Update on new regulations in March 2026

Our Newsletter #44 would lead you on the following:

LEGAL UPDATE

I. Labor registration

On 12 December 2025, the Government issued Decree No. 318/2025/ND-CP on labor registration and the labor market information system (“Decree 318”), effective from 01 January 2026, with notable provisions on labor registration as follows:

1. Subjects of labor registration

Pursuant to Article 18.2 of the Law on Employment 2025, employees are obligated to carry out labor registration. Decree 318 provides detailed regulations on subjects required to register labor, including:

1. Employees subject to compulsory social insurance participation;
2. Employees who are currently employed but not subject to compulsory social insurance participation;
3. Unemployed persons who are currently without jobs, seeking employment, and ready to work;
4. Officials, public employees, civil servants, and members of the people’s armed forces who are not required to carry out registration or adjustment of labor registration information;
5. Employees who self-declare their labor registration dossiers and bear legal responsibility for the truthfulness and accuracy of the declared information; and employers who are responsible for collecting, declaring, and providing full, accurate, and timely information on employees upon recruitment, changes, or termination of labor relations, and for ensuring the accuracy and truthfulness of such information.

2. Dossiers, order, and procedures for labor registration

Decree 318 classifies labor registration into 02 cases as follows:

2.1 For employees subject to compulsory social insurance participation

1. The labor registration dossier is the declaration form for social insurance participation issued by Vietnam Social Security;
2. Procedures:
   1. Employees provide relevant information to the employer in the declaration form specified in Clause 1 of this Article and are responsible for the accuracy of such information;
   2. Employers register or adjust labor registration information for employees when submitting dossiers for registration or adjustment of social insurance participation in accordance with the Law on Social Insurance and its guiding documents;
   3. After being received and processed by the social insurance authority, the employee’s labor registration information shall be synchronized and shared with the labor database.

2.2 For employees not subject to compulsory insurance and unemployed persons

1. The labor registration dossier is an electronic declaration form under Decree 318;
2. Form of registration: online;
3. Procedures:
   1. Employees access the National Employment Service Portal (https://vieclam.gov.vn) or the VNeID electronic identification application, select the function for registration or adjustment of labor registration information, and complete the electronic declaration form;
   2. The labor registration system receives, processes, and returns successful registration results immediately after completion of the electronic declaration form; in case of unsuccessful registration, the system shall provide reasons;
   3. The employee’s labor registration information is updated and synchronized with the labor database;
4. Where employees wish to seek employment, they shall register for job seeking using the prescribed form for employment services either directly at public employment service centers or online via the National Employment Service Portal or the VNeID application.

II. Electronic labor contracts

On 24 December 2025, the Government issued Decree No. 337/2025/ND-CP on electronic labor contracts (“Decree 337”), effective from 01 January 2026, with notable provisions as follows:

1. Conditions for execution of electronic labor contracts

Under Decree 337, the execution of electronic labor contracts must be conducted via an electronic transaction information system (eContract) that satisfies the following conditions:

1. Use of digital signature software and signature verification in compliance with the law on electronic transactions;
2. Implementation of security measures to ensure safety of customer information and electronic labor contract data; and technical solutions to maintain and restore contract authentication operations in case of incidents;
3. Storage solutions ensuring data integrity of electronic records and the ability to retrieve executed electronic labor contracts on the eContract system;
4. Functions ensuring proper identification of parties and authentication of identities in accordance with laws on electronic identification and authentication;
5. Technical measures to confirm that identified organizations and individuals have agreed to the contract contents;
6. Functions for authentication of electronic labor contracts in accordance with the law on electronic transactions, prior to submission to the electronic labor contract platform for ID assignment;
7. Functions allowing conversion between electronic labor contracts and written paper contracts in accordance with the law on electronic transactions;
8. Provision of electronic transaction accounts in compliance with the Law on Electronic Transactions;
9. Functions supporting employers in reporting labor utilization in accordance with labor laws via protocols and formats prescribed by the Ministry of Home Affairs;
10. Functions for aggregation, statistics, and periodic or ad hoc reporting to serve management of electronic labor contract transactions;
11. Connection via standardized application programming interfaces (APIs) with the electronic labor contract platform as prescribed by the Ministry of Home Affairs; and
12. Compliance with technical requirements on information security in accordance with cybersecurity laws.

