Vietnam Decree No. 314/2026/ND-CP on Data Exchange Transactions: FDI Impact

From September 25, 2026, Decree 314 will regulate the listing, testing, contracting, delivery, and traceability of data products and services on regulated exchanges. Its timing reflects Vietnam’s shift from treating data as a strategic resource to enabling controlled commercial use. It also addresses a practical gap and starts to standardize exchange process for showing where data came from, who could license it, and what buyers could do with it. Decree 314 supports the Data Law and National Data Strategy with rules centered on lawful origin, defined rights, privacy, cybersecurity, and traceability.

Decree 314 focuses on regulated data exchange activities, while broader obligations under Vietnam’s Data Law and personal-data rules continue to apply.

What Changes Under Decree 314

Participation follows eligibility and verification rules. Vietnamese entities must be lawfully established and outside specified restructuring, dissolution, or bankruptcy procedures. Foreign legal entities need lawful establishment and a qualifying commercial presence, branch, or representative office in Vietnam. Foreign participants with level-2 VNeID use the Vietnamese registration route; those without it use Form DK01 with certified or consular-legalized documents, subject to applicable exemptions.

Decree 314 identifies the National Data Exchange, which the National Data Center under the Ministry of Public Security will build, manage, and operate.

A seller must prove lawful origin and authority to license the data. Listings must disclose technical characteristics, quality, limitations, price, and licensed-use scope, including purpose, term, exclusivity, and any territorial, intellectual-property, or onward-transfer limits. Intermediary review does not shift responsibility from the seller or replace operator approval.

Personal data remains outside ordinary trade. Decree 314 prohibits buying or selling it through an exchange or processing it unlawfully. Derived products may be transacted only after de-identification and compliance with other personal-data rules. The Vietnam Personal Data Protection Law still governs the underlying processing; a listing does not authorize collection, disclosure, combination, or reuse.

Transactions are electronic and traceable. Contracts must address the product, quality, permitted use, price, delivery, confidentiality, liability, disputes, and termination. Both parties must confirm them using a public digital signature, a secure specialized electronic signature, or another method permitted by the exchange’s rules. Payments must be non-cash, made in Vietnamese dong, and routed through a provider or intermediary on the exchange’s published list. Data is delivered only after the electronic contract takes effect and the buyer has completed payment. The operator retains records and traceability logs for at least ten years and confirms use rights without creating or confirming data ownership.

Controlled testing is available before purchase. A buyer may assess a product in an isolated environment for up to 30 days. Complex or large-volume products may receive an extension, but total testing cannot exceed 60 days. Original seller data cannot be downloaded, copied, or extracted, and outputs undergo technical review. Each party remains responsible for its data and later use of results.

Why the New Framework Matters to Foreign Investors

For management, an exchange transaction is not simply a technology purchase. It is a licensing and governance decision requiring evidence of origin, rights, quality, permitted use, and compliance with the wider Data Law.

Foreign groups should distinguish participation from operation. Qualifying foreign entities may buy or sell, but Decree 314 does not change rules reserving exchange operation to qualifying public service units and state-owned enterprises. Investors considering data infrastructure, intermediary services, or analytics should assess foreign ownership and market access in Vietnam for each revenue activity.

Cross-border use remains a separate issue. Parties remain subject to data, personal-data, cybersecurity, and related laws; completing an exchange transaction does not clear offshore processing or onward transfer to an overseas affiliate.

What Companies Should Review Before September 25, 2026

• Confirm the participating entity, role, and authorized signatory. Identify which group entity will act as seller or buyer, who may bind it, and which electronic confirmation method will be used.
• Prepare evidence of data origin and licensing authority. Sellers must retain contracts, consents, creation records, licenses, authorizations, and technical records supporting the data’s origin and available rights.
• Define permitted use before buying. Buyers must translate the agreed purpose, term, territory, copying limits, and onward-transfer restrictions into controls for employees, affiliates, AI systems, and vendors.
• Check which other legal requirements apply. Before listing, testing, or purchase, the company must identify personal data, re-identification risks, non-tradable data, intellectual property, confidential information, and cross-border processing requirements.
• Create an internal approval process. Management should require legal, data, security, finance, and business owners to approve higher-risk transactions and align commercial purpose, delivery, and recorded rights.
• Strengthen contract terms on acceptance and remedies. Management should define quality, testing, security responsibility, correction or replacement, refunds, indemnities, evidence preservation, governing law, and disputes. Weak drafting can turn uncertainty over origin, quality, or misuse into technology disputes in Asia.

Frequently Asked Questions

Q1: Can an overseas company participate without incorporating a Vietnamese subsidiary?

Potentially. A lawfully established foreign legal entity may participate if it has a qualifying commercial presence, branch, or representative office in Vietnam under Vietnamese law or an applicable treaty. Each local presence does not automatically have authority to conduct every revenue-generating activity, so its role still requires review.

Q2: Can personal data be sold after it is listed on a data exchange?

No. Personal data cannot be bought or sold through a data exchange. A derived product may be transacted only after proper de-identification and satisfaction of all other personal-data requirements. Re-identification risk must be assessed.

Q3: Does data-exchange approval protect the parties from later liability?

No. Operator and intermediary checks do not remove seller responsibility for origin, authority, quality, and technical compliance or the buyer’s duty to stay within permitted use. Operators may suspend risky transactions or remove noncompliant listings; contractual remedies and compensation for actual loss may apply. Other laws may also apply. Decree 314 contains no standalone administrative-fine schedule.

Immediate Management Priority

Decree 314 turns data commercialization through regulated exchanges into a documented, traceable process. Before September 25, 2026, management should identify planned transactions, confirm the participating entity, and verify lawful origin and licensing rights. Commercial value depends on clear rights, reliable quality, and compliant use.

About the Author

Hanh Pham is a Legal Research Specialist at ANT Lawyers with more than 10 years of experience, supporting legal teams through regulatory research, authority liaison, documentation review, and knowledge development. She has been trained in corporate, civil law and related areas.

About ANT Lawyers, a Law Firm in Vietnam

Founded in 2012, ANT Lawyers is a Vietnam law firm with offices in Hanoi, Ho Chi Minh City and Da Nang. Our data and technology lawyers advise foreign investors, company directors and in-house legal teams on Vietnam’s data regulations, technology transactions, personal data protection and related compliance risks. We help management understand how new legal requirements may affect commercial decisions, contracts and business operations in Vietnam.

General Disclaimer

This article is for general informational purposes only, does not constitute legal advice, and does not create a lawyer-client relationship. Vietnamese laws, regulations and administrative practice change over time, and the correct position for any matter depends on its specific facts and the rules in force when action is taken. Verify the current position before relying on anything stated here, and consult qualified counsel on your specific situation.