Update on new regulations in September 2026 (Planning and Investment, Foreign-Invested Trading, and Cybersecurity & Personal Data)

September Newsletter

Our Newsletter #50 would lead you on the following:

LEGAL UPDATE

I. New administrative penalty framework for the planning and investment sector

On 21 July 2026, the Government issued Decree No. 288/2026/ND-CP (“Decree 288/2026”), amending and supplementing certain articles of Decree No. 122/2021/ND-CP dated 28 December 2021, regarding administrative penalties in the fields of planning and investment (“Decree 122/2021”). Decree 288/2026 officially took effect on the date of its issuance.

Decree 288/2026 adjusts and supplements the penalties applicable to violations relating to enterprise registration, registration of changes to enterprise registration information, and beneficial owner information. Key changes include the following:

1. Increased fines of up to VND70,000,000 for violations related to enterprise registration dossiers and applications to amend the Enterprise Registration Certificate (“ERC”)

  1. Untruthful or inaccurate declarations in enterprise registration dossiers
    1. Under the Law on Enterprises 2020, as amended and supplemented in 2025, making false, untruthful or inaccurate declarations in enterprise registration dossiers or dossiers for registration of changes to enterprise registration information is prohibited.
    2. Decree 288/2026 increases the applicable fine to between VND30,000,000 and VND70,000,000 for untruthful or inaccurate declarations in dossiers for enterprise establishment registration, registration of operation of branches and representative offices; dossiers for registration of changes to enterprise registration information, branch, representative office or business location information; notices of changes to enterprise registration information; notices of establishment of business locations; and enterprise dissolution dossiers.
  2. Late change or failure to register changes to the ERC
    For late registration or notification of changes as required by law, the applicable penalty is determined based on the duration of the delay, as follows:

    • A warning for a delay of 01 to 10 days;
    • A fine of VND10,000,000 to VND20,000,000 for a delay of 11 to 30 days;
    • A fine of VND30,000,000 to VND40,000,000 for a delay of 31 to 90 days; and
    • A fine of VND50,000,000 to VND60,000,000 for a delay of 91 days or more.

Failure to register or notify changes as required by law may be subject to a fine of between VND30,000,000 and VND70,000,000.

2. Increased fines of up to VND100,000,000 for violations related to beneficial owners

Decree 288/2026 supplements and adjusts the penalties applicable to violations relating to the declaration, notification and supplementation of beneficial owner information and information used to determine beneficial owners, as follows:

  1. A fine of VND30,000,000 to VND70,000,000 may be imposed for untruthfully or inaccurately declaring information regarding beneficial owners or information used to identify beneficial owners in enterprise registration dossiers, dossiers notifying changes to beneficial owner information, or notifications of changes to information used to identify beneficial owners;
  2. A fine of between VND30,000,000 and VND70,000,000 shall be imposed for failure to notify changes to information regarding the ultimate beneficial owner or information used to identify the ultimate beneficial owner; and
  3. For enterprises established before 01 July 2025, a fine of between VND70,000,000 and VND100,000,000 may be imposed for failure to supplement information on the enterprise’s beneficial owner, if any, or information used to determine the enterprise’s beneficial owner, if any, at the time the enterprise carries out the procedure for registering changes to its enterprise registration information or makes its most recent notification of changes to enterprise registration information.
  4. In addition to monetary fines, violating enterprises may be subject to the remedial measure of being required to supplement beneficial owner information or information used to determine beneficial owners.
II. Goods trading and activities directly related to goods trading by foreign investors

On 03 September 2026, the Government issued Decree No. 342/2026/ND-CP detailing the Law on Commerce and the Law on Foreign Trade Management regarding goods trading and activities directly related to goods trading by foreign investors and foreign-invested economic organizations in Vietnam (“Decree 342/2026”).

Decree 342/2026, which officially takes effect on 18 October 2026, stipulates the conditions for foreign investors to be granted business licenses and licenses to establish retail outlets, specifically as follows:

1. Expanded scope of goods trading activities that foreign-invested economic organizations (“FDI Enterprises”) may conduct without a business license

Decree No. 342/2026 specifically identifies the goods trading activities and activities directly related to goods trading conducted by FDI Enterprises that are subject to a Business license (also called as Business permit, Trading permit or Trading license). Outside these cases, FDI Enterprises may conduct goods trading activities after registering the corresponding activities in their investment and enterprise registration dossiers.

For activities subject to a Business license, the licensing conditions vary depending on the investor’s country or territory and Vietnam’s market-opening commitments applicable to the relevant activity. In particular:

  1. For investors from countries or territories with market-opening commitments with Vietnam: the investors must satisfy the market access conditions under the applicable international treaties in accordance with the investment laws. Where the economic organization has been established in Vietnam for at least 01 year, it must not have any overdue tax liabilities;
  2. For investors not falling within the above case or activities for which Vietnam has not made market-opening commitments: in addition to tax compliance requirements, the licensing authority will consider compliance with relevant specialized laws, the competitiveness of domestic enterprises, and factors relating to sector development strategies and Vietnam’s market-opening process; and
  3. For certain goods for which Vietnam has not made market-opening commitments, including petroleum-based lubricants and grease, rice, sugar, recorded visual materials, books, newspapers and magazines, Decree 342 provides specific conditions applicable to import rights, wholesale distribution rights and retail distribution rights.

