Vietnam’s emergence as a hub for artificial intelligence (AI) innovation presents compelling investment opportunities for businesses. The rapid advancement of AI applications, ranging from predictive analytics to automated processes, is transforming the Vietnamese economy across various sectors such as finance, manufacturing, agriculture, healthcare, transportation, and customer service. However, the increasing reliance on personal data in these applications necessitates a robust legal framework to safeguard individual privacy and maintain public trust.
This article aims to provide investors and businesses with a comprehensive update of Vietnam’s legal landscape for investments in AI sector, and the interplay between the nation’s ambitious AI development goals and its increasingly stringent personal data protection regulations.
1. DEVELOPMENT OF AI REGULATIONS IN VIETNAM
1.1. Policy framework
On 27 September 2019, the Political Bureau issued Resolution No. 52-NQ/TW on a number of policies for Vietnam’s proactive engagement in the Fourth Industrial Revolution (Industry 4.0). In this Resolution, AI is highlighted as one of the cornerstone technologies for socio-economic transformation of the country.
Subsequently, on 26 January 2021, the Prime Minister issued Decision No. 127/QD-TTg, setting out the national strategy for AI research, development and application by 2030. Specifically Vietnam targets to position itself among the top 4 in ASEAN and the top 50 in the world in this field by the year of 2030. Key objectives of this strategy include: (i) establishing a robust legal framework to support AI governance and innovation; (ii) developing state-of-the-art infrastructure; (iii) fostering a vibrant AI ecosystem by way of creating skilled workforce through education and training programs, providing incentives for investments in AI start-ups and R&D, etc.; (iv) promoting the adoption of AI in a wide array of sectors such as healthcare, education, finance, transportation, manufacturing, agriculture, etc.; and (v) encouraging collaboration between domestic and international stakeholders.
This commitment to AI development continues through subsequent high-level directives, such as Resolution No. 29-NQ/ TW dated 17 November 2022 of the 13thParty Central Committee on acceleratingthe national industrialisation and modernisation by 2030 with a vision towards 2045, Resolution No. 57-NQ/TW dated 22 December 2024 of the Political Bureau on the breakthrough development of science, technology, innovation, and national digital transformation, etc. These, along with other government decisions, underscore the importance of AI transformation. Investors are therefore well advised to closely monitor these policy developments to stay informed, ensure compliance, and effectively capitalise on opportunities.
1.2. Draft Law on Digital Technology Industry
With the aim of establishing a comprehensive legal framework to pave the ways for emerging digital technologies like AI, big data, cloud computing, IoT, blockchain and virtual/augmented reality, the Ministry of Information and Communications introduced the Draft Law on Digital Technology Industry (“Draft DTI Law”) for public consultation on 03 July 2024. The consultation period for this Draft DTI Law has now expired, and the official version is expected to be promulgated soon. Notably, an entire Section 5 of Chapter IV of the Draft DTI Law is specifically dedicated for AI-related regulations.
Some notable points of the Draft DTI Law are as follows:
- Newly-introduced definitions: Definitions for “AI” and “AI system” are introduced in the Draft DTI Law.
- Policy incentives: The Draft DTI Law offers a wide range of incentives on investment, taxation, credit, land use or rental fees, etc. for digital technology enterprises and projects, including those in the AI sector. Although they are still general and policy-oriented at this stage, it is expected that the competent authorities will issue detailed regulations on the specific incentives along with the eligibility criteria in specialised legal frameworks, such as laws on investment, taxation, land, etc., in the near future.
- Ethical standards, prohibited AI practices and risk-based approach: For the purpose of striking a balance between encouraging innovation and mitigating the potential risks associated with AI, the Draft DTI Law introduces provisions on ethical standards, prohibited AI practices and adopts a riskbased approach to govern AI systems.
The Decree 13 provides a detailed definition of personal data and differentiates between basic and sensitive personal data. It also introduces key roles involved in the personal data processing activities, including data controller, data processor, data controller and processor, and third party
- Regulatory sandbox: SMEs, including those providing AI systems, are encouraged to participate in the regulatory sandbox mechanism established under the Draft DTI Law. The testing period, based upon the current draft, is 2 years (and may be extended) from the date of approval by the competent authority. Apart from other rights and responsibilities prescribed under the Draft DTI Law, it is worth noting that enterprises participating in the sandbox are granted immunity from civil liability for any damage inflicted on the state and are exempt from administrative and criminal liability, provided that they strictly observe the provisions and requirements outlined in the approval document issued by the competent authority. This exemption, however, shall not apply in case the enterprise knew or should have known about the potential risks but failed to promptly inform or report to the competent authority and did not implement adequate measures to prevent or mitigate possible damages.
1.3. Decree No. 182/2024/ND-CP on Investment Support Fund
On 31 December 2024, the Vietnamese Government issued Decree No. 182/2024/ ND-CP (“Decree 182”), which takes effect on the same day, regarding the establishment, management, and utilisation of the Investment Support Fund (“ISF”). This Decree 182 aims to provide financial support, in the form of either annual cost support or initial investment cost support, to high-tech enterprises and investment projects, including those engaged in the AI sector, starting from the 2024 fiscal year.
Eligible entities under the Decree 182 include (i) high-tech enterprises; (ii) enterprises with investment projects for manufacturing hightech products; (iii) enterprises with high-tech application projects; and (iv)enterprises with investment projects for R&D centers.
The ISF offers financial support through direct cash grants for eligible items, including (i) HR training and development costs; (ii) R&D costs; (iii) fixed asset investment costs; (iv) hightech product manufacturing costs; (v) social infrastructure investment costs; and (vi) other costs as determined by the Government.
