- What is changing: in 2025–2026 several key instruments took effect: the Law on Personal Data Protection and Decree No. 356/2025/ND-CP (1 January 2026), the Law on Tax Administration 2025 (1 July 2026), and Decree No. 283/2026/ND-CP on administrative penalties in labour and social insurance (10 September 2026).
- Who is affected: every business that has employees, processes customer or staff data, or has related-party transactions.
- Biggest impact: regulators are moving to data-driven post-inspection. Some tax, environmental and competition violations can lead to criminal liability of the business itself, not only of individuals.
- First thing to do: prepare a register of compliance obligations and a risk map in the first two months. Start with personal data, labour and tax.
Quick reference
| Instrument | In force | Status | What it means for businesses |
|---|---|---|---|
| Law on Personal Data Protection (Law No. 91/2025/QH15); Decree No. 356/2025/ND-CP dated 31 December 2025 | 1 January 2026 | In force; replaces Decree No. 13/2023/ND-CP | Data protection staff, impact assessment dossiers, breach notification |
| Law on Tax Administration (Law No. 108/2025/QH15) dated 10 December 2025 | 1 July 2026 (some provisions from 1 January 2026) | In force; replaces the Law on Tax Administration 2019 | Risk-based and data-driven tax administration |
| Decree No. 283/2026/ND-CP dated 15 July 2026 | 10 September 2026 | In force; replaces Decree No. 12/2022/ND-CP | Penalties for labour and social insurance violations |
| Law on Inspection (Law No. 84/2025/QH15) | 1 July 2025 | In force | Rights and obligations of a business under inspection |
| Decree No. 151/2026/ND-CP dated 13 May 2026 | 1 July 2026 | In force; replaces Decree No. 08/2020/ND-CP | Enforcement officers (thừa hành viên) prepare official records of events (vi bằng) to preserve evidence |
| Penal Code 2015 (as amended), Articles 75 and 76 | — | In force | Criminal liability of commercial legal entities |
1. Why businesses should review compliance in 2026
The State is moving from pre-approval to post-inspection. Businesses have more freedom to operate, but must prove they comply when inspected. The Law on Tax Administration 2025 continues the move to risk-based and data-driven administration. E-invoices let the tax authority cross-check transactions on a large scale.
The table below turns the main legal changes into their impact on a business’s processes.
| Legal change | Processes affected | Risk | Level | Owner | Action |
|---|---|---|---|---|---|
| Law on Personal Data Protection, Decree No. 356/2025/ND-CP | Recruitment, customer management, marketing, transferring data to a parent company or a foreign provider | Fines; violations on cross-border data transfers carry a maximum fine of up to 5% of the previous year’s revenue | High | Legal, IT, HR | Map your data; appoint data protection staff; prepare the impact assessment dossier |
| Law on Tax Administration 2025 | Accounting, invoices, related-party transactions | Tax assessed by the authority, penalties, referral for criminal investigation where there are signs of a crime | High | CFO, Accounting | Review transfer pricing documentation for related-party transactions; control suppliers and input invoices |
| Decree No. 283/2026/ND-CP | Employment contracts, work rules, social insurance contributions | Fines; evading insurance contributions can lead to criminal prosecution | High | HR | Check the new list of violations against your HR processes |
| Law on Inspection 2025 | Working with inspection teams | Breaching the obligations of an inspected party; missing the right to explain | Medium | Management, Legal | Issue internal rules on working with State authorities; appoint a point of contact |
| Decree No. 151/2026/ND-CP | Keeping evidence in a dispute | Losing helpful evidence | Monitor | Legal | Update the form for requesting an official record (vi bằng) to the new title of enforcement officer |
The levels in the table are assessed for a typical business. The actual level depends on each business’s sector, volume of data and transaction model.
An FC Legal lawyer will discuss it with you and propose a suitable approach.
2. The most underestimated risk: criminal liability of the legal entity
Under the Penal Code 2015 (as amended), a commercial legal entity bears criminal liability for 33 offences listed in Article 76. Many of them relate directly to normal business activity: tax evasion (Article 200); illegally printing, issuing or trading invoices and documents (Article 203); breaching competition rules (Article 217); causing environmental pollution (Article 235); money laundering (Article 324).
