Vietnam Data Exchanges Under Decree 314: Checks Before Listing or Buying

Before offering a dataset, analytics feed or data-access service on a Vietnamese data exchange, establish who can transact, what rights are being granted and how delivery will be controlled. Decree 314/2026/ND-CP was issued on 8 August 2026 and took effect on 25 September 2026. It is enacted law, not a consultation proposal. Its scope includes exchange participation, listings, testing, contracting and transaction oversight. 1 2

For a Singapore-based provider entering Vietnam, the important distinction is between supplying a product through an exchange and operating the exchange itself. Neither possession of data nor company registration alone answers the legal questions.

Separate the participant, intermediary and operator roles

Decree 314 defines a seller as a party supplying exploitation or use rights, and a buyer as the recipient of those rights. An intermediary connects and supports transactions without directly owning or deciding the traded data’s content. Analysis and aggregation services process inputs into products or services with added value over the original data. These roles carry different responsibilities. 2

A logistics analytics business might therefore be a seller of a derived product, rather than an exchange operator. A platform matching multiple data suppliers and buyers needs a separate assessment of its intermediary and exchange functions. Calling either business an AI platform does not settle that classification.

The Data Law, effective from 1 July 2025, separately addresses intermediaries, analytics services and exchanges in Articles 40 to 43. Exchange participation should not be confused with permission to establish or operate an exchange. 3 Internal reporting and ordinary bilateral sharing also should not automatically be treated as exchange transactions, although the underlying collection and use remain subject to applicable law. 2 3

Check the entity that will sign and receive access

Article 16 requires a foreign legal entity to be lawfully established in its home jurisdiction, satisfy relevant transaction conditions and have a commercial presence, branch or representative office in Vietnam in accordance with Vietnamese law or an applicable treaty. Providers operating in conditional business sectors must hold the required eligibility certificate. 2

Identify the contracting entity before onboarding. Will the Singapore parent buy access, or will a Vietnam subsidiary do so? Will the parent provide analytics while the subsidiary manages customers? Those choices affect the eligibility documents and the permitted user named in the contract.

The decree’s reference to a representative office is not a reason to assume that such an office may conduct every revenue-generating activity. Check the proposed presence against its own permitted functions. Royce’s guide to Vietnam presence options provides context for that structural decision.

Foreign participants without a level-two electronic identity account have a documentary verification route under Article 18. Legal documents require certification or consular legalisation as applicable, subject to the stated exemptions. Confirm the exchange’s process before committing to a launch timetable. 2

Build the listing around evidence, not ownership claims

Article 17 requires lawful provenance supported by valid records of collection, creation or transferred exploitation and use rights. Sellers must disclose use restrictions and relevant quality limitations. API offerings need connection instructions, data structures, authentication methods, access permissions and usage limits. 2

A useful listing dossier should show the chain from input to commercial output. For a production-efficiency dataset, retain the source agreement, evidence of permitted processing, the transformation method and the rights available to the buyer. A supplier’s permission to generate an internal report is not necessarily permission to resell its underlying records.

Analytical outputs must be clearly identified as value-added products or services, rather than original data. Providers must disclose basic processing methods, input sources and update frequency, and stay within their input-data rights. An intermediary’s assessment does not replace the seller’s responsibility or the operator’s listing decision. 2

Describe limitations candidly. Distinguish measured observations from estimates, specify the reporting period and explain whether later corrections will be supplied. These practical disclosures help buyers assess whether the product fits their intended use.

Apply the personal-data stop check before uploading

Decree 314 prohibits using an exchange to buy or sell personal data or process it unlawfully. Products derived from personal data may be transacted only when they meet de-identification conditions and other requirements of personal-data-protection law. 1 2

Do not treat removal of names as automatic clearance. Review whether the remaining fields or combinations could identify individuals, and document the legal and technical assessment before listing. The exchange rule is conditional, not a standalone authorisation to commercialise customer records.

This article concerns commercial data products, not a full privacy compliance programme. For processing roles, regional vendor access and transfer documentation, see Vietnam personal data protection.

Connect the contract to payment and delivery controls

Article 23 requires exchange purchases, sales and exchanges of data products and services to use electronic contracts through the exchange system. Minimum terms include the product, rights and obligations, quality, purpose, payment, delivery, confidentiality, liability, disputes and termination. 2

Define permitted users and purposes precisely. For example, access for one subsidiary’s demand forecasting should not silently become permission for group-wide model training or onward distribution. Record the term, territorial restrictions where relevant and any sublicensing limits alongside the technical access controls.

Transactions must use registered trading and payment accounts. Payment runs through providers publicly listed by the operator and must comply with non-cash payment law. The official transaction currency is VND. These rules do not themselves authorise a separate payment business. 2

Delivery can include downloads, API access or analytical results. Article 25 links delivery to an effective contract and fulfilment of the buyer’s payment obligations under that contract. Article 24 allows lawful arrangements including instalments, payment after delivery or temporary holding pending checks. Do not assume that every transaction requires full prepayment. 2

Agree an acceptance period and remedies for missing, inaccessible or defective outputs. The exchange’s confirmation evidences the transferred exploitation or use rights within the agreed scope; it does not establish data ownership. 2

Plan testing and analytics reporting before launch

Exchange testing must be isolated from production and external systems. Original data cannot be downloaded, copied or extracted. The initial limit is 30 days, with an operator-approved extension of up to 30 further days for complex products or large data volumes. 2

For AI evaluation, decide which outputs can leave the environment and how to prevent those outputs exposing original data. Testing access is not unrestricted training-data access.

Analytics providers also need to check the separate data-services framework. Decree 347/2026/ND-CP, effective from 15 September 2026, amended Decree 169/2025/ND-CP. Its Article 1 requires analysis and aggregation providers to notify the National Data Centre before operating and submit the annual BC01 report before 20 December. It also restructures certificate provisions, so notification should not be treated as a blanket replacement for every eligibility certificate. 4

A short pre-transaction checklist

• Identify the seller, buyer, intermediary and operator, and confirm the contracting entity’s eligibility.
• Assemble provenance records, input permissions and the exact rights offered.
• Complete the personal-data and prohibited-data review before uploading samples.
• Match listing descriptions, quality disclosures and API permissions to the contract.
• Confirm testing limits, registered payment arrangements, acceptance checks and applicable analytics notifications.

Coordinate these steps with the wider Vietnam market-entry plan, rather than treating exchange onboarding as a substitute for business-entry checks.

Focused questions

Does buying access make the buyer the data owner?

No. Article 25 expressly states that the rights confirmation does not confirm or create ownership. Check the contract’s purpose, duration and onward-transfer limits before using the product beyond the original project. 2

Can an AI team take the trial dataset into its own cloud environment?

Not under the exchange testing rules. Original data must remain within the exchange infrastructure and cannot be downloaded, copied or extracted. Agree permitted evaluation outputs with the operator and seller instead. 2

References

• 1 Government policy portal: Decree 314/2026/ND-CP on data exchanges, 17 August 2026
• 2 Government of Vietnam: signed Decree 314/2026/ND-CP, 8 August 2026
• 3 Government policy portal: full text of Data Law 60/2024/QH15
• 4 Government of Vietnam: Decree 347/2026/ND-CP amending data-service rules, 8 September 2026