According to the dossier of the Draft Law amending and supplementing a number of articles of the Law on Commercial Arbitration (Draft) which is expected to be considered by the XVI National Assembly at the 2nd Session (October 2026) and take effect from March 1, 2027, the focus of this amendment is on the decentralization of management of arbitration institutions. However, for enterprises, it is worth paying attention to the stability of the selected arbitration institution and the ability to continue to resolve disputes when that institution terminates its operation. These risks should be distinguished from procedural inadequacies that already exist under current law.
When personal data becomes an integral part of business activities, disputes not only arise between businesses and data subjects, but also between parties involved in data processing. The Law on Personal Data Protection 2025 (Law on PDP) sets out the requirement to protect the rights of data subjects, and also raises the issue of the mechanism for resolving related disputes.
One of the important advantages of commercial arbitration is the right of the parties to choose a dispute resolver. However, businesses should not equate an arbitrator with an outstanding reputation or professional profile with a suitable person for its case. The suitability depends on the nature of the dispute, legal issues or decisive evidence, the capacity to administer the proceedings, and the requirement for independence and objectivity. Therefore, the selection of arbitrators must be prepared as a strategic decision, which can significantly affect the time, cost, and efficiency of dispute resolution.
Bank guarantees are often considered by businesses as the last layer of protection when the partner fails to fulfill their obligations. But having a letter of guarantee in hand does not mean that money is guaranteed. In many disputes, the deciding issue is not only whether the guaranteed party is in breach of contract, but whether the guarantee commitment is actually valid and whether the payment request meets the conditions of that commitment exactly.
From July 1, 2026, the Law on Cyber Security 2025 sets out a remarkable requirement: some agencies, organizations and state-owned enterprises must allocate at least 15% of the total funding for the implementation of digital transformation investment programs, schemes and projects, and the application of information technology to protect cybersecurity. The regulation seems to be just a percentage of the budget, but when it comes into practice, it raises a series of questions: What is the 15% calculated on, who is required to apply and how to spend it to both comply with the law, and avoid formal investment and financial waste for businesses?
Data on the Internet is becoming an important source of raw materials for training generative artificial intelligence (Gen AI). However, a piece of information that is made public does not mean that any organization has the right to collect, exploit and use it for commercial purposes. When the Law on Personal Data Protection takes effect from January 1, 2026, the problem for AI development businesses in Vietnam is not only how much data can be accessed, but also what legal basis is to use it.
In the past two years, the legal framework for data in Vietnam has shifted rapidly from a "protection" mindset to data governance throughout the life cycle. In just two months, the Government issued Decree 330/2026/ND-CP on sanctioning administrative violations in the field of cyber security and personal data protection and Decree 363/2026/ND-CP ("Decree 363") on sanctioning administrative violations in the field of data. Decree 363 was issued on September 19, 2026 and takes effect from November 11, 2026.
