ALIAT – Decree No. 320/2026/ND-CP: New regulations on electronic identification and authentication

On 13 August 2026, the Government issued Decree No. 320/2026/ND-CP amending and supplementing a number of provisions of Decree No. 69/2024/ND-CP dated 25 June 2024 on electronic identification and authentication (“Decree 320”).

Decree 320 does not replace Decree No. 69/2024/ND-CP in its entirety, but amends and expands the mechanisms for electronic identification, data integration and the use of electronic identification accounts in administrative procedures, public services and transactions in the digital environment. Below are some notable provisions of Decree 320:

No requirement to resubmit documents already integrated into VNeID

Decree 320 requires agencies, organizations and individuals, when receiving and handling administrative procedures, public services, civil transactions and other activities, to access and use electronic identities, information and documents already integrated into VNeID; at the same time, individuals and organizations must not be required to submit or present originals or copies of documents and materials that have already been integrated.

This provision has significant practical implications for the digitalization of documents relating to administrative procedures. Where documents have actually been integrated and can be accessed from the system, continuing to require a duplicate set of paper documents is, in principle, no longer appropriate.

However, enterprises need to distinguish between not having to resubmit documents that have already been integrated and obligations to inspect, appraise or retain documents under sector-specific laws. The fact that documents integrated into VNeID do not have to be presented under Decree 320 does not automatically abolish the obligation to retain such documents in accordance with law.

Foreigners may be issued electronic identification accounts without classification by level

Under the previous provisions of Decree No. 69/2024/ND-CP, electronic identification accounts of foreigners were classified into Level 1 and Level 2 accounts, with different conditions, scopes of use and issuance procedures. Eligible persons were basically foreigners who had been issued permanent residence cards or temporary residence cards in Vietnam.

Decree 320 abolishes the classification of electronic identification accounts of foreigners by level, while expanding the eligible persons to foreigners who lawfully enter Vietnam or lawfully reside in Vietnam and have a need to obtain an account.

The procedure for issuance of electronic identification accounts to foreigners is carried out in person at the provincial-level immigration authority. Foreigners present their passports or international travel documents, complete the application form under Form TK01, provide a mobile phone number registered in their own name, an email address (if any), and have their facial images and fingerprints collected. The processing time is shortened to no more than 02 working days if the National Database on Immigration already contains facial image and fingerprint information, or no more than 05 working days if such biometric data is not yet available.

For enterprises having foreign investors, legal representatives, experts or managers, this change may expand the ability to use VNeID in administrative procedures and electronic transactions.

Organizations may be issued electronic identification accounts without classification by level

Agencies and organizations established or registered to operate in Vietnam may also be issued electronic identification accounts upon request without classification by level.

At the same time, the time limit for issuing an account where the organization’s information needs to be verified because it is unavailable in a national database or specialized database is also shortened from no more than 15 days to no more than 10 working days from the date of receipt of a complete and valid application.

VNeID becomes a focal point for carrying out administrative procedures and electronic communications

Decree 320 clarifies the legal validity of electronic information in electronic identification and authentication activities. Accordingly, the use of electronic identity information and information and documents integrated into electronic identity cards, electronic identification accounts or electronic identification and authentication systems has the same legal validity as providing the corresponding information or presenting the corresponding documents when carrying out administrative procedures, public services, transactions and other activities.

An electronic identity holder may use VNeID to create and submit an application for settlement of administrative procedures. The application is transmitted from VNeID to the National Public Service Portal; the processing result is transmitted back from the National Public Service Portal to VNeID for notification to the individual, agency or organization.

In addition to login and authentication functions, Decree 320 also establishes a communication channel on the National Electronic Identification Application for citizens holding Level 2 accounts, foreigners, agencies and organizations holding electronic identification accounts. State agencies, political organizations and socio-political organizations may send notifications and receive feedback and petitions through this channel. Enterprises should therefore consider VNeID as an official information-receiving channel that needs to be assigned for monitoring, rather than merely as a login tool.

Expansion of document integration and data updates on VNeID

Decree 320 establishes a mechanism for automatic synchronization and updating of documents that do not constitute State secrets and are issued by competent agencies or organizations if the database of the issuing agency has been connected to the electronic identification and authentication system. In principle, when information or documents change, the issuing agency must immediately update them. If the document-issuing agency does not yet have a connected database, the electronic identity holder may submit a request for integration through VNeID. Within 05 working days from the date the system receives the request, the competent document-issuing agency must receive, process and approve the integration request in accordance with the guidance of the Ministry of Public Security.

