- HM&P: Vietnam International Law Firm
- HM&P: Vietnam International Law Firm
- 02873080839
- https://hmplaw.vn/
Insights
From July 1, 2026, the Law on Cyber Security 2025 sets out a remarkable requirement: some agencies, organizations and state-owned enterprises must allocate at least 15% of the total funding for the implementation of digital transformation investment programs, schemes and projects, and the application of information technology to protect cybersecurity. The regulation seems to be just a percentage of the budget, but when it comes into practice, it raises a series of questions: What is the 15% calculated on, who is required to apply and how to spend it to both comply with the law, and avoid formal investment and financial waste for businesses?
Data on the Internet is becoming an important source of raw materials for training generative artificial intelligence (Gen AI). However, a piece of information that is made public does not mean that any organization has the right to collect, exploit and use it for commercial purposes. When the Law on Personal Data Protection takes effect from January 1, 2026, the problem for AI development businesses in Vietnam is not only how much data can be accessed, but also what legal basis is to use it.
In the past two years, the legal framework for data in Vietnam has shifted rapidly from a "protection" mindset to data governance throughout the life cycle. In just two months, the Government issued Decree 330/2026/ND-CP on sanctioning administrative violations in the field of cyber security and personal data protection and Decree 363/2026/ND-CP ("Decree 363") on sanctioning administrative violations in the field of data. Decree 363 was issued on September 19, 2026 and takes effect from November 11, 2026.
The use of cloud computing platforms ("Cloud") such as Microsoft 365, Amazon Web Services ("AWS"), Google Cloud or global ERP systems such as SAP, Oracle and Microsoft Dynamics has become a familiar infrastructure in business operations. On these systems, employee, customer, supplier, salary, transaction data and many other data for operation can exist simultaneously. Legal issues therefore do not stop at information security: depending on how the system is configured and operated, a purely technical storing, synchronization or processing operation can give rise to cross-border data transfers.
On November 11, 2026, Decree 363/2026/ND-CP on sanctioning administrative violations in the field of data ("Decree 363") officially took effect. For businesses, the issue worth noting is not only the new fines, but also the many data processing activities that are taking place on a daily basis: from collecting, storing, decentralizing access to hiring suppliers and transferring data abroad are now placed under a more specific sanction mechanism.
In M&A deals involving public companies, even a single purchase of a few percent of the shares can give rise to a public offer obligation that the investor does not properly identify or perform.
This Handbook has been prepared to provide a comprehensive and systematic overview of the key decisions, legal procedures and matters requiring careful consideration that an enterprise must master before, during and after conducting an IPO in Vietnam. The content is organized following the logical sequence of an actual IPO project, beginning with a self-assessment of readiness and identification of eligibility conditions, followed by comprehensive preparation in the areas of finance, corporate governance and legal matters, the process of working with state regulatory authorities and the stock exchange, and finally the ongoing obligations of a public company after its official listing.
In a merger and acquisition (M&A) transaction, due diligence always contains a paradox: to decide whether to buy a business and for how much, the buyer needs to know as much as possible; but to protect its business, the seller needs to control as tightly as possible what is disclosed.
Registration of security is often seen as a procedure that follows a credit contract. But in essence, this is one of the institutions that determines the safety of the capital market. Assets are only truly valuable as collateral when lenders can establish and publicize their rights, third parties can recognize the existence of those rights, and the order of priority can be determined with relative certainty when disputes arise or asset disposal.
The financial market only really plays a role when it can bring capital to the right place where it is needed, with reasonable costs, appropriate deadlines and controlled risks. Over the years, Vietnam has built an increasingly large financial system, but the market structure is still not truly balanced. The economy is also significantly dependent on bank credit; the stock market, bonds, insurance and long-term investment institutions have not developed commensurately; while many new financial products still lack legal corridors and operational infrastructure.
There are knowledge that take many years to accumulate but only after a new document have to be relearned. There are procedures that were once very familiar and suddenly become strange. There are tasks that a few years ago a young lawyer had to spend all day doing, today new tools can be handled in a few minutes.
The gap between these two issues is where the legal risk of a restructuring focuses. You can prove that departments have been merged, reports have changed, or the number of positions has decreased. The harder question remains: how has this change changed the demand for labor and why are specific workers affected?
-
-