Under Clause 1, Article 75, a legal entity bears criminal liability only when four conditions are all met. Criminal liability of the legal entity does not exclude criminal liability of individuals (Clause 2, Article 75). The main penalties are a fine, suspension of operations for a fixed term of 6 months to 3 years, or permanent suspension of operations.
Diagram 1. When a commercial legal entity bears criminal liability (Articles 75 and 76, Penal Code)
- Starting point: the criminal act is one of the 33 offences in Article 76 of the Penal Code.
- All four conditions must be met at the same time (Clause 1, Article 75): (1) the act was done in the name of the legal entity; (2) it was done for the benefit of the legal entity; (3) it was directed, managed or approved by the legal entity; (4) the limitation period for criminal prosecution has not expired.
- Result: the commercial legal entity bears criminal liability.
- And: this does not exclude the criminal liability of individuals (Clause 2, Article 75).
Vietnamese law gives no exemption to a business that has a compliance programme. This is different from the “adequate procedures” defence under the UK Bribery Act.
In FC Legal’s assessment, the practical value of a compliance system lies in the third condition: “directed, managed or approved by the legal entity”. When a violation occurs, a business with approval procedures, training records, a reporting channel and documented case handling has grounds to argue that the act was an individual’s conduct, not the will of the legal entity. A business that only has documents on paper, with no evidence that they operate in practice, will find this argument hard to use.
This is an analytical view. There is no precedent or official guidance yet on how the prosecuting authorities assess a business’s compliance programme.
3. What a compliance system includes
A compliance system is not a set of files in storage. It is a mechanism that runs all the time: identify obligations, assign a responsible person, control and keep evidence. A business does not need to adopt the full model at once. The table below shows the minimum level and the full model.
| Component | Small and medium-sized businesses (minimum level) | Large, listed and foreign-invested businesses (full model) |
|---|---|---|
| Register of obligations, risk map | Focus on key risks: tax, labour, personal data, conditional business lines | Cover all obligations; update periodically; the governing body approves the risk appetite |
| Internal documents | Code of conduct, registered work rules, essential policies (anti-bribery, gifts and conflicts of interest, personal data, record keeping) | Three tiers: code of conduct → topic policies → standard operating procedures (SOPs) |
| Allocation of responsibility | The director and one legal point of contact; outsource the legal and audit functions | Three Lines Model; internal audit reports directly to the governing body |
| Training, reporting channel | Induction training for new staff; one confidential reporting channel | Training based on role risk; hotline, anonymous reporting portal; rules protecting people who report |
| Handling deviations | A log of violations and corrective measures | Corrective and preventive action procedure; metrics; periodic reports to the governing body |
In the full model, responsibility is split into three lines: business and operations units own the risk; legal and compliance set policies and monitor; internal audit gives an independent assessment.
Diagram 2. The Three Lines Model applied to a compliance system
- Governing body (Board of Directors / Members’ Council / Owner). It directs the executive management.
- Executive management (General Director / Director). It directs Line 1 and Line 2.
- Line 1: business and operations (risk owners).
- Line 2: legal, compliance and risk management. It monitors and supports Line 1.
- Line 3: internal audit (independent assurance). It reports directly to the governing body.
- Independent auditors, certification bodies and State authorities give external assurance to the governing body.
A note on labour discipline. To discipline an employee who breaches a compliance policy, the violation and the form of discipline must be set out in the work rules (nội quy lao động). Under the Labour Code 2019, an employer with 10 or more employees must have written work rules and register them with the State labour authority.
What international standards are for. ISO 37301:2021, ISO 37001:2016, the G20/OECD Principles of Corporate Governance (2023) and the US Department of Justice guidance on evaluating compliance programmes do not bind Vietnamese businesses, except businesses subject to a foreign jurisdiction. They are a proven method for designing a system.
