Official Letter No. 6661/QNG-QLDN1: Determining personal income tax withholding obligations for income paid after the termination of employment contracts

,

On 6 August 2026, the Tax Department of Quang Ngai Province (the “Tax Authority“) issued Official Letter No. 6661/QNG-QLDN1 (the “Official Letter“) guiding personal income tax (PIT) withholding on income paid after the termination of employment contracts.

In this Official Letter, based on the legal grounds governing personal income tax withholding under the Law on Personal Income Tax 2025 and Decree No. 253/2026/ND-CP, the Tax Authority provides guidance that where an enterprise or organization makes payments of salaries, wages, remuneration, or other amounts to individuals whose employment contracts have been terminated, and the income paid is VND 5 million or more per payment, the enterprise or organization is required to withhold and remit PIT at the rate of 10% of the income before making the payment to such individuals.

Furthermore, if the former employee earns income solely subject to the withholding rate mentioned above but estimates that their total taxable income after family circumstance deductions falls below the taxable threshold, the employee may submit a commitment letter to the income-paying organization. This commitment serves as a basis for the organization to temporarily refrain from withholding PIT. The employee assumes full responsibility for their commitment letter; any fraud detected by the managing tax authority will be handled in accordance with the law.

Based on the guidance in this Official Letter, ALIAT recommends that enterprises carry out the following necessary actions:

  • Review and identify post-termination payments to check whether the enterprise incurs any instances where income must be paid to employees after contract termination.

If applicable, the enterprise must declare and withhold 10% PIT on the income before disbursing it to the employee.

  • In cases where former employees estimate their total taxable income after family circumstance deductions will not reach the taxable threshold, the enterprise must request a written commitment letter containing all legally required content; and this document must be retained at the company headquarters for future tax declaration and finalization audits.

Official Letter No. 2265/CST-GTGT: Enhanced scrutiny for the application of the 0% VAT rate to exported services

,

On 4 August 2026, the Department of Tax, Fee and Charge Policy Management and Supervision issued Official Letter No. 2265/CST-GTGT (“Official Letter 2265”), providing guidance on supporting documents required to substantiate eligibility for the 0% VAT rate applicable to services supplied to foreign organizations and individuals and consumed outside Vietnam.

The documentation requirements differ depending on when the relevant transactions arise, as follows:

For exported services arising before 1 July 2025

For transactions arising before 1 July 2025, businesses are required to provide:

  • a service provision agreement;
  • bank payment documents; and
  • documents evidencing that the services were performed outside Vietnam.

For exported services arising from 1 July 2025

For transactions arising from 1 July 2025, businesses are required to provide:

  • a service provision agreement with the relevant foreign organization or individual;
  • non-cash payment documents; and
  • other supporting documents as may be required by the competent State authorities.

Accordingly, in certain cases, the tax authorities may require businesses to provide additional documents and information to verify their eligibility for the 0% VAT rate.

Particular attention should be paid where a business supplies digital information content products to a foreign customer, such as text, data, images or audio in digital form that are stored or transmitted over a network environment. For these products, businesses must retain and provide documents and information evidencing that the products are consumed outside Vietnam, including:

  • information regarding the foreign customer’s residence or location, such as billing address, delivery address, registered office address, residential address or other similar information; and
  • information evidencing access from outside Vietnam, such as the country calling code associated with the SIM card, IP address, location of a fixed telephone line or other similar information.

Official Letter 2265 therefore indicates increased scrutiny by the tax authorities over the eligibility for the 0% VAT rate applicable to exported services, with greater emphasis on specific and substantive evidence demonstrating that the relevant services are actually consumed outside Vietnam, rather than relying solely on contractual and payment documentation.

In this context, businesses providing services to foreign customers should review the supporting documentation for transactions currently subject to the 0% VAT rate and maintain sufficient records evidencing the provision and consumption of such services outside Vietnam. For digital information content products, businesses should also establish mechanisms to collect and retain information regarding the foreign customer’s residence or location and access from outside Vietnam, so that such information can be readily provided to the tax authorities upon request.

Decree No. 330/2026/ND-CP: Administrative Sanctions for Personal Data Protection Violations Officially Established – Enterprises Need to Take Immediate Action

,

On 19 August 2026, the Government issued Decree No. 330/2026/ND-CP providing for administrative penalties for violations in the fields of cybersecurity and personal data protection (“Decree 330”), which takes effect from 19 August 2026.

Decree 330 was issued to establish a specific penalty mechanism for violations in the field of personal data protection, thereby strengthening the enforcement and deterrent effect of the regulations on personal data protection. This is an important step in further developing the legal framework in the context where regulations on personal data protection have been progressively developed and applied since 2023, but prior to the issuance of Decree 330, there had been no comprehensive and specific administrative penalty mechanism for each group of violations in this field. Some notable points of Decree 330 include:

Violations of regulations on consent of personal data subjects

To strengthen compliance with the requirement to obtain consent from data subjects before processing their personal data, Decree 330 provides for fines applicable to violations of the consent requirements under two principal penalty brackets:

A fine ranging from VND 30 million to VND 50 million applies to acts such as processing data without consent; setting consent as the default option or providing misleading instructions; making service provision conditional upon consent; failing to separately distinguish each processing purpose; obtaining consent without maintaining logs; or failing to provide notification when processing sensitive personal data.

A higher fine ranging from VND 50 million to VND 70 million applies to intentional acts of continuing to process personal data after the data subject has withdrawn their consent or upon a request from a competent State authority, as well as the act of treating a user’s silence as consent without authorization.

In addition to monetary fines, violating organizations and enterprises may also be subject to additional penalties and stringent remedial measures. The competent authorities may confiscate all material evidence and administrative violation instruments used to commit the violation. At the same time, the violating party may be required to destroy or permanently delete all personal data that has been unlawfully collected and processed in a manner that renders such data irretrievable, and to remit all unlawful proceeds or profits to the State budget.

Accordingly, enterprises should pay attention to default options on forms, clearly separate each processing purpose for which consent is sought, and implement management systems capable of evidencing consent in the event of inspection or examination. Upon receiving a request from a user to withdraw consent, enterprises should have procedures in place to automatically update their systems and immediately cease processing the relevant personal data in order to avoid the risk of penalties and being required to destroy the entire accumulated database.

Violations of regulations on personal data processing impact assessments

To strengthen oversight and ensure compliance during data processing activities, Decree 330 introduces specific sanctions for violations of regulations on personal data processing impact assessments.

Specifically, violations of the obligations to prepare, maintain, submit and update the relevant dossiers are subject to fines ranging from VND 20 million to VND 30 million. This penalty bracket applies to cases where an enterprise commences personal data processing activities but fails to prepare or maintain a Personal Data Processing Impact Assessment Dossier at its headquarters; fails to submit one original copy of the dossier to the Department of Cyber Security and High-Tech Crime Prevention under the Ministry of Public Security within 60 days from the date on which personal data processing is first conducted; intentionally fails to complete the dossier as requested by the competent specialized authority; fails to update the dossier every six months when there are changes; or fails to update the dossier within 10 days in cases where an update is required by law.

In particular, a fine ranging from VND 50 million to VND 100 million applies to intentional acts involving falsification or non-cooperation, including: deliberately falsifying data or providing inaccurate information in the Personal Data Processing Impact Assessment Dossier, or refusing to amend or complete the dossier upon receipt of a written request for remediation from the Department of Cyber Security and High-Tech Crime Prevention.

