Decree 386/2026/ND-CP on Data Innovation in Vietnam: 7 Legal Issues for Foreign Companies

A data project can be technically successful yet still face legal and commercial barriers to commercialization. The business needs lawful access to suitable information, permission to test its product, and rights to use the results. Decree 386/2026/ND-CP on Data Innovation in Vietnam brings these questions together through mechanisms for data access, research, testing, and project support.

Issued on October 12, 2026, the decree takes effect on December 1, 2026. It governs data innovation and exploitation activities involving national data, as well as activities conducted through the Center for Data Innovation and Exploitation under the National Data Center (the “Center”). Foreign technology businesses, research organizations, and companies developing data products should assess which activities and programs fit their plans.

Why Vietnam Issued Decree 386

Vietnam’s Data Law already provides the legal foundation for developing and using digital data. Decree 386 adds specific mechanisms to help turn data into products and services, including coordinated access, shared research facilities, controlled testing, and support for commercialization.

For a foreign business, the opportunity is to connect product development with data and facilities that it may otherwise struggle to obtain. The decree also connects qualifying research and testing results with public procurement. Other applicable Vietnamese laws continue to govern the collection, sharing, protection, and use of data in these activities.

Quick Reference

Decree 386 provides support for qualifying data innovation activities across Vietnam and for participants in programs operated through the Center. Foreign participation is expressly included, but eligibility depends on the activity, applicant, and program. A company developing a data product may qualify differently from a startup entering the National Data Incubator or a business seeking access to a particular dataset.

The questions are whether the company can obtain the data it needs, what it may do during testing, which costs qualify for support, and how it can sell the resulting product. Each permission has its own conditions. Participation also brings continuing responsibilities for security, records, and the handling of data when the project ends.

7 Legal Issues for Data Innovation in Vietnam

Foreign Participation Depends on the Activity and Program

The decree includes foreign organizations and individuals connected with data innovation activities in Vietnam. It also expressly permits foreign cooperation with the Center in controlled testing and qualifying incubation activities. This gives foreign businesses a reason to assess participation before assuming the programs are limited to domestic companies.

However, the National Data Incubator has defined participant categories. These include qualifying young innovative businesses, science and technology organizations, researchers, and other participants meeting prescribed criteria. An established foreign group should identify which entity and project meet those criteria, rather than assume that its size or technology qualifies it for every benefit.

Program admission also serves a different purpose from business licensing. A company planning to sell data services, operate infrastructure, or establish a local business still needs to assess the permissions for that activity. Its Vietnam market entry strategy should identify who will sign the cooperation agreement, incur the costs, and earn the revenue.

Data Access Has a Defined Purpose and Period

The decree provides a coordinated electronic process for requesting data. The request identifies the applicant, intended use, data required, and period of access. Protected or restricted data can require additional safeguards and involvement from the authority responsible for it. Joining a program does not give a business unrestricted access to national databases.

This affects product design. The company should confirm whether the available data is sufficiently complete, current, and detailed for its intended use. Access may be limited to anonymized or aggregated information, or may require data to be processed within a secure environment. The technical team needs to understand those limits before promising a service to customers.

Buying data through an exchange is a separate transaction. The rules on data exchange transactions in Vietnam address the rights offered, permitted use, and transaction records. Neither program participation nor a purchase settles whether headquarters or an overseas supplier may access the data.

Controlled Testing Has Limits Before Commercial Launch

The Center’s controlled testing mechanism covers new data products, services, technologies, and business models where the law is absent or incomplete. Foreign participants need a specific cooperation contract or agreement with the Center and must meet the conditions under data legislation.

Testing takes place within an approved scope and period. The initial testing period may not exceed three years. An extension may be granted once, subject to the applicable statutory conditions and the maximum extension period prescribed by law.

Participants need risk controls, monitoring, activity logs, and arrangements for inspection or audit. Testing may be suspended or stopped where the prescribed security or legal risks arise.

The commercial timetable should therefore allow for a decision after testing. Successful results can support recognition and commercialization, but the company still needs the permissions required for wider operation. Customer contracts should reflect that position, especially where delivery depends on approval to move beyond the trial.

Financial Support Depends on the Project and Eligible Costs

The decree provides concrete support for enterprises carrying out qualifying research, technology innovation, digital transformation, and data product projects. The project must have been approved, confirmed, or validly accepted by the competent authority under the decree.

For eligible projects in this category, support may cover 50% of data access fees for 24 months from the applicable approval, confirmation, or acceptance date. Eligible costs for data integration, connection, synchronization, analysis, processing, and protection may also qualify for support of up to 50%, subject to the applicable annual cap of VND 2 billion per project. Other participant categories have different arrangements.

These figures can affect the project budget, but eligibility and payment procedures need to be settled first. The funding source, approved costs, and supporting documents determine what the business can claim. Where the specified support categories overlap, the decree provides for the highest applicable benefit rather than cumulative support for the same activity. A foreign investor should confirm the applicant’s eligibility before treating support as committed funding.