The Appendix enclosed with Decree 320 adds 206 types of documents that may be integrated, including 66 types of documents issued to individuals and 140 types of documents issued to agencies and organizations. For enterprises, this list includes many commonly used documents such as Enterprise Registration Certificates, Certificates of Registration of Branch/Representative Office Operations, Tax Registration Certificates and many sector-specific licences and certificates of satisfaction of business conditions.

The inclusion of a type of document in the list of documents eligible for integration does not mean that the data will immediately be available on VNeID at all times. Actual accessibility still depends on whether the database of the issuing agency has been connected, whether the data has been accurately synchronized and whether the specific document has been updated to the account of the relevant holder.

Mandatory linkage and authentication of electronic transaction accounts with electronic identification accounts

One of the notable changes under Decree 320 is the addition of a requirement to link and authenticate electronic transaction accounts with electronic identification accounts for certain activities on digital platforms.

Accordingly, electronic transaction accounts as prescribed by the law on electronic transactions on digital platforms serving activities in the following sectors must be linked and authenticated with electronic identification accounts:

education and digital literacy;
securities, telecommunications and banking;
e-commerce, including accounts of sellers, livestream sellers and affiliate marketers as prescribed by the Law on E-Commerce;
electronic invoices, transport business, tourism business, pharmaceutical business and medical examination and treatment; and
social networks in Vietnam.

For electronic transaction accounts on digital platforms serving national defence and security activities or providing cross-border services, linkage and authentication with electronic identification accounts must be completed before use.

Decree 320 provides important transitional deadlines for accounts created before 28 September 2026:

No later than 31 December 2026: accounts in the above-mentioned sectors, except for the banking sector, must complete linkage and authentication with electronic identification accounts.
No later than 30 June 2027: accounts in the banking sector must complete linkage and authentication.

For this purpose, national digital platforms must integrate the use of electronic identification accounts for authentication, login and transaction purposes no later than 31 December 2026. Enterprises in the regulated sectors should promptly review their login architecture, customer identity verification/authentication processes, terms of use, consent mechanisms and migration plans for existing accounts to avoid concentrating the work at the end of the transitional period.

Enhanced requirements on cybersecurity, transparency in data access and restrictions on data sharing

For agencies and organizations eligible to directly connect their information systems to the electronic identification and authentication system, Decree 320 requires the cybersecurity protection plan of the information system to meet at least Level 3. The connection dossier must clearly state the scope and purpose and include documents evidencing satisfaction of cybersecurity conditions; the system management authority may conduct cybersecurity and information security inspections before connection.

Agencies and organizations connected to, accessing and using information and documents in the system must also retain and provide access histories for display to electronic identity holders. Such history includes the type of information and documents accessed, the purpose, number of accesses, time and accessing party. At the same time, information and documents authenticated or accessed from the system must not be further shared with another party, unless requested by the data subject or otherwise provided by law.

Accordingly, enterprises that connect to or use data from the identification system need to simultaneously review access control mechanisms, system logs, personal data protection policies, purposes of data processing and data-sharing flows to service providers or companies within the same group. Successful authentication of data on VNeID does not create a right to use such data for purposes beyond the permitted scope.

Some other changes to note

In addition to the above contents, Decree 320 also adds a social welfare account on VNeID, allowing the integration of one payment account, e-wallet or mobile money account registered in the holder’s own name to receive support payments, pensions and social welfare payments.

Decree 320 also expands the conditions for using automated immigration control gates for Vietnamese citizens and foreigners whose immigration data or electronic identification accounts satisfy the prescribed conditions.

Overall, Decree 320 promotes the use of electronic identification accounts as a common authentication layer for the public sector and many digital transactions in the private sector. Decree 320 is considered to take the National Electronic Identification Application (VNeID) a further step from an electronic identification tool to shared infrastructure for accessing documents, carrying out administrative procedures, receiving notifications and authenticating electronic transaction accounts.

These changes have a direct impact on enterprises operating digital platforms, enterprises in the sectors listed under Decree 320, enterprises having foreign employees or managers and organizations that regularly carry out online public administrative procedures. In this context, enterprises should prioritize determining whether they fall within the sectors subject to mandatory account linkage, reviewing the electronic identification accounts of the organization and its foreign representatives/managers, and assessing technical integration capabilities and data protection requirements ahead of the transitional deadlines at the end of 2026 and in mid-2027.