In addition to monetary fines, violating enterprises may also be subject to stringent remedial measures. Accordingly, the violating organization may be required to prepare, complete and submit the dossier in accordance with the applicable regulations and provide evidence of compliance to the competent authority. Notably, where an enterprise fails to prepare or maintain the dossier at its headquarters, it may be required to suspend all personal data processing activities until it has fully discharged its dossier submission obligations and obtained official confirmation from the specialized personal data protection authority.

Accordingly, enterprises should proactively review all internal personal data processing procedures, prepare and maintain the relevant impact assessment dossier at their headquarters, and ensure that the original dossier is submitted to the Department of Cyber Security and High-Tech Crime Prevention within 60 days from the commencement of personal data processing. In addition, establishing a six-monthly review mechanism and a procedure for updating the dossier within 10 days following a change are mandatory steps to mitigate the risk of administrative penalties and, in particular, the risk of being required to suspend all personal data processing activities.

Violations of regulations on cross-border transfer of personal data

To strengthen control over the transfer of personal data outside the territory of Vietnam, Decree 330 introduces stringent sanctions for violations of regulations on cross-border transfers of personal data.

Specifically, a fine ranging from VND 30 million to VND 50 million applies to acts including: failure to prepare or submit the cross-border data transfer impact assessment dossier within 60 days from the date of the first transfer, failure to complete or update the dossier as required, failure to maintain the dossier readily available for inspection, failure to notify the contact details of the representative of the data recipient, or failure to establish control mechanisms resulting in the data being processed beyond the declared scope.

In particular, a fine ranging from VND 50 million to VND 100 million applies to cases involving failure to enter into a contract or data transfer document establishing binding responsibilities; failure to obtain consent from the data subject or notify the data subject of the transfer of their data overseas; failure to apply appropriate security measures; obstruction of an inspection; continuing to transfer data after being ordered to cease by a competent authority; or failure to report and cooperate in preventing or mitigating damage when a data breach or data loss occurs at the recipient’s end.

Notably, Decree 330 establishes a fine calculated as a percentage of the total revenue generated in the Vietnamese market during the immediately preceding financial year for serious violations, such as failure to prepare the relevant dossier, concealment of data flows, or inaccurate declaration of data flows resulting in the disclosure or loss of Vietnamese citizens’ personal data. The applicable fine ranges from 1% to 2% of revenue for incidents affecting between 10,000 and fewer than 100,000 data subjects; from 2% to 3% of revenue for incidents affecting between 100,000 and fewer than 1,000,000 data subjects; and up to 3% to 5% of revenue where 1,000,000 or more data subjects are affected or national defense or security is threatened. Where the violating organization has no revenue in Vietnam or the fine calculated based on the percentage of revenue is lower than VND 3 billion, fixed fines will apply depending on the scale of the violation, ranging from VND 200 million to VND 500 million, from VND 500 million to VND 1 billion, and from VND 1 billion to VND 3 billion, respectively.

Accordingly, enterprises should review all cross-border personal data transfer activities, prepare and submit the Cross-Border Personal Data Transfer Impact Assessment Dossier using the prescribed form, and ensure timely submission. In addition, reviewing and entering into data transfer agreements containing provisions imposing confidentiality and other responsibilities on the recipient, updating transparent consent mechanisms for data subjects, and establishing procedures for responding to data disclosure or loss incidents occurring at the recipient’s end are mandatory steps to mitigate the risk of fines of up to 5% of revenue or suspension of cross-border data transfer activities.

Violations of regulations on the appointment of personal data protection officer, units

To ensure effective implementation of internal data governance, Decree 330 establishes a legal framework for imposing penalties on violations relating to the appointment of personnel and establishment of personal data protection units.

Specifically, a warning or fine ranging from VND 10 million to VND 20 million applies to acts of failing to enter into confidentiality responsibility agreements with personnel responsible for personal data protection; failing to organize training or professional development; or failing to specify the functions, duties and powers in the appointment document or decision establishing the relevant unit.

In particular, a fine ranging from VND 20 million to VND 30 million applies to more serious violations, including failure to issue a formal document appointing responsible personnel or a decision establishing the relevant unit; appointing personnel who have not received specialized training; or appointing a person who does not satisfy the applicable requirements (i.e., holding at least a college-level qualification or having at least two years of experience in legal affairs, IT, cybersecurity, data security, risk management, compliance control or human resources management).

In addition, violating enterprises may be subject to remedial measures requiring them to issue the necessary appointment documents and regulations specifying the relevant duties, or to replace the responsible personnel with another person who satisfies the applicable legal requirements and submit evidence of such compliance to the competent authority.

A common violation is for enterprises to formally appoint personnel or establish a personal data protection unit without clearly defining its responsibilities, entering into confidentiality agreements, or providing appropriate training. In the event of an inspection, such formalistic appointments may result in penalties and require the enterprise to dismiss the appointed personnel and identify suitable replacements.

Accordingly, enterprises should proactively review all documents relating to the appointment of personnel and establishment of personal data protection units. Issuing a formal decision specifying the functions and duties of the relevant personnel/unit, entering into a separate confidentiality agreement, reviewing the personnel’s qualifications and experience, and proactively organizing professional training and development programs for responsible personnel are mandatory legal steps to prevent the risk of administrative penalties and disruption to internal operations.

Violations of regulations on personal data protection in recruitment and labor management

Under the 2025 Law on Personal Data Protection, enterprises may only require job applicants to provide information that is directly relevant to the recruitment purpose and are required to delete and destroy the personal data of applicants who are not recruited, unless otherwise agreed.

Consistent with this requirement, Decree 330 introduces a detailed penalty framework for violations involving personal data in recruitment and labor management. Specifically, a fine ranging from VND 20 million to VND 50 million may apply to acts of requiring job applicants to provide data that is not relevant to the recruitment purpose, using application data for another purpose without an agreement, processing data beyond the scope of consent, or failing to delete or destroy the data of unsuccessful applicants.

For employees during the employment relationship, the fine increases to between VND 50 million and VND 70 million where an enterprise retains employees’ personal data beyond the statutory or agreed retention period, fails to delete the data upon termination of the employment contract, or unilaterally applies technological measures to monitor or collect data in the workplace, such as installing cameras or device-monitoring software, without providing clear notice to employees. In particular, the act of processing or using data unlawfully collected through technological or technical measures is subject to a fine ranging from VND 70 million to VND 100 million.

In addition to monetary fines, enterprises may be required to permanently destroy or delete all personal data unlawfully collected and remit any unlawful proceeds arising from the violation. Accordingly, automatically retaining applicant records indefinitely or conducting employee monitoring in a non-transparent manner may expose enterprises to significant legal risks.

Accordingly, enterprises should proactively review their internal recruitment and human resources management procedures to ensure legal compliance. During recruitment, the recruitment function should collect only information that is genuinely necessary for the relevant position and establish an agreement allowing the retention of application records for unsuccessful applicants, rather than automatically retaining such records by default. For existing employees, enterprises should issue clear notices or internal regulations governing the use of workplace monitoring technologies, such as cameras and device-monitoring software, and specify the applicable data retention periods and procedures for deleting and destroying personal data upon termination of employment.