Notably, for investors from countries or territories without market-opening commitments with Vietnam, the licensing authority may further consider factors such as diplomatic relations, national defense, national security, public order and social safety before deciding whether to grant the Business license.

2. Conditions for the issuance of a license to establish a retail outlet

Decree No. 342/2026 sets out specific conditions for foreign investors to establish retail outlets, distinguishing between the first retail outlet and subsequent retail outlets. For subsequent retail outlets, whether an Economic Needs Test (“ENT”) is required is determined on a case-by-case basis.

  1. For the first retail outlet, foreign investors must satisfy the basic conditions relating to tax obligations and the business location. In particular, where the economic organization has been established in Vietnam for at least one year, it must not have any overdue tax debts. In addition, the proposed retail outlet location must comply with relevant regulations on land management, planning, investment, construction, fire prevention and fighting, traffic safety, and environmental sanitation.
  2. For retail outlets other than the first retail outlet, foreign investors are subject to either an ENT exemption or an ENT requirement, depending on the applicable case. Where an ENT is required, in addition to the basic conditions mentioned above, the foreign investor must satisfy the ENT criteria prescribed under Decree 342/2026.

Notably, Decree 342/2026 specifically determines the geographical market area affected for the purpose of the ENT.

    • For a retail outlet with an area of less than 5,000 m², the relevant geographical market area is considered at the commune/ward or equivalent level; and
    • For a retail outlet with an area of 5,000 m² or more, the relevant geographical market area is considered at the provincial or centrally administered municipal level.

The ENT assessment also takes into account factors including the impact of the proposed retail outlet on market stability and existing retail outlets and traditional markets in the area; market demand and the capacity of the proposed retail outlet to meet such demand; its contribution to local socio-economic development; and requirements concerning security, public order and social safety.

In addition to the above conditions, the licensing authority may consider the conformity of the proposed retail outlet with local, regional and national sectoral development plans and strategies. For foreign investors from countries or territories without market-opening commitments with Vietnam, the licensing authority will also consider the progress and demand for market opening, diplomatic relations, and requirements relating to national defense, national security, public order and social safety.

III. Administrative penalties in cybersecurity and personal data protection

On 19 August 2026, the Government issued Decree No. 330/2026/ND-CP (“Decree 330/2026”) on administrative penalties for violations in the fields of cybersecurity and personal data protection. Decree 330/2026 provides for forms of administrative sanctions, fines, remedial measures and the statute of limitations for administrative penalties applicable to violations in these fields and takes effect from 19 August 2026, with the following notable provisions:

1. Maximum fines for violations of cybersecurity and personal data protection regulations

For violations of cybersecurity regulations, Decree 330/2026 provides for a maximum fine of VND200,000,000 for an organization and VND100,000,000 for an individual for a single violation.

For violations of personal data protection regulations, the maximum fines applicable to organizations are determined based on the relevant types of violations, including:

  1. Illegal purchase or sale of personal data: a maximum fine of 10 times the proceeds obtained from the violation;
  2. Violations of regulations on cross-border transfer of personal data: a maximum fine of 5% of the preceding financial year’s revenue of the violating organization; and
  3. Other violations of personal data protection regulations: a maximum fine of VND3,000,000,000.

For individuals, the maximum fine applicable to the above-mentioned personal data protection violations is half the corresponding fine applicable to organizations.

2. Additional sanctions that may affect business operations

In addition to warnings and fines, Decree 330/2026 provides for additional sanctions that may be imposed depending on the nature and severity of the violation. Accordingly, violating organizations and individuals may be subject to revocation of the right to use licenses or practicing certificates for a period of between 01 month and 24 months with respect to certain licenses and certificates, including licenses for providing social network services, licenses for establishing aggregated electronic information websites, licenses for trading in cybersecurity products and services, and certificates of eligibility for providing personal data processing services.

In addition, Article 4 of Decree 330/2026 provides for suspension of operations for a period of between 01 month and 24 months, confiscation of exhibits and means used for administrative violations, and expulsion of foreign individuals committing violations.

3. Statute of limitations for administrative penalties

Decree 330/2026 provides that the statute of limitations for administrative penalties for violations in the fields of cybersecurity and personal data protection is 01 year.

For the purpose of determining the end of a violation, Decree 330/2026 provides that the violation is deemed to have ended when the individual or organization has fulfilled the relevant obligation or when the violation has actually ceased, as confirmed by the competent authority.

The competent authority shall determine whether a violation has ended or is ongoing based on relevant legal regulations, case files, documents and circumstances of the case in accordance with the law on handling administrative violations.

The above is not official advice from BLawyers Vietnam. If you have any questions or suggestions about the above, please contact us at info@blawyersvn. We would love to hear from you.

Date: 30 September 2026

Writer: Blawyers Vietnam

Legal News and Update Team

PUBLISHED ARTICLES

DIGITAL AUDIO PROGRAM

PUBLISHED LEGAL NEWSLETTERS

CONTACT US

✍ Legal News and Update Team
📩 legalnews@blawyersvn.com

For Downloading: 

Newsletter #50 (EN version)

Maybe you are interested in reading other Newsletters of BLawyers Vietnam: Legal Newsletter in May 2026/ Legal Newsletter in June 2026/ Legal Newsletter in July 2026

blawyersvn-cta-image

Request a consultation

To schedule a meeting with BLawyers Vietnam’s attorneys, please call us or complete the intake form below. We will respond within 24 hours.

This field is for validation purposes and should be left unchanged.