2. Conditions applicable to employers and employees

Under Decree 337, employers and employees must satisfy the following conditions:

1. For individual employees and employers: valid identification documents including citizen identity card, identity card, electronic identity, certificate of identity, level-2 electronic identification account, or a valid passport; valid visa or documents evidencing visa exemption (for foreign individuals);
2. For employers being enterprises, agencies, organizations, cooperatives, or households: establishment decision or documents defining functions, duties, powers, and organizational structure, or enterprise registration certificate, investment registration certificate, or household business registration certificate; and identification documents of the legal representative, including citizen identity card, identity card, certificate of identity, level-2 electronic identification account, or valid passport; valid visa or visa exemption documents (for foreign individuals);
3. Possession of digital signatures and use of timestamp services in accordance with the law on electronic transactions.

3. Conditions applicable to eContract service providers

Under Decree 337, eContract service providers must satisfy the following conditions:

1. The eContract system must meet the conditions set out in Section II.1 above;
2. Availability of solutions and technologies to collect, verify, and match identification information of organizations and individuals, including biometric data of the legal representative (such as fingerprints, facial features, iris, voice, and other biometric identifiers) with corresponding information and biometric data on identification documents specified in Section II.2 above, ensuring accurate identification and authentication in accordance with applicable laws;
3. Possession of a license for trust services, including authorization to provide data message authentication services in accordance with the law on electronic transactions.

III. Guidance on the Personal Data Protection Law 2025

On 31 December 2025, the Government issued Decree No. 356/2025/ND-CP detailing a number of articles and measures for implementation of the Personal Data Protection Law (“Decree 356”), effective from 01 January 2026, with notable provisions on personal data protection as follows:

1. Guidance on the exercise of data subject rights

The rights of personal data subjects are guided in Article 5 of Decree 356 as follows:

1. Right to be informed about personal data processing activities: Personal data controllers and controller-processors must establish clear procedures, processes, and forms to enable data subjects to exercise their rights in accordance with personal data processing activities and the responsibilities of relevant departments; ensuring that data subjects are informed of the procedures for exercising the rights prescribed in Clause 1, Article 4 of the Personal Data Protection Law.
2. Right to consent, refuse consent, or withdraw consent to personal data processing:
   • Upon receiving a request to withdraw consent, restrict processing, or object to personal data processing in accordance with the data subject’s procedures, the personal data controller or controller-processor must respond within 02 working days, provide full information on the procedures for ceasing processing, and implement such cessation within 15 days, except where processing does not require consent under Article 19 of the Personal Data Protection Law. If it is necessary to request a processor or third party to cease processing, this must be completed within 20 days.
   • Depending on the nature and complexity of the request, the processing time may be extended maximally once for no more than 15 additional days. The controller or controller-processor must notify the data subject of the reason for the extension and be responsible for proving that the extension is necessary and reasonable.
3. Right to access, rectify, or request rectification of personal data:
   • Upon receiving a request to access, rectify, or request the rectification of personal data, or to provide personal data in accordance with the procedures established by the data subject, the personal data controller or the controller-processor must respond within 02 working days, provide the data subject with complete information regarding the applicable procedures, and complete the request within 10 days. Where it is necessary to request a personal data processor or a third party to rectify the personal data of the data subject, such rectification must be completed within 15 days.
   • Depending on the nature and level of complexity of the request, where an extension of the processing time is necessary, only one extension may be granted for a period not exceeding 10 additional days. The personal data controller or the controller-processor must notify the data subject of the reason for the extension and bear the responsibility for demonstrating that such extension is necessary and reasonable.
4. Right to request provision, deletion, restriction of processing of personal data; and to submit a request to object to the processing of personal data:
   • Upon receiving a request for deletion of personal data in accordance with the procedures established by the data subject, the personal data controller or the controller-processor must respond within 02 working days, provide the data subject with complete information regarding the applicable procedures, and complete the request within 20 days. Where it is necessary to request a personal data processor or a third party to provide, delete, or restrict the processing of the data subject’s personal data, such actions must be completed within 30 days.
   • Depending on the nature and level of complexity of the request, where an extension of the processing time is necessary, only one extension may be granted for a period not exceeding 20 additional days. The personal data controller or the controller-processor must notify the data subject of the reason for the extension and bear the responsibility for demonstrating that such extension is necessary and reasonable.
5. Right to lodge complaints, denunciations, lawsuits, or claim damages: Currently, Decree 356 does not provide detailed guidance on this matter; however, reference may be made to item (vi) below.
6. Right to request competent authorities or relevant organizations and individuals to implement measures to protect personal data:
   • Upon receiving a request to implement measures or solutions to protect the data subject’s personal data in accordance with the procedures established by the data subject, the competent authority or any agency, organization, or individual involved in personal data processing must respond within 02 working days, provide the data subject with complete information regarding the applicable procedures, and implement such measures within 15 days.
   • Depending on the nature and level of complexity of the request, where an extension of the processing time is necessary, only one extension may be granted for a period not exceeding 15 additional days. The personal data controller or the controller-processor must notify the data subject of the reason for the extension and bear the responsibility for demonstrating that such extension is necessary and reasonable.

2. Methods of expressing consent by data subjects

Decree 356 provides detailed guidance on methods for obtaining consent from personal data subjects, enabling enterprises to identify valid forms as follows:

1. The methods for obtaining the consent of the personal data subject must ensure verifiability regarding the identification of the data subject who has given consent, as well as the time and content of such consent, including:
   1. In writing;
   2. Recorded phone calls;
   3. Consent express via SMS;
   4. Via email, websites, platforms, or applications with technical consent mechanisms;
   5. Other appropriate methods that can be printed or reproduced in writing, including electronic or verifiable formats.
2. Controllers and controller-processors must retain records of the data subject’s consent. In the event of a dispute, the burden of proof regarding consent lies with the controller or controller-processor.
3. Controllers and controller-processors must not establish default consent mechanisms or unclear instructions that may mislead data subjects between consent and non-consent. Default settings must comply with personal data protection principles and respect data subject rights.
4. When seeking consent to process sensitive personal data, the data subject must be informed that the data involved is sensitive personal data.

The above is not official advice from BLawyers Vietnam. If you have any questions or suggestions about the above, please contact us at info@blawyersvn.com. We would love to hear from you.

Date: 30 March 2026

Writer: BLawyers Vietnam

Legal News and Update Team

PUBLISHED ARTICLES

• Digital assets recognized in Vietnam: What do businesses and individuals need to know about capital contributions and inheritance?
• Making a will in Vietnam for a foreign child under 18: commonly overlooked conflict-of-law issues
• Foreign loans and conversion into equity in a Vietnamese company: 3 key considerations for foreign investors
• Compensation for AI related damages

DIGITAL AUDIO PROGRAM

• PODCAST: #33 Handling sexual harassment in the workplace: Where are employers getting it wrong?

PUBLISHED LEGAL NEWSLETTERS

• Update on new regulations in February 2026

CONTACT US

✍ Legal News and Update Team
📩 legalnews@blawyersvn.com

For Downloading: 

Newsletter #44 (EN version)

Maybe you are interested in reading other Newsletters of BLawyers Vietnam: Legal Newsletter in November 2025/ Legal Newsletter in December 2025/ Legal Newsletter in January 2026