Violations involving the unlawful purchase, sale or transfer of personal data

Decree 330 establishes a penalty mechanism based on the amount of unlawful proceeds obtained by organizations engaging in the unlawful purchase or sale of personal data.

Accordingly, a violating organization may be subject to a fine ranging from two to ten times the amount of proceeds obtained from the unlawful purchase or sale of personal data. This means that, if an enterprise unlawfully earns VND 1 billion from secretly selling a customer information list, the fine imposed on that enterprise could be as high as VND 10 billion.

Where the amount of unlawful proceeds cannot be determined, fixed fines ranging from VND 500 million to VND 1 billion apply to unlawful transactions involving basic personal data of 10,000 or more individuals or sensitive personal data of 2,000 or more individuals. A fine ranging from VND 1 billion to VND 3 billion applies to unlawful purchase or sale of personal data that seriously infringes upon core areas such as national defense, national security, social order and safety, foreign affairs or the macroeconomy, or directly threatens the life, health, honor, dignity, property, or lawful rights and interests of other organizations or individuals.

Decree 330 has expanded the regulatory scope to cover most forms of exploitation and trading of information currently occurring in the market. Specifically, providing, sharing or exchanging personal data for material benefit or any other benefit in violation of the law is considered a violation.

In addition, transferring personal data for a fee without a lawful agreement or consent from the data subject, or entering into a data transfer agreement without clearly specifying the purpose or processing the data for a purpose different from the original purpose, is also classified as unlawful purchase or sale of personal data.

Accordingly, enterprises should urgently review all existing activities involving the sharing, exchange or commercialization of customer or partner databases. All data transactions generating revenue or commercial benefits must be based on the user’s clear consent and must apply data de-identification techniques when the data is placed on data trading platforms.

Compliance recommendations

In the context where violations may result in various levels of penalties, and the aggregate amount of fines may become significant if an enterprise simultaneously violates multiple obligations, the enterprise should proactively review and strengthen its compliance system through the following steps:

  • Determine the scope of application, processing roles and exemptions

Clearly determine whether the enterprise acts as the Data Controller, Data Processor or Third Party for each processing activity; and review cases eligible for exemption from or reduction of obligations, particularly exemptions applicable to small enterprises and cases exempt from preparing a cross-border data transfer impact assessment dossier.

  • Establish a data map and legal basis map

Prepare a data map to fully identify personal data flows throughout the entire processing lifecycle, including collection, use, storage, sharing and transfer of data. On this basis, determine the corresponding legal basis for each processing activity, such as consent, performance of a contract, compliance with a legal obligation, or other legal bases as prescribed by law.

  • Review the consent mechanism and procedures for exercising data subject rights

Remove “pre-ticked box” mechanisms or any default assumption that silence constitutes consent. The enterprise should establish a comprehensive tracking table for the deadlines applicable to requests to exercise data subject rights, including cases where such requests are made through a Data Processor or Third Party, the applicable processing period and any extension period. At the same time, the enterprise should maintain complete logs and evidence demonstrating the collection of consent.

  • Establish a personal data incident-response playbook

Develop a standardized procedure covering the process from detection, recording and classification of incidents to harm assessment, reporting/escalation mechanisms and fulfilment of notification obligations within the statutory time limits. In particular, the enterprise should establish mechanisms for controlling and handling incidents within 72 hours to mitigate the risk of penalties.

  • Complete the DPIA and cross-border data transfer assessment dossier (CTIA)

Review, complete and maintain the Personal Data Processing Impact Assessment Dossier (DPIA) and the Cross-Border Personal Data Transfer Impact Assessment Dossier (CTIA) in accordance with the forms and requirements under Decree No. 356/2025, while establishing a mechanism for updating the dossiers when there are changes to processing activities, systems, data recipients or other relevant factors.

  • Review the DPO, DPA and vendor governance mechanism

Ensure that the DPO/personnel responsible for personal data protection fully satisfies the applicable criteria, avoiding merely formal appointments. At the same time, review the Data Processing Agreements (DPAs) and vendor governance mechanisms to ensure that the responsibilities, rights and obligations of the parties in relation to personal data protection are clearly allocated and consistent with the requirements of Decree No. 356/2025.

Decree No. 320/2026/ND-CP: New regulations on electronic identification and authentication

,

On 13 August 2026, the Government issued Decree No. 320/2026/ND-CP amending and supplementing a number of provisions of Decree No. 69/2024/ND-CP dated 25 June 2024 on electronic identification and authentication (“Decree 320”).

Decree 320 does not replace Decree No. 69/2024/ND-CP in its entirety, but amends and expands the mechanisms for electronic identification, data integration and the use of electronic identification accounts in administrative procedures, public services and transactions in the digital environment. Below are some notable provisions of Decree 320:

No requirement to resubmit documents already integrated into VNeID

Decree 320 requires agencies, organizations and individuals, when receiving and handling administrative procedures, public services, civil transactions and other activities, to access and use electronic identities, information and documents already integrated into VNeID; at the same time, individuals and organizations must not be required to submit or present originals or copies of documents and materials that have already been integrated.

This provision has significant practical implications for the digitalization of documents relating to administrative procedures. Where documents have actually been integrated and can be accessed from the system, continuing to require a duplicate set of paper documents is, in principle, no longer appropriate.

However, enterprises need to distinguish between not having to resubmit documents that have already been integrated and obligations to inspect, appraise or retain documents under sector-specific laws. The fact that documents integrated into VNeID do not have to be presented under Decree 320 does not automatically abolish the obligation to retain such documents in accordance with law.

Foreigners may be issued electronic identification accounts without classification by level

Under the previous provisions of Decree No. 69/2024/ND-CP, electronic identification accounts of foreigners were classified into Level 1 and Level 2 accounts, with different conditions, scopes of use and issuance procedures. Eligible persons were basically foreigners who had been issued permanent residence cards or temporary residence cards in Vietnam.

Decree 320 abolishes the classification of electronic identification accounts of foreigners by level, while expanding the eligible persons to foreigners who lawfully enter Vietnam or lawfully reside in Vietnam and have a need to obtain an account.

The procedure for issuance of electronic identification accounts to foreigners is carried out in person at the provincial-level immigration authority. Foreigners present their passports or international travel documents, complete the application form under Form TK01, provide a mobile phone number registered in their own name, an email address (if any), and have their facial images and fingerprints collected. The processing time is shortened to no more than 02 working days if the National Database on Immigration already contains facial image and fingerprint information, or no more than 05 working days if such biometric data is not yet available.

For enterprises having foreign investors, legal representatives, experts or managers, this change may expand the ability to use VNeID in administrative procedures and electronic transactions.

Organizations may be issued electronic identification accounts without classification by level

Agencies and organizations established or registered to operate in Vietnam may also be issued electronic identification accounts upon request without classification by level.

At the same time, the time limit for issuing an account where the organization’s information needs to be verified because it is unavailable in a national database or specialized database is also shortened from no more than 15 days to no more than 10 working days from the date of receipt of a complete and valid application.

VNeID becomes a focal point for carrying out administrative procedures and electronic communications

Decree 320 clarifies the legal validity of electronic information in electronic identification and authentication activities. Accordingly, the use of electronic identity information and information and documents integrated into electronic identity cards, electronic identification accounts or electronic identification and authentication systems has the same legal validity as providing the corresponding information or presenting the corresponding documents when carrying out administrative procedures, public services, transactions and other activities.

