In the past two years, the legal framework for data in Vietnam has shifted rapidly from a "protection" mindset to data governance throughout the life cycle. In just two months, the Government issued Decree 330/2026/ND-CP on sanctioning administrative violations in the field of cyber security and personal data protection and Decree 363/2026/ND-CP ("Decree 363") on sanctioning administrative violations in the field of data. Decree 363 was issued on September 19, 2026 and takes effect from November 11, 2026.
The use of cloud computing platforms ("Cloud") such as Microsoft 365, Amazon Web Services ("AWS"), Google Cloud or global ERP systems such as SAP, Oracle and Microsoft Dynamics has become a familiar infrastructure in business operations. On these systems, employee, customer, supplier, salary, transaction data and many other data for operation can exist simultaneously. Legal issues therefore do not stop at information security: depending on how the system is configured and operated, a purely technical storing, synchronization or processing operation can give rise to cross-border data transfers.
On November 11, 2026, Decree 363/2026/ND-CP on sanctioning administrative violations in the field of data ("Decree 363") officially took effect. For businesses, the issue worth noting is not only the new fines, but also the many data processing activities that are taking place on a daily basis: from collecting, storing, decentralizing access to hiring suppliers and transferring data abroad are now placed under a more specific sanction mechanism.
In M&A deals involving public companies, even a single purchase of a few percent of the shares can give rise to a public offer obligation that the investor does not properly identify or perform.
This Handbook has been prepared to provide a comprehensive and systematic overview of the key decisions, legal procedures and matters requiring careful consideration that an enterprise must master before, during and after conducting an IPO in Vietnam. The content is organized following the logical sequence of an actual IPO project, beginning with a self-assessment of readiness and identification of eligibility conditions, followed by comprehensive preparation in the areas of finance, corporate governance and legal matters, the process of working with state regulatory authorities and the stock exchange, and finally the ongoing obligations of a public company after its official listing.
In a merger and acquisition (M&A) transaction, due diligence always contains a paradox: to decide whether to buy a business and for how much, the buyer needs to know as much as possible; but to protect its business, the seller needs to control as tightly as possible what is disclosed.
Registration of security is often seen as a procedure that follows a credit contract. But in essence, this is one of the institutions that determines the safety of the capital market. Assets are only truly valuable as collateral when lenders can establish and publicize their rights, third parties can recognize the existence of those rights, and the order of priority can be determined with relative certainty when disputes arise or asset disposal.
