated safeguards.

Responsibility may also extend across several internal functions. Human resources may control employee data, marketing may use customer data, IT may manage security and access, and regional teams may select cloud or processing vendors. Compliance therefore requires clear ownership and coordination across the organisation.

3.2 What businesses should do

• Document the evidence required to demonstrate that policies are implemented in daily operations.
• Map personal data by source, purpose, system, user, recipient, retention period and destination country.
• Review privacy notices, consent language and user interfaces to remove default or ambiguous consent mechanisms.
• Check the status, accuracy and filing of required impact assessment dossiers.
• Review contracts with processors, cloud providers, regional headquarters and overseas data recipients.
• Test the incident response process against the 72-hour notification requirement.
• Assign accountable owners across legal, compliance, HR, IT, security and business teams.

Read Related: A Dissection of Vietnam’s Personal Data Protection Decree – Compliance Guide for Investors in 2026

A coordinated compliance response

The three Decrees apply to different functions, but their implementation should be coordinated. Ownership information affects enterprise registration and governance. VNeID increasingly affects access to digital administrative procedures. Personal data controls affect HR, customer management, technology, vendor relationships and cross-border operations.

Foreign-invested businesses should therefore establish a cross-functional review led by the relevant decision-makers. The immediate objective should be to identify gaps in ownership records, prepare eligible foreign personnel for VNeID registration and confirm that data protection controls operate in practice. Early action may reduce the risk of registration delays, interrupted access to electronic procedures and enforcement exposure.

How Ascentium Vietnam (formely InCorp Vietnam) Can Help?

Ascentium Vietnam supports foreign investors and foreign-invested enterprises throughout their establishment and operations in Vietnam. Our teams provide assistance across market entry, enterprise registration, corporate compliance, HR and payroll, accounting and tax, business intelligence, ERP and IT, and advisory services.

Businesses assessing the impact of these developments may contact Ascentium Vietnam for support in reviewing their corporate records, foreign workforce administration and operational compliance requirements.

Ascentium Vietnam (formerly InCorp Vietnam) is a trusted partner for foreign investors, providing comprehensive corporate advisory and outsourcing solutions across Vietnam and Asia. As part of Ascentium Group, we focus on providing transparent and reliable services to overseas clients in Vietnam and Asia.

Contact Ascentium Vietnam’s experts for a consultation at vietnam@ascentium.com or visit ascentium.com/vietnam.