Việt Nam Opens a Legal Marketplace for Data: Nghị định 314/2026/NĐ-CP

Việt Nam has spent the past year building the enforcement side of its data regime — cybersecurity decrees, a fine schedule for privacy violations, sanctions for the crypto pilot. The newest piece points the other way: towards a legal market where data can actually be bought and sold. Nghị định 314/2026/NĐ-CP, issued by the Government on 8 August 2026 and effective from 25 September 2026, is the country’s first dedicated rulebook for sàn dữ liệu — data exchange platforms where datasets, data products, and data services are listed and traded.

What the document is

Nghị định 314/2026/NĐ-CP runs to 9 chapters and 38 articles and regulates the establishment and operation of data exchanges, applying to agencies, organisations, enterprises, and individuals involved in exchange activities. It implements Luật Dữ liệu số 60/2024/QH15, passed on 30 November 2024 and in force since 1 July 2025 — the framework law that created the Trung tâm dữ liệu quốc gia (National Data Center), the national general database, and the legal concepts of data products and data services. The Data Law promised that data could become a tradeable asset class; this decree supplies the market infrastructure.

Article 5 sets up a two-tier structure. At the top sits the Sàn dữ liệu quốc gia (National Data Exchange), built, managed, operated, and supervised by the National Data Center under the Bộ Công an. Alongside it, other data exchanges may operate — but they must maintain information-system security at level 3 or higher under Việt Nam’s classification scheme and must be capable of connecting and sharing data with the national exchange.

What changes compared to before

Until now, data trading in Việt Nam existed in two forms: an unregulated grey market (much of it trafficking in leaked personal data, now punishable under Nghị định 330/2026 at up to ten times the proceeds) and bilateral commercial contracts with no standard venue, no quality verification, and no provenance requirements. The Data Law named “sàn dữ liệu” as a concept in 2024 but left the operational detail open. From 25 September, that detail exists: who may trade, what may be listed, how accounts are opened, and how transactions are recorded.

The threshold rule is provenance. Under Article 17, data listed on an exchange must have a lawful, documented origin — sellers must be able to evidence how the data was collected, created, or acquired, and the platform is responsible for verifying it. Listings must meet quality, technical, safety, and security requirements: machine-readable formats, API documentation where relevant, and disclosed quality metrics.

Personal data gets the strictest treatment. Article 4(6) strictly prohibits exploiting a data exchange to buy or sell personal data or to process personal data unlawfully. Products or services derived from personal data may be listed only after they satisfy khử nhận dạng (de-identification) requirements under the personal data protection framework. The same logic extends to auctions: under Article 11(5), personal-data-derived products must be de-identified before auction, and platform operators must refuse auctions involving personal data or prohibited datasets.

Who it affects and how trading works

Participation is identity-verified end to end. Under Article 18, Vietnamese citizens, organisations, and enterprises register trading accounts through a level-2 VNeID electronic identification account (or other methods the platform provides), linked to a registered payment account or e-wallet. Payments must be non-cash and in Vietnamese đồng. Vietnamese organisations must be legally established and not in dissolution or bankruptcy proceedings; foreign entities need a commercial presence, branch, or representative office in Việt Nam; individuals need full civil capacity. Providers of conditional data services need operating certificates.

Operational rules are unusually concrete. Buyers may trial data products for a maximum of 30 days (extendable to 60 for complex cases), after which platforms must delete trial data within 24 hours (Article 13). Transaction records must be retained for at least 10 years from completion (Article 25).

For businesses sitting on valuable datasets — logistics, retail, telecom, mapping, industrial sensor data — the decree creates a sanctioned monetisation channel that did not exist before, with the compliance cost of proving provenance and de-identifying anything personal. For buyers, notably AI developers hungry for training data, it promises verified-origin datasets instead of scraped or leaked ones. For individuals, the design is defensive: your personal data cannot legally appear on an exchange, and everyone trading is identity-verified.

Open questions

The hardest one is technical: de-identification is a spectrum, and re-identification of “anonymised” datasets is a well-documented risk. How strictly platforms and regulators will assess khử nhận dạng — and who is liable if a de-identified product is re-identified after sale — will define how much of the data economy this market can actually carry. It also remains to be seen when the National Data Exchange will open for trading, how many private exchanges will clear the security and connectivity bar, and whether pricing and valuation practice for data products will converge on anything predictable. As with the rest of this year’s data legislation, the first months of operation will be the real guidance.

Sources

This post is general information, not legal advice.