4. When an inspection team arrives: cooperate, comply and protect your rights
Under the Law on Inspection 2025 (Law No. 84/2025/QH15), inspections must not obstruct the normal operations of the inspected party (Clause 2, Article 4). The inspected party has the right to explain, complain and make recommendations (Clause 1, Article 50). It must also comply with the inspection decision and provide information and documents in a timely, complete and accurate way (Clause 2, Article 50). Specialised inspections and tax and customs inspections follow the specialised laws.
Businesses should prepare how they will act, based on the three principles below.
| Principle | What the business should do | What it must not do |
|---|---|---|
| Cooperate in good faith | Appoint in advance a point of contact and a person with authority to decide; prepare a workspace and a channel for providing electronic data for online or remote inspection | Delay without reason; act in a way that may be seen as improperly influencing officials on duty |
| Comply with the law | Keep records as they are and pause routine destruction and data deletion as soon as the decision is received; cooperate when the competent authority seals or takes inventory as the law allows | Provide untruthful information; falsify or destroy documents (Clauses 6 and 7, Article 6, Law on Inspection 2025) |
| Protect lawful rights and interests | Check the scope of work against the inspection decision; explain in writing with evidence; keep a log of documents handed over; mark trade secrets and ask for them to be kept confidential; consult a lawyer when the matter is complex | Use rights to drag out the process; refuse a lawful request on general grounds of confidentiality |
What foreign-invested businesses often misunderstand. Vietnamese law has no “attorney–client privilege” like the United States. A lawyer must keep client information confidential, but this duty is not a ground for the business to refuse a lawful request from a competent authority. Communications with in-house legal staff who are not lawyers are also outside a lawyer’s professional duty of confidentiality.
5. Records and evidence: the basis for protecting your business
Legal hold. When a trigger event occurs, such as receiving an inspection decision or a notice of dispute, the business should immediately pause routine destruction and automatic deletion of related data. Destroying documents related to the subject of an inspection is prohibited (Clause 6, Article 6, Law on Inspection 2025). It also destroys the very evidence that could help the business.
Minimum retention periods should be set out in an internal policy, for example:
| Record group | Minimum period | Legal basis |
|---|---|---|
| Accounting vouchers used directly for bookkeeping; accounting books; annual financial statements | 10 years | Law on Accounting 2015; Decree No. 174/2016/ND-CP |
| Accounting documents used for management and not directly for bookkeeping | 5 years | Law on Accounting 2015; Decree No. 174/2016/ND-CP |
| Corporate legal records (charter, resolutions, meeting minutes) | For the whole period of operation | Article 11, Law on Enterprises 2020 |
| Commercial contracts, transaction records | No shorter than the limitation period for bringing a claim and the retention period for related accounting vouchers | Article 429, Civil Code 2015 (3 years); Article 319, Commercial Law 2005 (2 years) |
Official records of events (vi bằng). From 1 July 2026, under Decree No. 151/2026/ND-CP, bailiffs (thừa phát lại) are renamed enforcement officers (thừa hành viên). Enforcement officers may prepare official records of real events and acts anywhere in Vietnam, except in cases where this is not allowed. An official record is a source of evidence for a court or arbitral tribunal to consider, but it does not replace a notarised or certified document. Businesses should consider an official record when they need to record damaged goods at delivery, a construction project behind schedule, or online content that appears to infringe before it is taken down.
6. A 12-month roadmap: what to do, who does it, and when
| Stage | What to do | Owner | Outputs |
|---|---|---|---|
| Months 1–2: Survey and risk mapping | Prepare the register of compliance obligations; assess gaps; prepare the personal data processing impact assessment if you do not have one | Legal and heads of departments | Register of obligations; risk map approved by the governing body |
| Months 3–5: Design the document framework | Issue the code of conduct, topic policies and internal rules on working with State authorities; amend the work rules; set up a channel for reporting violations | Legal, HR | Set of internal documents; registered work rules |
| Months 6–8: Operation and training | Training based on role risk; digitise the approval process for gifts and supplier due diligence; mock audit | Legal, IT, departments | Training records; mock audit report |
| Months 9–12: Audit and improvement | Internal or independent audit; fix non-conformities; report to the governing body | Internal audit or outsourced | Report on how well the system works; plan for the next year |
If resources are limited, the business should prioritise in this order: (1) personal data, because the obligations have applied since 1 January 2026; (2) labour and social insurance, because Decree No. 283/2026/ND-CP has just taken effect; (3) tax and invoices.