Incubation Can Help a Business Reach Public-Sector Customers

The decree addresses a difficulty for businesses selling new technology: a useful product may have little sales history or evidence of previous contracts. Qualifying National Data Incubator members can benefit from exemptions from certain revenue and operating-history requirements when competing for covered digital, data, and artificial intelligence procurement. This relief applies for six years from the date on which the product first enters production and satisfies the applicable conditions for lawful market entry.

Recognized results from completed testing or research and development orders can also count toward similar-contract experience in the cases specified by the decree. The business should keep the formal confirmation, testing results, and acceptance records needed to support that position. The benefits depend on the participant, product, procurement, and relevant period; they do not guarantee an award.

Foreign suppliers considering a tender covered by Vietnam’s trade agreements should separately assess government procurement affecting foreign bidders. Incubation status does not establish treaty coverage or settle every bidder condition. The tender documents remain important when deciding which entity and product to offer.

Data Protection Duties Continue Throughout the Project

Participants must protect data throughout collection, storage, processing, and use. The decree requires records of access and processing, timely reporting of incidents or violations, and steps to contain problems and preserve evidence. When the permitted purpose or access period ends, data must be returned, deleted, or destroyed as required, subject to legal exceptions.

Before implementation, cooperation with foreign organizations involving data use, processing, or access to data systems under the Center’s international cooperation framework must undergo a security and data safety risk assessment. Access controls and monitoring continue during the work. The parties should agree who supplies the information and implements the controls needed for that assessment.

Breaching access conditions can lead to suspension or withdrawal of access, affecting the project’s ability to operate. Separate rules on penalties for data violations and personal data protection penalties may also apply, depending on the conduct. The project agreement should give the business prompt access to incident information held by its partners and suppliers.

Contracts Need to Protect Results and Address Project Exit

Incubation comes with responsibilities as well as support. Participants must improve data within their lawful scope of access and share specified processing results, analyzed or aggregated data, technical documents, and other enrichment results with the Center under its rules. The Center must protect confidential information, business secrets, and research results. It cannot use the shared data to develop directly competing products without the participant’s written consent; other uses must be addressed in the cooperation agreement.

The business should settle those terms before sharing its technology. The agreement needs to distinguish existing software and know-how from results created during the project, and explain ownership, licensing, permitted disclosure, and commercialization. These issues should form part of the company’s intellectual property assessment under Vietnamese law.

The contract should also address interrupted access, rejected results, costs, and termination. If the relationship ends, the parties need clear arrangements for lawful data return or deletion and any rights that continue. Keep approvals, agreed changes, delivery records, and acceptance documents together. They can become essential evidence for contract disputes in Vietnam if the parties disagree about what was promised or completed.

Frequently Asked Questions

Q1. Must a foreign company establish a Vietnamese subsidiary to participate?

There is no single answer for every activity. The decree expressly includes foreign participants, while particular programs have their own eligibility requirements. The business should assess its proposed entity, local presence, and intended commercial activity together. Participation alone does not authorize every service it may wish to sell.

Q2. Can data obtained through the program be sent to an overseas group company?

Only where the proposed use and transfer meet the relevant conditions. Check the access permission, data category, recipient, and overseas processing arrangements. A cooperation agreement does not remove cross-border data requirements, and common ownership does not by itself permit sharing.

Q3. Does completing a trial give the company permission to launch commercially?

No. Successful testing can support recognition, procurement eligibility, or further commercial development. The company must still confirm the permissions and conditions for its proposed launch, including any continuing right to use the underlying data.

Conclusion

Before committing to a data project, put the proposed product, required datasets, participating entity, and expected customers into one short brief. Use it to confirm program eligibility, access conditions, and the terms of cooperation. Resolving those questions before signing helps the business judge whether the available support fits a product it can lawfully develop and sell.

About the Author

Hanh Pham is a Legal Research Specialist at ANT Lawyers with more than 10 years of experience, supporting legal teams through regulatory research, authority liaison, documentation review, and knowledge development. She has been trained in corporate, civil law and related areas. This article has been reviewed by Tuan Nguyen, Managing Partner, ANT Lawyers; member of the Hanoi Bar Association and Vietnam Bar Association.

About ANT Lawyers, a Law Firm in Vietnam

Founded in 2012, ANT Lawyers is a Vietnam law firm with offices in Hanoi, Ho Chi Minh City and Da Nang. Our data compliance lawyers advise on personal data protection, data processing, cross-border data transfers, cybersecurity and compliance requirements in Vietnam. We combine legal analysis with practical understanding of Vietnam’s regulatory environment and local administrative practice.

General Disclaimer

This article is for general informational purposes only, does not constitute legal advice, and does not create a lawyer-client relationship. Vietnamese laws, regulations and administrative practice change over time, and the correct position for any matter depends on its specific facts and the rules in force when action is taken. Verify the current position before relying on anything stated here, and consult qualified counsel on your specific situation.