An electronic identity holder may use VNeID to create and submit an application for settlement of administrative procedures. The application is transmitted from VNeID to the National Public Service Portal; the processing result is transmitted back from the National Public Service Portal to VNeID for notification to the individual, agency or organization.

In addition to login and authentication functions, Decree 320 also establishes a communication channel on the National Electronic Identification Application for citizens holding Level 2 accounts, foreigners, agencies and organizations holding electronic identification accounts. State agencies, political organizations and socio-political organizations may send notifications and receive feedback and petitions through this channel. Enterprises should therefore consider VNeID as an official information-receiving channel that needs to be assigned for monitoring, rather than merely as a login tool.

Expansion of document integration and data updates on VNeID

Decree 320 establishes a mechanism for automatic synchronization and updating of documents that do not constitute State secrets and are issued by competent agencies or organizations if the database of the issuing agency has been connected to the electronic identification and authentication system. In principle, when information or documents change, the issuing agency must immediately update them. If the document-issuing agency does not yet have a connected database, the electronic identity holder may submit a request for integration through VNeID. Within 05 working days from the date the system receives the request, the competent document-issuing agency must receive, process and approve the integration request in accordance with the guidance of the Ministry of Public Security.

The Appendix enclosed with Decree 320 adds 206 types of documents that may be integrated, including 66 types of documents issued to individuals and 140 types of documents issued to agencies and organizations. For enterprises, this list includes many commonly used documents such as Enterprise Registration Certificates, Certificates of Registration of Branch/Representative Office Operations, Tax Registration Certificates and many sector-specific licences and certificates of satisfaction of business conditions.

The inclusion of a type of document in the list of documents eligible for integration does not mean that the data will immediately be available on VNeID at all times. Actual accessibility still depends on whether the database of the issuing agency has been connected, whether the data has been accurately synchronized and whether the specific document has been updated to the account of the relevant holder.

Mandatory linkage and authentication of electronic transaction accounts with electronic identification accounts

One of the notable changes under Decree 320 is the addition of a requirement to link and authenticate electronic transaction accounts with electronic identification accounts for certain activities on digital platforms.

Accordingly, electronic transaction accounts as prescribed by the law on electronic transactions on digital platforms serving activities in the following sectors must be linked and authenticated with electronic identification accounts:

  • education and digital literacy;
  • securities, telecommunications and banking;
  • e-commerce, including accounts of sellers, livestream sellers and affiliate marketers as prescribed by the Law on E-Commerce;
  • electronic invoices, transport business, tourism business, pharmaceutical business and medical examination and treatment; and
  • social networks in Vietnam.

For electronic transaction accounts on digital platforms serving national defence and security activities or providing cross-border services, linkage and authentication with electronic identification accounts must be completed before use.

Decree 320 provides important transitional deadlines for accounts created before 28 September 2026:

  • No later than 31 December 2026: accounts in the above-mentioned sectors, except for the banking sector, must complete linkage and authentication with electronic identification accounts.
  • No later than 30 June 2027: accounts in the banking sector must complete linkage and authentication.

For this purpose, national digital platforms must integrate the use of electronic identification accounts for authentication, login and transaction purposes no later than 31 December 2026. Enterprises in the regulated sectors should promptly review their login architecture, customer identity verification/authentication processes, terms of use, consent mechanisms and migration plans for existing accounts to avoid concentrating the work at the end of the transitional period.

Enhanced requirements on cybersecurity, transparency in data access and restrictions on data sharing

For agencies and organizations eligible to directly connect their information systems to the electronic identification and authentication system, Decree 320 requires the cybersecurity protection plan of the information system to meet at least Level 3. The connection dossier must clearly state the scope and purpose and include documents evidencing satisfaction of cybersecurity conditions; the system management authority may conduct cybersecurity and information security inspections before connection.

Agencies and organizations connected to, accessing and using information and documents in the system must also retain and provide access histories for display to electronic identity holders. Such history includes the type of information and documents accessed, the purpose, number of accesses, time and accessing party. At the same time, information and documents authenticated or accessed from the system must not be further shared with another party, unless requested by the data subject or otherwise provided by law.

Accordingly, enterprises that connect to or use data from the identification system need to simultaneously review access control mechanisms, system logs, personal data protection policies, purposes of data processing and data-sharing flows to service providers or companies within the same group. Successful authentication of data on VNeID does not create a right to use such data for purposes beyond the permitted scope.

Some other changes to note

In addition to the above contents, Decree 320 also adds a social welfare account on VNeID, allowing the integration of one payment account, e-wallet or mobile money account registered in the holder’s own name to receive support payments, pensions and social welfare payments.

Decree 320 also expands the conditions for using automated immigration control gates for Vietnamese citizens and foreigners whose immigration data or electronic identification accounts satisfy the prescribed conditions.

Overall, Decree 320 promotes the use of electronic identification accounts as a common authentication layer for the public sector and many digital transactions in the private sector. Decree 320 is considered to take the National Electronic Identification Application (VNeID) a further step from an electronic identification tool to shared infrastructure for accessing documents, carrying out administrative procedures, receiving notifications and authenticating electronic transaction accounts.

These changes have a direct impact on enterprises operating digital platforms, enterprises in the sectors listed under Decree 320, enterprises having foreign employees or managers and organizations that regularly carry out online public administrative procedures. In this context, enterprises should prioritize determining whether they fall within the sectors subject to mandatory account linkage, reviewing the electronic identification accounts of the organization and its foreign representatives/managers, and assessing technical integration capabilities and data protection requirements ahead of the transitional deadlines at the end of 2026 and in mid-2027.

Circular 38/2026/TT-NHNN: New Foreign Exchange Rules for Foreign Investment in Vietnam

,

Circular No. 38/2026/TT-NHNN: Completing the foreign exchange transaction management mechanism to align with changes in Vietnam’s investment laws

On 31 July 2026, the State Bank of Vietnam issued Circular No. 38/2026/TT-NHNN on foreign exchange management for foreign investment activities in Vietnam (“Circular 38”), replacing Circular No. 06/2019/TT-NHNN (“Circular 06”), and taking effect from 18 August 2026.

Circular 38 was issued to align foreign exchange management regulations with the current investment laws, while clarifying the mechanisms for capital contribution, opening and use of investment capital accounts, transfer of capital, profits and lawful revenues, payment of transfer prices and other transactions related to foreign investment activities in Vietnam. Some notable points of Circular 38 include:

Changes to the concept of “Foreign investment capital account in Vietnam”

Circular 38 replaces the term “direct investment capital account” under Circular 06 with “foreign investment capital account in Vietnam”. This change aims to broaden the scope of application, covering not only foreign investment activities into Vietnam but also investment activities from the International Financial Center in Vietnam (“IFC”) into the rest of Vietnam.

The updates below focus on foreign exchange management regulations applicable to cases where foreign investors being foreign organizations or individuals outside the territory of Vietnam conduct investment activities in Vietnam. For enterprises that are members of the IFC investing into the rest of Vietnam, foreign exchange management regulations are basically applied similarly to foreign investors, but with differences in cash flows as there is no transfer of funds from abroad into Vietnam.