2. DEVELOPMENT OF PERSONAL DATA PROTECTION REGIME IN VIETNAM
2.1. Decree No. 13/2023/ND-CP on personal data protection
In 2018, the European Union’s General Data Protection Regulation (GDPR) officially came into effect, establishing one of the strictest data protection regulations in the world and setting a precedent for privacy and data laws globally, including in Vietnam.
On 17 April 2023, the Vietnamese Government issued Decree No. 13/2023/ND-CP on personal data protection (“Decree 13”). This marks a significant milestone in Vietnam’s efforts to develop a legal framework for personal data protection and to align with international best practices in safeguarding individual privacy.
The Decree 13 provides a detailed definition of personal data and differentiates between basic and sensitive personal data. It also introduces key roles involved in the personal data processing activities, including data controller, data processor, data controller and processor, and third party. Under the Decree 13, the processing of personal data requires consent from data subjects, except in certain
special cases. Additionally, parties involved in the personal data processing must develop internal policies regarding personal data protection, appoint a personal data protection department and officer, submit impact assessment dossiers on personal data processing and cross-border transfer of Vietnamese citizens’ personal data (if applicable) to the competent authority, and fulfill other obligations as prescribed by law.
2.2. Draft Law on Personal Data Protection
On 24 September 2024, the Ministry of Public Security released the Draft Law on Personal Data Protection (“Draft PDPL”) for public feedback (with the consultation period now expired). This Draft PDPL aims to establish a comprehensive legal framework to address limitations of the Decree 13, and respond to practical requirements for personal data protection. The Draft PDPL is expected to be promulgated in May 2025 and come into effect in 2026.
Investors and businesses involved in AI and personal data processing must adopt a proactive ap-proach to compliance to mitigate risks, build trust with customers, and capitalise on the signifi-cant growth opportunities within Vietnam’s dynamic AI market
Key notable points in the Draft PDPL compared to the Decree 13 include:
- New parties involved in personal data protection: The Draft PDPL introduces new parties involved in personal data protection activities, including (i) developer related to personal data protection; (ii) personal data protection organisation; (iii)
personal data protection expert; (iv) organisation issuing certification for sufficient capabilities in personal data protection; and (v) personal data protection credit rating organisation.
- New provisions of personal data protection in specific sectors: The Draft PDPL introduces new provisions governing data protection in specific sectors, including marketing, behavioral advertising, big data, AI, cloud computing, banking and finance, health and insurance, etc. Businesses in different sectors will be required to comply with varying personal data protection requirements. For example, in the context of AI, the Draft PDPL allows organisations and individuals to utilise personal data for
research and development of machinelearning algorithms, artificial intelligence and other automated systems, provided
that they must (i) serve notice on the data subjects (which must contain clear explanations on the impacts of the algorithm, artificial intelligence or automated system on legitimate rights and interest of the data subjects), and (ii) offer the data subjects the right to opt out.
- Updating the impact assessment dossiers: The Draft PDPL requires the impact assessment dossiers on personal data processing and cross-border transfer of Vietnamese citizens’ personal data to be updated every six months if there are any changes, and immediately in specific circumstances, such as company dissolution or mergers.
Recently, on 04 March 2025, the Vietnamese Government issued Resolution No. 41/NQ-CP, in which the Government requires the Ministry of Public Security to supplement provisions in the Draft PDPL allowing for the application of provisions in specialised laws that stipulate higher levels of personal data protection than those proposed in the Draft PDPL. Under this Resolution, the Government is assigned to issue detailed provisions relating to the administrative procedures and business conditions stipulated in the Draft PDPL. Consequently, a guiding decree for the Draft PDPL is also anticipated in the near future.
2.3. Decrees on administrative sanctions
In May 2024, the Government introduced the appraisal dossier for the Draft Decree on Cybersecurity Administrative Sanctions (“Draft DCAS”), which includes provisions concerning personal data protection violations in Section 2 of Chapter II. Under the Draft DCAS, violations against personal data protection regulations may be subject to monetary fines of up to 5% of the company’s total revenues in Vietnam for the previous fiscal year. In addition to these hefty fines, the Draft DCAS introduces a wide array of supplementary sanctions, such as suspension of business licences or operations for up to 24 months and temporary or fixed-term suspensions on data processing for up to 3 months. This Draft DCAS is expected to be passed after the issuance of the official version of the Draft PDPL.
Additionally, on 21 February 2025, the Government issued Decree No. 24/2025/ ND-CP (“Decree 24”), amending and supplementing, among others, Article 46 of Decree No. 98/2020/ND-CP dated 26 August 2020 regarding violations against regulations on the protection of consumers’ information. In particular, the Decree 24 increases the penalties in general, expands the details of violations related to the protection of consumers’ information, and introduces more severe penalties for instances where the concerned information is sensitive personal data of consumers.
In conclusion, Vietnam’s focus on both AI development and personal data protection creates a complex yet manageable legal environment. Investors and businesses involved in AI and personal data processing must adopt a proactive approach to compliance to mitigate risks, build trust with customers, and capitalise on the significant growth opportunities within Vietnam’s dynamic AI market.
Nguyen Xuan Thuy, Partner, LNT & Partners
Email: thuy.nguyen@lntpartners.com
Mr Thuy, with over 18 years of experience in legal practice, is a Partner at LNT & Partners.
He has successfully advised a number of foreign investors, multinational companies, domestic companies and regulatory agencies in Vietnam on mergers and acquisitions, corporate matters, education, labour, real estate, personal data protection law and dispute resolution.
Ho My Ky Tan, Associate, LNT & Partners
Email: kytan.ho@lntpartners.com
Ms Tan is an Associate of LNT & Partners, specialising in M&A and corporate matters.
She adopts a practical approach to M&A, focuses on corporate governance, and offers valuable advice for compliance with personal data protection law for clients.
