Updated: 23 September 2026<\/p>\n
From 15 September 2026, earlier guidance on certificates of eligibility for data analysis and aggregation products and services should not be applied unchanged. Decree No. 347\/2026\/ND-CP amends Decree No. 169\/2025\/ND-CP, repealing certain conditions, procedures and forms while adjusting the regulatory scope and notification duties.<\/p>\n
Article 9 of Decree No. 347 repeals Article 28(1), Article 29 and Forms TK03, TK07, GCN03 and QD03 of Decree No. 169 relating to the previous data analysis and aggregation certificate regime. A dossier prepared using the old TK03 should therefore be reviewed before use.<\/p>\n
However, Article 8 of Decree No. 347 also expands many references from data intermediation to data intermediation, analysis and aggregation. Reading only the repeal provisions does not justify concluding that every analytics activity is free of procedures or conditions.<\/p>\n
Article 23(3) of Decree No. 169, as reworded by Decree No. 347, must be checked for data intermediation, analysis and aggregation products and services between users and state authorities. Registration and licensing mechanisms in these provisions still require consideration.<\/p>\n
Amended Articles 36\u201337 and forms address authority and corresponding dossiers. Under Article 3 of Decree No. 347, authority rests with the Ministry of Public Security; the Minister assigns the state data management unit to implement it. Form TK02 has been updated for the expanded scope. Identify the service model before choosing a form rather than use the commercial label analytics to determine the procedure.<\/p>\n
Article 1 of Decree No. 347 amends Article 31(5) of Decree No. 169: organisations providing data analysis and aggregation products and services must notify the National Data Centre before operating. Those already operating before the Decree's effective date must notify within 20 working days after that date.<\/p>\n
Organisations must also submit annual reports using Form BC01 before 20 December. The reporting period runs from 15 December of the previous year through 14 December of the reporting year. Notices and reports may be submitted in person, by post or online as prescribed. Track the transitional 20-working-day period using the actual calendar; do not treat it as 20 consecutive days.<\/p>\n
Article 28(3) of Decree No. 169 excludes analysis and aggregation for internal use and products or services governed by other laws, subject to its conditions. Businesses should substantiate internal use through users, contracts, revenue sources and delivery of results.<\/p>\n
Articles 28(2) and 30 also provide product and service appraisal and certification mechanisms, including for access to incentives and support. Distinguish these from the repealed business certificate. Data exchange activities under Articles 32\u201335 are also separate: organising data transactions goes beyond preparing analytical reports.<\/p>\n
A company building a sales dashboard for its departments should check the internal-use exclusion. If it sells analytics to customers, assess notification duties and rules for that model. If the service connects users with state authorities, also assess the amended registration and licensing scope. Processing personal data may independently trigger duties under Decree No. 356.<\/p>\n
Changes to business procedures do not create a right to exploit every data source. A seller of market reports must establish whether inputs were lawfully obtained, whether individuals remain identifiable and whether supplier contracts permit the purpose. If the activity falls within personal data processing services under Article 21 of Decree No. 356, assess that Decree's separate certification regime.<\/p>\n
Transactions organised through a data exchange must also be distinguished from analytics services. Decree No. 314\/2026\/ND-CP on data exchanges takes effect on 25 September 2026 and is not yet applicable at this article's 23 September 2026 cut-off. Businesses planning to operate after that date must check the corresponding regime rather than use the repeals in Decree No. 347 to draw conclusions about their entire model.<\/p>\n
Before preparing procedures, ask whether the customer is buying analytical results, outsourcing personal data processing or participating in data transactions. A clear description of the product and data flows helps identify the correct rules, forms and receiving authority.<\/p>\n
Can we say that data analytics licensing has been abolished? That is too broad. Identify the repealed mechanism and provisions and explain the remaining duties.<\/strong><\/p>\n Does issuance take only five working days? The five-day period in the amended process is one stage after relevant opinions are received, not a guarantee for the entire process from submission.<\/strong><\/p>\n Data Law No. 60\/2024\/QH15<\/a><\/p>\n Decree No. 169\/2025\/ND-CP on data products and services<\/a><\/p>\n Decree No. 347\/2026\/ND-CP amending Decree No. 169<\/a><\/p>\n Decree No. 356\/2025\/ND-CP implementing personal data protection requirements<\/a><\/p>\n Decree No. 314\/2026\/ND-CP on data exchanges \u2014 effective from 25 September 2026<\/a><\/p>\n Sources checked through 23 September 2026.<\/em><\/p>\n Article 07 Vietnam Data Law and the Classification of Core and Important Data<\/a><\/p>\n Article 09 Certification for Personal Data Processing Services in Vietnam<\/a><\/p>\n Article 05 Overseas Cloud and CRM Services and Vietnam Data Transfer Filings<\/a><\/p>\nLegal sources<\/h2>\n
Related articles<\/h2>\n