 |
| At the Khanh Hoa Data Centre__Photo: Xuan Trieu/VNA |
Government Decree 314/2026/ND-CP on operation of data exchanges, specifies that organisations being Vietnamese legal persons may participate in data exchanges if they have been lawfully established and operating within Vietnam’s territory and are not currently undergoing division, splitting, consolidation, merger, dissolution or bankruptcy procedures.
Foreign legal entities can join data exchanges if they have been lawfully established, meet the law-specified conditions, and maintain Vietnam-based commercial presence in accordance with Vietnam’s law or treaties of which Vietnam is a member state.
All participating individuals must have full civil act capacity as required by law while organisations providing data products and services on the list of conditional business lines must possess business eligibility certificates.
Decree 314 also stipulates that the operation of data exchanges must comply with the law on personal data protection. It prohibits taking advantage of data exchanges to buy, sell or process personal data in contravention of law.
Data products or services originating from personal data may only be traded or auctioned on the exchanges when meeting de-identification conditions and other requirements specified in the law on personal data protection.
Auction service providers may refuse to organise auctions for personal data, data not yet permitted for transaction, and data, data products or data services showing signs of violation of the law on personal data protection.
In addition to personal data protection requirements, the decree mandates ensuring cybersecurity, data security and the protection of data classified as state secrets during transactions and storage on data exchanges.
Data obtained from national databases or specialised databases may only be traded if they do not disclose state secrets or personal information, or are not subject to access restriction or sharing ban.
The decree also requires data exchange service operators to suspend the provision of information, data, or data products or services that show signs of law violation or remove violating content and notify thereof to concerned parties.- (VLLF)