Principles for transferring investment capital contributions into Vietnam

Investors may make capital contributions in foreign currency or Vietnamese dong on the basis of documents evidencing the capital contribution in accordance with the law, including the Enterprise Registration Certificate, Investment Registration Certificate, approval for capital contribution, purchase of shares or purchase of contributed capital, BCC contract, PPP contract and other relevant documents (collectively, “Documents Evidencing Capital Contribution”).

Notably, investors may transfer funds into the investment capital account to make capital contributions, change the contributed capital or the ratio of contributed capital before the enterprise completes the procedures for registration of changes to its charter capital or ownership structure in accordance with the laws. This provision facilitates capital increase and ownership restructuring transactions, while being consistent with the mechanism for registering changes after actual changes have occurred.

In addition, where the Documents Evidencing Capital Contribution specify multiple currencies, investors may select one currency to convert and determine the total value of the capital contribution. The selected currency must be used consistently throughout the entire capital contribution process, and the total value of the capital contribution after conversion must not exceed the capital contribution amount recorded in the Documents Evidencing Capital Contribution.

The applicable exchange rate shall be the exchange rate determined by the authorized bank where the investor opens the investment capital account at the time the funds are credited to the investment capital account.

Transfer of funds for investment preparation activities

Before the competent authority issues the Documents Evidencing Capital Contribution, foreign investors are permitted to transfer funds from abroad into Vietnam or from a payment account opened at an authorized bank in Vietnam to pay lawful expenses incurred during the investment preparation stage. Where the investor chooses to establish an economic organization before carrying out investment registration procedures, the investor is also permitted to open an investment capital account before the Investment Registration Certificate is issued or amended to make such payments.

After the Documents Evidencing Capital Contribution are issued, the amount transferred into Vietnam for investment preparation purposes may be handled under one of the following options:

  • Convert into capital contribution: part or all of the amount may be converted into the investor’s capital contribution;
  • Convert into a foreign loan: part or all of the amount may be converted into a foreign loan of the foreign-invested economic organization, subject to compliance with the laws on foreign borrowing and repayment; or
  • Return to the investor: where the Investment Registration Certificate is not issued or amended, the amount transferred shall be returned to the investor after deducting lawful expenses incurred during the investment preparation process in Vietnam.

The conversion or return of the above amount must be carried out on the basis of valid documents and vouchers evidencing the amount transferred and lawful expenses incurred, while ensuring compliance with regulations on foreign exchange management, investment, accounting and relevant laws.

Transfer of funds for payment of transfer prices

Payment of the transfer price for shares or contributed capital in a foreign-invested economic organization shall be made as follows:

  • Not through the investment capital account: transactions between non-resident investors or between resident investors.
  • Must be made through the investment capital account: transactions between a non-resident investor and a resident investor.

For transfer of investment projects under BCC contracts and PPP projects, payment must be made through the investment capital account in both cases: (i) between a non-resident investor and a resident investor; and (ii) between non-resident investors.

For petroleum contracts, payment of the transfer price for investment projects or transfer of participating interests, rights and obligations of contractors must be made through the investment capital account for transactions between a non-resident investor and a resident investor.

Currency for pricing and payment of transfer prices

The pricing and payment of the transfer price for capital or investment projects may be made in foreign currency for transactions between non-resident investors.

For transactions related to petroleum contracts, the pricing and payment of the transfer price for investment projects, participating interests, rights and obligations of contractors under petroleum contracts may be made in foreign currency for transactions between non-resident investors or between a foreign investor and a resident investor.

Except for the transfer transactions in the petroleum sector mentioned above, the pricing and payment of the transfer price for capital or investment projects must be made in Vietnamese dong for transactions between a resident investor and a non-resident investor or between resident investors.

Vietnam’s Circular 32/2026/TT-BYT: Key Changes to Drug Marketing Authorization

,

Circular 32 takes effect on 1 October 2026 and introduces important changes to the preparation, assessment and management of marketing authorisation dossiers for drugs and drug substances in Vietnam.

On 29 July 2026, the Ministry of Health issued Circular 32/2026/TT-BYT (“Circular 32”) on the marketing authorisation of drugs and drug substances for human use. Circular 32 applies to chemical drugs, vaccines, biological products, herbal drugs and drug substances. It does not apply to traditional drugs or medicinal materials.

Circular 32 will replace Circular 12/2025/TT-BYT from 1 October 2026. Although the new rules introduce additional flexibility in several areas, they also place greater responsibility on registration establishments to substantiate their regulatory approach, classify changes correctly and maintain supporting records.

Key takeaways

  • Consolidated applications and deferred submission of a Certificate of Pharmaceutical Product (CPP) are available only where all applicable conditions are met.
  • An exemption from safety and efficacy documentation does not exempt the dossier as a whole from assessment or remove other applicable documentation requirements.
  • A Certificate of Suitability to the monographs of the European Pharmacopoeia (CEP) should not be treated as standalone evidence of Good Manufacturing Practice (GMP) compliance.
  • Pending applications should be assessed individually before a registration establishment requests the application of a more favourable transitional provision.

Transitional arrangements

In principle, applications submitted before 1 October 2026 but not yet determined will continue to be processed under the rules in force at the time of submission. From the effective date, a registration establishment may request the application of provisions of Circular 32 that facilitate or simplify administrative procedures, subject to the scope and conditions of the relevant transitional provisions.

This is not an unrestricted right to choose between the old and new regimes. Businesses should assess each pending application by reference to its submission date, current status and the specific provision proposed to be applied.

Five changes businesses should note

1. Application submission and supplementary CPPs

Circular 32 permits a single application to cover multiple products where the prescribed criteria are met. The scope is expanded in certain cases involving different packaging establishments or batch-release sites. The omission of certain criteria as separate items does not, however, create an automatic right to make a consolidated submission. The applicable conditions and consistency of each product must still be verified.

In the cases specifically prescribed by Circular 32, the Drug Administration of Vietnam may accept a new marketing authorisation application without a CPP. The registration establishment must provide a written explanation and submit the CPP no later than its second supplementary submission made at the request of the receiving authority.

This mechanism defers only the timing of CPP submission. A product will remain ineligible for marketing authorisation if the CPP is not submitted on time or does not satisfy the requirements concerning the issuing authority, contents, validity or consistency with the dossier.

What businesses should review: Identify applications that may qualify for deferred CPP submission and establish controls for the applicable deadline, issuing authority, validity and dossier consistency.

2. Safety and efficacy data and reliance mechanisms

Circular 32 continues the mechanism for relying on assessments by foreign medicines regulatory authorities and differentiates data requirements according to the characteristics of the product.

For a chemical drug having the same active ingredient, strength or concentration, route of administration and dosage form as a drug authorised by a reference stringent regulatory authority (SRA) or the European Medicines Agency (EMA), but with changes to its indication, dosage regimen, bioavailability or pharmacokinetics, Circular 32 permits an appropriate data pathway. Depending on the case, this may comprise full clinical data; literature data together with the package insert or summary of product characteristics; or data prepared under clinical development guidelines for drugs with new improvements.

A chemical drug similar to a drug authorised by an SRA or the EMA, and not falling within the above group of changed or improved drugs, may be exempt from submitting safety and efficacy documentation. Circular 32 also adds an exemption for certain newly domestically manufactured drugs for the prevention or treatment of Group A infectious diseases, excluding vaccines, where all prescribed conditions are satisfied.

