Vietnam Introduces New Trading and Retail Rules for Foreign-Invested Enterprises
On 3 September 2026, the Government of Vietnam issued Decree No. 342/2026/ND-CP (“Decree 342“), detailing the implementation of Article 22 of Commercial Law No. 36/2005/QH11 and Article 5 of the Law on Foreign Trade Management No. 05/2017/QH14 in relation to the purchase and sale of goods, as well as activities directly related to such transactions, by foreign investors and foreign-invested economic organisations in Vietnam. Decree 342 will take effect on 18 October 2026 and replace Decree No. 09/2018/ND-CP dated 15 January 2018 (“Decree 09“).
Decree 342 retains the core licensing architecture under Decree 09 but recalibrates a number of important features, including the scope of regulated activities, treaty-based market access, provincial licensing authority, national-security consultation, the Economic Needs Test, licensing implications of foreign acquisitions of Vietnamese retail businesses, reporting obligations, licence duration and revocation.
For more information, click here to read our Legal Update.
Seven Decrees to Implement Vietnam's New Cybersecurity Regulatory Framework Issued
On 19 August 2026, the Government of Vietnam issued a package of seven decrees, Decree Nos. 327-333/2026/ND-CP, forming a significant part of the regulatory framework for implementing the new Cybersecurity Law and related cybersecurity and personal data protection requirements.
The package follows the entry into force of the Law on Cybersecurity No. 116/2025/QH15 (“Cybersecurity Law“) on 1 July 2026. As discussed in our January 2026 Legal Update titled “Law on Cybersecurity Comes into Operation on 1 July 2026: Establishing a Unified Legal Framework on Cybersecurity and Network Information Security in Vietnam“, the Cybersecurity Law consolidated and replaced the former Law on Cybersecurity 2018 and Law on Network Information Security 2015, thereby establishing a unified legal framework governing cybersecurity and network information security in Vietnam.
Although issued as a coordinated package, the seven decrees should not be characterised narrowly as seven implementing decrees of the Cybersecurity Law alone. In particular, Decree 330 establishes the administrative sanctions framework for personal data protection, while Decree 328 was issued pursuant to a broader body of legislation, of which the Cybersecurity Law is only one component.
Decrees 327 and 329 to 333 took effect on 19 August 2026, while Decree 328 took effect on 5 October 2026.
For businesses, Decrees 330 to 333 warrant particular attention. Collectively, they introduce or further elaborate requirements relating to personal data protection and cross-border personal data transfers, cybersecurity protection for information systems (IS),the licensing of cybersecurity products and services, regulatory cooperation, data localisation, and local presence requirements. Decrees 327 to 329, meanwhile, form part of the brader regualtory framework governing unlawful information and conduct in cyberspace, fake and false information, and cybersecurity protection forces.
For more information, click here to read our Legal Update.
Vietnam Strengthens Beneficial Ownership Transparency, Streamlines Enterprise Registration, and Introduces New Business Suspension Controls
On 23 July 2026, the Government of Vietnam issued Decree No. 296/2026/ND-CP (“Decree 296“), amending and supplementing Decree No. 168/2025/ND-CP on enterprise registration. Decree 296 took effect immediately on the date of its signing.
Decree 296 pursues two parallel policy objectives. On one hand, it facilitates enterprise registration through greater use of State databases and streamlined electronic procedures. On the other hand, it increases transparency regarding the individuals who ultimately own or control enterprises, and introduces tighter compliance requirements for enterprises that remain under prolonged business suspension.
The amendments form part of Vietnam’s broader efforts to implement the recommendations of the Organisation for Economic Co-operation and Development (OECD) Global Forum and align its beneficial-ownership framework with relevant Financial Action Task Force (FATF) standards, including measures contemplated under the Prime Minister’s National Action Plan in Decision No. 948/QD-TTg dated 27 May 2026.
For more information, click here to read our Legal Update.
Vietnam Issues Decree to Tighten Labour and Social Insurance Sanctions
On 15 July 2026, the Government issued Decree No. 283/2026/ND-CP on administrative sanctions in the fields of labour, social insurance, and Vietnamese workers working abroad under contract (“Decree 283“). Decree 283 took effect on 10 September 2026 and replaced Decree No. 12/2022/ND-CP, which had governed administrative sanctions in these fields since 2022. Decree 283 was promulgated in the context of the Law on Social Insurance No. 41/2024/QH15, effective from 1 July 2025, which introduces a statutory distinction between “late payment” and “evasion” of compulsory social insurance contributions. Decree 283 operationalises this distinction through two separate and more granular fine structures. It also expressly establishes a sector-specific mechanism for referring cases showing indications of criminal offences to the competent criminal proceedings authorities, clarifies the fine multipliers applicable to organisations and household businesses, and enables the fully electronic processing of administrative violations.
For more information, click here to read our Legal Update.
Please note that whilst the information in this Update is correct to the best of our knowledge and belief at the time of writing, it is only intended to provide a general guide to the subject matter and should not be treated as a substitute for specific professional advice
