In 2026, technology investment in Vietnam operates for the first time inside a complete data frame: the data law, the new-generation personal data protection law and the e-commerce law stand as one system, so the technology edition must read them as one architecture, not three separate topics. This is a question that legal and finance teams of enterprises in Vietnam must answer in writing and with evidence, not by word-of-mouth experience.
The legal framework in force
The data architecture comprises Data Law 60/2024/QH15 effective 01/7/2025 laying the data classification and management base, the new-generation personal data protection law effective from early 2026 with Decree 356/2025/ND-CP replacing Decree 13/2023/ND-CP as the main enforcement frame, and Cybersecurity Law 24/2018/QH14 for conditional security and data-localisation duties. The frame shaping technology investment is data, no longer tax incentives. The market architecture comprises E-Commerce Law 122/2025/QH15 and Decree 248/2026/ND-CP effective 01/7/2026 replacing Decree 52/2013/ND-CP for platforms and online sellers. New constraints centre on data transfers and platform responsibility. For artificial intelligence, at the writing date Vietnam has enacted no dedicated AI law: AI activity is governed indirectly through the data, cybersecurity, e-commerce and existing civil-liability frames — the edition records this gap plainly instead of inferring an AI regime that does not yet exist.
Application to the enterprise’s file
- The frame shaping technology investment is data, no longer tax incentives. Decisions to place a data centre, a cross-border SaaS model or an AI team in Vietnam must pass three data questions — data classification, outbound data transfer and impact assessment — before reaching incentives, because a stuck data file locks the whole launch schedule.
- New constraints centre on data transfers and platform responsibility. Outbound-transfer impact files, e-commerce platform duties over sellers and counterfeit goods, and cybersecurity storage requirements are the three points where a standard global business model must be adjusted when entering Vietnam.
- 2027 opportunity sits where the frame is already clear: data centres, digital services and technology talent. Once the data architecture stands still, advantage shifts to execution speed — enterprises completing compliance files early will take the market while rivals still await detailed guidance per subsector.
Action checklist
- Put personal-data impact assessments and cross-border transfer files on the conditions-precedent list of every technology project.
- Map each global product feature against these three duties and record the points needing localisation in the product roadmap.
- Lock the data-file and platform-licence completion calendar by quarter, and treat it as the critical path of the 2027 expansion plan.
Bottom line
The key point on Vietnam technology digital economy legal report 2026 data AI is not to follow another enterprise’s practice: each case must be checked against its own contracts, files and notices.
Frequently Asked Questions
Which legal frames are shaping technology investment in Vietnam?
In principle: The frame shaping technology investment is data, no longer tax incentives. Decisions to place a data centre, a cross-border SaaS model or an AI team in Vietnam must pass three data questions — data classification, outbound data transfer and impact assessment — before reaching incentives, because a stuck data file locks the whole launch schedule. Main bases: Data Law 60/2024/QH15 (effective 01/7/2025); Decree 356/2025/ND-CP (replacing 13/2023); Cybersecurity Law 24/2018/QH14; E-Commerce Law 122/2025/QH15 and Decree 248/2026/ND-CP. No dedicated AI law exists at the writing date. If authority is unclear, ask in writing.
What new constraints bind data and AI?
The distinction that matters: New constraints centre on data transfers and platform responsibility. Outbound-transfer impact files, e-commerce platform duties over sellers and counterfeit goods, and cybersecurity storage requirements are the three points where a standard global business model must be adjusted when entering Vietnam. Main bases: Data Law 60/2024/QH15 (effective 01/7/2025); Decree 356/2025/ND-CP (replacing 13/2023); Cybersecurity Law 24/2018/QH14; E-Commerce Law 122/2025/QH15 and Decree 248/2026/ND-CP. No dedicated AI law exists at the writing date. Fix verbal understandings in writing.
Where are the opportunities for technology investors in 2027?
From the actual file’s perspective: 2027 opportunity sits where the frame is already clear: data centres, digital services and technology talent. Once the data architecture stands still, advantage shifts to execution speed — enterprises completing compliance files early will take the market while rivals still await detailed guidance per subsector. Main bases: Data Law 60/2024/QH15 (effective 01/7/2025); Decree 356/2025/ND-CP (replacing 13/2023); Cybersecurity Law 24/2018/QH14; E-Commerce Law 122/2025/QH15 and Decree 248/2026/ND-CP. No dedicated AI law exists at the writing date. Keep supporting records year by year.
This article has been quality-reviewed by the FLAW AI Legal Council