An exemption from safety and efficacy documentation does not remove applicable administrative, quality or bioequivalence documentation requirements, nor does it exempt the dossier as a whole from assessment.

What businesses should review: Correctly classify the product and compare it with drugs authorised in Vietnam and by an SRA or the EMA before selecting the data package and reliance pathway.

3. Quality dossiers, CEP/GMP and registered drug substances

Compared with Circular 12, a CEP is no longer listed among the documents that may independently demonstrate a drug-substance manufacturer’s GMP compliance. A CEP may still form part of the quality dossier, but it should not be used as standalone GMP evidence. Dossiers currently using a CEP for both purposes should be reassessed, and any supplementary documents required under Article 22.7 of Circular 32 should be identified.

Circular 32 also addresses electronic quality documents. Where documents in the drug-substance section are provided electronically without the drug-substance manufacturer’s seal, they may be certified with the seal of the finished-product manufacturer or the registration establishment. The certifying party assumes legal responsibility for their accuracy, lawfulness and authenticity.

Where a drug substance already holds a marketing authorisation in Vietnam and is used in accordance with its approved name, manufacturer, quality standard and source, the finished-product dossier need not resubmit certain listed quality documents and legal papers. This is a limited exemption from resubmission, not permission to rely on or reuse the entire drug-substance dossier. Two certificates of analysis must still be submitted as required.

What businesses should review: Reassess dossiers that rely on a CEP as GMP evidence and confirm whether a registered drug substance meets every condition for the limited exemption from resubmission.

4. Contract manufacturing, technology transfer and stability data

Circular 32 removes from the required dossier the permit for contract manufacturing for foreign traders under Decree 69/2018/ND-CP. It also clarifies the requirement to align changes to the formulation, manufacturing process, material specifications, finished-product specifications and trade name of a contract-manufactured drug or a drug prior to technology transfer.

For certain contract-manufacturing or technology-transfer applications, or new applications involving a change of manufacturer, Circular 32 permits the use of at least six months of long-term and accelerated stability data where all conditions are met. Stability studies must continue after authorisation, and any out-of-specification result must be reported together with remedial measures.

What businesses should review: Control stability data, variation filing deadlines and any separate notification obligations for contract-manufactured or technology-transferred drugs as an integrated workstream.

5. Post-approval changes and reconsideration

Appendix II increases the categories of minor notification-only changes from 11 to 13. The new categories include:

  • MiV-N11: a minor change to the manufacturing process of certain drugs, provided it qualifies as a Level 1 change under the US Food and Drug Administration’s Scale-Up and Post-Approval Changes (SUPAC) guidance and satisfies all technical conditions;
  • MiV-N12: a change to a component of the primary packaging that does not directly contact the finished drug and does not affect dose delivery, use, safety or stability; and
  • MiV-N13: a change to the name or address of the establishment or party responsible for quality testing, where the manufacturer and testing site remain unchanged.

The notification mechanism may be used only when every condition for the relevant variation code is satisfied. Otherwise, the applicable approval procedure must still be followed.

An approved change must be implemented within 12 months. A notification-only change may be implemented from the date the dossier is received, but no later than 12 months after publication by the Drug Administration of Vietnam. The continued circulation of products bearing the previous particulars depends on the date of domestic manufacture or, for imported drugs, the shipment date at the port of departure.

Circular 32 also allows a registration establishment to request reconsideration within one month after receiving notice that an application will not be granted or renewed, or that a variation will not be approved. If the explanation is accepted under the prescribed process, assessment may continue without the establishment having to repeat the entire procedure from the beginning.

What businesses should review: Revalidate the classification of proposed notification-only changes and establish a calendar for implementation, manufacture or shipment cut-off dates and the one-month reconsideration period.

Actions to take before 1 October 2026

Businesses should consider taking the following steps:

  1. Map the dossier portfolio. Classify applications being prepared, submitted, supplemented or awaiting renewal, together with post-approval changes, and record the intended transitional approach for each.
  2. Review CPP and CEP/GMP documentation. Identify deferred CPP cases and reassess applications that previously relied on a CEP as GMP evidence.
  3. Confirm the data strategy. Compare the proposed product with drugs authorised in Vietnam and by an SRA or the EMA to determine the correct safety and efficacy data package.
  4. Assess drug-substance dossiers. Confirm eligibility for the limited exemption from resubmitting specified documents and prepare the two required certificates of analysis.
  5. Review stability data and post-approval changes. Focus on contract manufacturing, technology transfer, manufacturer changes and proposed MiV-N11, MiV-N12 or MiV-N13 changes.
  6. Establish a regulatory calendar. Track submission and implementation deadlines, manufacture or shipment cut-off dates and the period for requesting reconsideration.

ALIAT’s view

Circular 32 provides useful procedural flexibility, but its practical benefit will depend on careful product classification and well-supported regulatory decisions. Updating dossier checklists alone will not be sufficient. Registration establishments should also review their internal processes for variation classification, deadline management, approval of notification-only changes and documentation of any request to apply a transitional provision.

Circular 32/2026/TT-BYT dated 29 July 2026 takes effect on 1 October 2026 and replaces Circular 12/2025/TT-BYT.

This update provides general information as at the date of publication and does not constitute legal advice or regulatory advice on any specific product or dossier. Application of the rules should be assessed in light of the dossier status, product characteristics and implementing guidance issued by the competent authorities.

Draft Decree on Criteria for Determining Vietnamese Origin: Proposed Framework for Identifying the Origin of Goods Circulating Domestically

,

The Ministry of Industry and Trade is currently finalizing a draft decree on criteria for determining Vietnamese origin for goods circulating within the domestic market (the “Draft”), with the objective of establishing a clear and transparent legal basis for origin labeling and advertising. The Draft introduces several notable points as follows:

Criteria for Determining Goods of Vietnamese Origin

Accordingly, goods shall be considered of Vietnamese origin if they fall into one of the following three categories:

  • Goods wholly obtained in Vietnam, including plants grown and harvested in Vietnam; animals born and raised in Vietnam; products derived from such animals; minerals extracted in Vietnam; and products obtained from fishing, hunting, or gathering activities conducted in Vietnam;
  • Goods produced in Vietnam entirely from materials originating in Vietnam;
  • Goods that are not wholly obtained in Vietnam but undergo their final substantial transformation in Vietnam, resulting in a fundamental change in their nature and achieving a value content exceeding the prescribed minimum threshold.

Determination of Vietnamese Value Content for Non-Wholly Obtained Goods

For goods that are not wholly obtained in Vietnam, the Draft proposes that the value added through production, processing, or manufacturing activities conducted in Vietnam must account for at least 30% of the ex-works price of the goods.

The calculation method for Vietnamese value content is specifically outlined, taking into account the value of originating and non-originating materials, ex-works price, direct labor costs, allocated production costs, and the manufacturer’s anticipated profit.

For goods in the information technology and digital technology sectors, the Draft also recognizes that activities such as research and development, design, assembly, manufacturing, testing, digitalization, automated programming, and product development may be included in the Vietnamese value content if carried out in Vietnam.

Simple Processing Operations Not Qualifying for Vietnamese Origin

A key feature of the Draft is the proposal that simple processing operations shall not be considered in determining Vietnamese origin. Such operations include preservation, simple packaging changes, basic cleaning, ironing or pressing, labeling, simple polishing, husking, coloring, simple cutting, sorting, simple packaging, simple assembly, basic inspection, or individual slaughtering of animals.