Measuring effectiveness. Some indicators to track from the first year: the percentage of staff who complete mandatory training; the percentage of new partners checked before a contract is signed; the percentage of personal data incidents notified on time. Do not set a “zero incidents” target. It tends to make people hide incidents instead of reporting them.
7. Unclear points in the law that businesses should note
- Grace period for small businesses on personal data protection. Small businesses and start-ups may choose whether or not to appoint data protection staff and prepare the impact assessment dossier for 5 years from 1 January 2026. The grace period does not apply if the business provides personal data processing services, directly processes sensitive personal data, or processes the data of a large number of data subjects. The list of sensitive personal data is quite broad. A cautious approach is to review the types of data you process, including employee data, before relying on the grace period.
- The value of a compliance programme in criminal proceedings. As discussed in section 2, there is no official guidance yet. Businesses should treat a compliance system as a tool for prevention and keeping evidence, not as a legal “shield”.
- Environmental penalties. Decree No. 45/2022/ND-CP still applies; a replacement is being drafted. Manufacturers should follow it so they can update their register of obligations.
Frequently asked questions
Must a business build a “compliance system”?
No general rule requires every business to build a compliance system. The obligations in each area (tax, labour, personal data and so on) are mandatory. A compliance system is how the business manages those obligations and proves it meets them. It is a governance recommendation, not a separate legal obligation.
Does ISO 37301 certification exempt a business from liability?
No. Certification is objective evidence that the business has a compliance management system, but Vietnamese law does not make it a ground for exempting or reducing liability.
The inspection team asks for documents that seem outside the scope of the inspection decision. What should the business do?
Discuss it openly to clarify the request, in writing where needed, and ask for your view to be recorded in the minutes. Do not refuse outright before the basis of the request is clear.
How often should a business update its compliance risk map?
At least once a year, and immediately after a major change in the law or in the business model, such as starting a new business line, starting to transfer data abroad, or a sharp increase in headcount.
Sources and legal basis
- Legislation (Tier 1): Penal Code 2015 (as amended), Articles 75 and 76; Civil Code 2015; Labour Code 2019; Commercial Law 2005; Law on Accounting 2015 and Decree No. 174/2016/ND-CP; Law on Enterprises 2020 (as amended in 2025); Law on Inspection (Law No. 84/2025/QH15); Law on Personal Data Protection (Law No. 91/2025/QH15) and Decree No. 356/2025/ND-CP; Law on Tax Administration (Law No. 108/2025/QH15); Decree No. 283/2026/ND-CP; Decree No. 151/2026/ND-CP; Decree No. 45/2022/ND-CP.
- Reference standards (Tier 3): ISO 37301:2021; ISO 37001:2016; G20/OECD Principles of Corporate Governance (2023); U.S. Department of Justice, Evaluation of Corporate Compliance Programs (September 2024); The IIA’s Three Lines Model (2020).
Where does your business stand?
For an in-depth review, talk to FC Legal about a Legal Health Check. We review your business’s register of compliance obligations and its compliance risk map.
Please do not send confidential documents or personal data through the form.
Note: FC Legal provides this content for information and to share general legal knowledge. It reflects the law as at the legal review cut-off date of 5 October 2026. It is not legal advice on any specific matter or transaction and does not create a lawyer–client relationship. How the law applies may depend on the facts, operating model and circumstances of each business. Businesses should consult a lawyer or a suitable legal expert before making decisions. If you quote this content, please cite FC Legal and the link to the article.
Author: FC Legal legal team, FC Legal Law Company Limited · Reviewed by: Managing Lawyer · Legal review cut-off date: 5 October 2026.