This provision is significant in preventing situations where imported goods undergo only minimal processing in Vietnam but are nevertheless labeled or marketed as having Vietnamese origin.

Obligations of Traders

The Draft imposes clear obligations on traders when presenting information regarding Vietnamese origin on product labels or related materials. Specifically, traders are required to:

  • Take full legal responsibility for the declared origin of goods;
  • Retain documentation substantiating the origin of goods; and
  • Provide supporting documents upon request by competent authorities.

Practical Implications for Businesses

Overall, the Draft represents an important step toward standardizing the determination of Vietnamese origin for domestically circulated goods. The introduction of a dedicated regulatory framework for the domestic market is expected to curb arbitrary origin claims, while providing a clearer legal basis for market surveillance and consumer protection.

In light of the above, should the Draft is adopted, enterprises should consider the following actions to mitigate the risk of misrepresenting origin:

  • Review product portfolios and current origin claims to determine which products satisfy the Draft criteria for Vietnamese origin;
  • Reassess supply chains and production processes, particularly for goods with imported inputs or only minimal processing conducted in Vietnam;
  • Standardize documentation evidencing origin, including materials records, bills of materials, production processes, cost structures, invoices, technical documents, and related records for inspection purposes;
  • Review product labeling, commercial materials, and advertising content to ensure that origin claims are legally compliant and not misleading; and
  • Establish internal control mechanisms among legal, production, procurement, and marketing functions to ensure that origin-related claims are consistently verified prior to market disclosure.

Official Letter No. 2519/BTC-PC: Temporary Continued Application of Investment Procedures under the 2020 Law on Investment

,

On 11 December 2025, the National Assembly passed the Law on Investment No. 143/2025/QH15 (“Investment Law 2025”), which took effect on 1 March 2026 and replaces the Law on Investment No. 61/2020/QH14. This marks a significant update to the legal framework governing investment activities in Vietnam.

However, as the implementing regulations guiding the Investment Law 2025 have not yet been fully issued to facilitate the application of new investment procedures, on 4 March 2026, the Ministry of Finance issued Official Letter No. 2519/BTC-PC to provide guidance on the implementation of the Investment Law 2025, ensuring continuity in state administration and the handling of administrative procedures in the investment sector without disruption.

Accordingly, the provisions under Decree No. 31/2021/ND-CP guiding the Law on Investment and Decree No. 19/2025/ND-CP on special investment procedures will continue to apply during the transitional period until the official implementing regulations of the Investment Law 2025 are promulgated. In addition, existing guiding circulars (including Circular No. 03/2021/TT-BKHĐT) will remain in effect.

To ensure continuity in the receipt and processing of investment dossiers, the Ministry of Finance requests competent authorities, as well as enterprises and investors, to continue applying the procedures and processes under the aforementioned existing regulations. This approach helps minimize legal gaps and avoid practical difficulties during implementation.

Official Letter 2519/BTC-PC reflects a clear “soft transition” approach adopted by the regulatory authorities in the course of reforming the investment legal framework. In this context, enterprises and investors should take note of the following key points:

  • Continue applying the current investment regulations under Decree No. 31/2021/ND-CP, Decree No. 19/2025/ND-CP, and relevant circulars until the implementing regulations for the Investment Law 2025 are issued;
  • Proactively monitor forthcoming implementing regulations of the Investment Law 2025 to promptly update and adjust investment activities, thereby mitigating compliance risks once the new rules take effect;

Assess the priority and timing of planned investment projects to determine whether to proceed with investment registration under the current framework or defer until the new implementing regulations on investment procedures are issued.

Official Letter No. 1296/CT-NVT: Detailed Guidance on Personal Income Tax Finalization for the 2025 Tax Period

,

On 4 March 2026, the General Department of Taxation issued Official Letter No. 1296/CT-NVT (“Official Letter 1296”), providing detailed guidance on the declaration and finalization of personal income tax (“PIT”) for income derived from salaries and wages for the 2025 tax period, while also updating certain provisions applicable from the 2026 tax period. Key highlights include the following:

Personal deductions for income from salaries and wages

Effective from the 2026 tax period, the personal deduction threshold is increased from VND 11 million/month (equivalent to VND 132 million/year) to VND 15.5 million/month (equivalent to VND 186 million/year) for taxpayers, and from VND 4.4 million/month to VND 6.2 million/month for each dependent. This adjustment raises the non-taxable income threshold and reduces the tax burden on individuals.

Tax rates applicable to income from salaries and wages

For the 2025 tax finalization, resident individuals’ income from salaries and wages remains subject to the progressive tax tariff comprising seven brackets, with rates ranging from 5% (for taxable income up to VND 60 million/year) to 35% (for taxable income exceeding VND 960 million/year).

From the 2026 tax period, this tariff will be streamlined to five brackets, with the 5% rate applicable to taxable income up to VND 120 million/year, and the highest rate of 35% applicable to taxable income exceeding VND 1.2 billion/year.

Scope and subjects required to conduct PIT finalization

Official Letter 1296 clarifies the scope and subjects required to conduct PIT finalization. Income-paying organizations and individuals are responsible for declaring and finalizing PIT, including conducting finalization on behalf of individuals where valid authorization is provided.

For individuals, direct finalization obligations arise in cases such as: having income from multiple sources without meeting authorization conditions; foreign employees terminating their employment in Vietnam; or individuals receiving income from foreign entities, international organizations, or diplomatic missions where PIT has not been withheld during the year.

The Official Letter also specifies cases where PIT finalization is not required, including where no income is paid, business operations are suspended during the calendar year, or where the additional tax payable after finalization does not exceed VND 50,000, as well as cases where excess tax has been paid but the taxpayer does not request a refund or offset.

Authorization for PIT finalization

Official Letter 1296 further clarifies the circumstances under which individuals may authorize PIT finalization. Typically, this applies to individuals who have labor contracts of three months or more with a single employer and are still employed at the time of finalization; or those who earn additional irregular income from other sources not exceeding VND 10 million/month on average, which has already been subject to 10% withholding.

Conversely, individuals with multiple income sources, those with additional tax payable or refundable amounts, or specific cases such as foreign employees terminating employment in Vietnam, should assess whether they are required to directly finalize PIT with the tax authorities.

Online tools supporting PIT finalization

To facilitate taxpayers, the tax authorities have deployed various systems supporting electronic declaration and submission.

For income-paying organizations: software such as the Tax Declaration Support (HTKK) version 5.5.8, iTaxViewer version 2.6.3, and the tax authority’s administrative procedure processing system are used for declaration and submission of finalization dossiers.

For individuals: digital platforms such as the tax authority’s public service portal, the eTax Mobile application, and the National Public Service Portal support declaration, submission, and tracking of dossier status.

Automatic PIT refund mechanism for individuals

A notable development is the implementation of an automatic PIT refund mechanism for individuals conducting direct finalization. From 2025 onwards, taxpayers may submit refund dossiers electronically, and where the dossier satisfies all prescribed conditions, the system will automatically process the refund within approximately three working days. Official Letter 1296 also specifies the applicable conditions and provides guidance on required documentation and system functionalities.

Overall, Official Letter 1296 enhances the efficiency of tax administration, ensuring transparency and consistency in PIT finalization while reducing administrative burdens through increased digitalization. Accordingly, ALIAT recommends that enterprises:

  • Proactively review employees’ authorization documents for PIT finalization;
  • Identify cases where employees are required to directly finalize PIT with tax authorities;

Verify the proper withholding and issuance of tax withholding certificates.

Decree No. 37/2026/ND-CP: Changes to Goods Risk Classification and Introduction of Extensive New Labelling Requirements

,

On 23 January 2026, the Government promulgated Decree No. 37/2026/ND-CP detailing a number of provisions and measures for the implementation of the Law on Product and Goods Quality (“Decree 37”). Decree 37 will take effect from 1 July 2026. Its key highlights are summarized as follows:

Risk-Based Product and Goods Quality Management

Under previous regulations, products and goods were classified into 02 groups: (i) goods not capable of causing safety risks; and (ii) goods potentially capable of causing harm to human health, animals, plants, and the environment.

Under Decree 37, products and goods are classified into 03 risk levels in terms of their impact on human health, animals, plants, and the environment, namely: low risk, medium risk, and high risk.

The risk level of goods is determined based on an assessment of factors such as: (i) the severity of impact; (ii) the ability to control, mitigate, or eliminate hazards in practice and the capacity for recovery after impact; (iii) the scale of impact; and (iv) the frequency of occurrence during actual use. The determination of these factors must be grounded in scientific evidence and practical data, as well as the regulatory capacity and management requirements of competent state authorities from time to time.

For this purpose, Decree 37 also sets out detailed technical criteria and scoring methodologies for assessing the risk levels of products and goods. The lists of products and goods classified as medium-risk and high-risk (together with their corresponding HS codes under the Import and Export Tariff Schedule) will be issued by the relevant regulatory authorities in the near future, with an implementation roadmap commencing from 1 July 2026.

The risk-based classification of goods serves as the basis for determining which information must be displayed on physical labels and which information may be integrated into electronic labels. Simultaneously, the shift to risk-based classification of goods means that regulatory and labeling obligations will no longer apply uniformly but will instead vary depending on the risk level of each product. This may directly affect both the scope of information required to be disclosed and the corresponding management approach.

Introduction of Extensive New Labelling Requirements

Decree 37 expands labeling obligations in the context of e-commerce. Sellers are required to publicly disclose complete label information when trading on digital platforms (except for certain batch-specific details such as date of manufacture or batch number). E-commerce platform operators are required to ensure transparent display of information and to facilitate connectivity with state management data systems where necessary.

In addition, whereas previous regulations focused primarily on physical labels, Decree 37 introduces a legal framework for electronic labeling. Certain mandatory information may now be presented through QR codes, RFID technology, or other electronic data carriers, rather than being limited to traditional physical labels. The formal recognition of electronic labels enables enterprises to digitalize product information, while also facilitating traceability and integration with state management databases.

Furthermore, Decree 37 revises the rules on label placement in a more practical manner. Labels must be affixed in a location that is easily visible and allows all required information to be read without disassembling product components. Mandatory labeling content is not required to be concentrated in a single location, provided that it remains complete and readily identifiable. This approach affords enterprises greater flexibility in packaging design, while simultaneously imposing higher standards regarding information visibility and accessibility.

The recognition of electronic labeling and the expansion of labeling requirements to the e-commerce environment indicate that product information is no longer managed through a single format (i.e., physical labels), but must instead be administered concurrently across multiple interfaces (including physical labels, electronic labels, and e-commerce platforms). This not only requires enterprises to ensure the accessibility and proper display of information in practice, but also to maintain the completeness and consistency of such information across all formats.

In addition, the more flexible rules on label placement and presentation provide enterprises with greater flexibility in packaging design, while at the same time imposing higher requirements in terms of visibility and accessibility of information, particularly where content is presented in a dispersed manner or integrated through electronic means.

Application of Technology Platforms in Quality Management and Traceability

Decree 37 introduces specific provisions on the development and implementation of technology platforms to support product and goods quality management.

With respect to digital applications in data collection, storage and sharing, Decree 37 encourages manufacturers and traders to adopt coding systems in various forms, including one-dimensional barcodes, two-dimensional codes (QR codes, DataMatrix), radio-frequency identification (RFID), near-field communication (NFC), and other appropriate technological solutions.

Priority is also given to integrating advanced technologies such as Artificial Intelligence (AI), Big Data, and the Internet of Things (IoT) to ensure seamless data collection, management, storage and sharing throughout the entire supply chain.

Decree 37 further encourages the use of barcodes and identification codes for quality management and product traceability. Traceability systems implemented by organizations and individuals must ensure full traceability of the entire formation and circulation process of products in accordance with applicable national, international, regional, foreign or corporate standards, consistent with the law on standards and technical regulations.

Such systems must be declared as conforming to applicable standards; where a corresponding national technical regulation exists, a declaration of conformity must be made in accordance with regulations.

Minimum traceability data required within the system include: Product name and image; Name and address of the manufacturing/trading organization or individual; Origin; Brand/trademark; Batch number, lot number or serial number (if any); Expiry date (if any).

The Ministry of Science and Technology is the unified authority responsible for nationwide traceability management, including: promulgating and publishing standards and technical regulations; ensuring data connectivity and sharing systems; operating, maintaining and upgrading the National Product and Goods Traceability Portal and the national platform for identification, authentication and traceability; and managing traceability codes and data carriers.

Provincial-level People’s Committees are responsible for organizing and coordinating traceability inspections within their localities in collaboration with relevant ministries and agencies.

The above changes introduced under Decree 37 reflect a broader shift in the approach to managing product and goods quality, thereby giving rise to significant implications for enterprises’ compliance obligations and operational activities. Specifically:

In the short term, enterprises may incur increased costs associated with reviewing product classification systems, adjusting label and packaging designs, and investing in technological infrastructure to support electronic labeling and product traceability. At the same time, ensuring consistency and completeness of product information across multiple forms of presentation will also increase internal governance and compliance requirements.

Nevertheless, in the long term, the adoption of electronic labeling and traceability systems may enable enterprises to optimize product management, enhance transparency, and thereby improve market trust and support business operations, particularly in the digital environment.

Accordingly, ALIAT recommends that enterprises focus on the following:

  • Proactively monitor, update and review product lists by risk classification once guidance from competent authorities is issued;
  • Review labelling practices, including electronic labels and e-commerce disclosures, to: (a) ensuring that product labels are placed in a position that is easily visible and allow all mandatory information to be fully readable without the need to disassemble the product; (b) ensuring the visibility and completeness of mandatory information, including where such information is presented in a dispersed manner; and (c) ensuring consistency and alignment between physical labels, electronic labels, and information disclosed on e-commerce platforms;
  • proactively reviewing and classifying goods and packaging in accordance with the transitional provisions of Decree 37, whereby: (a) for product labels and packaging printed prior to 01 July 2026, a plan should be developed for their continued use or replacement within a maximum period of two (02) years from 01 July 2026; and (b) for goods that have been manufactured, imported, or already placed into circulation prior to this date, such goods may continue to be circulated until their expiry date.

Reviewing and assessing the necessity of upgrading technical infrastructure to support the implementation of electronic labeling and product traceability, including product coding systems, data storage and management systems, as well as the capability to connect and share information with relevant governmental data management platforms.