Insights
The Law on Personal Data Protection 2025 and Decree 356/2025/ND-CP have created a clearer legal basis for the use of external organizations to provide personal data protection services. For businesses that do not have enough resources to build a dedicated apparatus, outsourcing DPO (Data Protection Officer) can be a quick way to add legal, technological and data governance capacity. Therefore, outsourced DPO is becoming the choice of many businesses when personal data protection is no longer just a compliance requirement but has become a content of corporate governance. However, the popularity of this model also leads to a fairly common misconception: hiring a DPO means that the business has solved the problem of data protection.
As personal data protection gradually becomes a requirement of corporate governance, the question is no longer whether businesses need a Data Protection Officer (DPO) or not. What businesses are interested in now is how to organize this function: building an internal DPO, outsourcing or a combination of both.
It is worth noting that Decree 333/2026/ND-CP ("Decree 333") was officially issued on August 19, 2026, not only in the addition of cybersecurity obligations. More importantly, many requirements have been concretized in a way that directly impacts systems, processes and how businesses operate digital services.
This difference is especially obvious when businesses outsource personal data protection (DPO). The question is not really whether the outsourced DPO is a personal data processor or not, but whether the business is correctly determining the role of the DPO in each data processing activity. This is also the starting point of many confusions in practice and the reason why many businesses are designing the whole data management system on a legal premise that is not really accurate.
The publication "Practical challenges in applying corporate income tax exemptions for small and medium-sized enterprises" was drafted and published by HM&P to provide businesses, business managers and interested individuals and organizations with a practical, easy-to-understand and easy-to-apply view. The content of the publication is presented in the form of questions and answers, closely following current legal regulations, especially Resolution no. 198/2025/QH15, Decree no. 20/2026/ND-CP and official letters answering the reality of the tax authorities for specific situations arising in the process of application.
For many years, when it comes to Double Taxation Agreement (DTA), most businesses think of a very specific benefit: how to get tax exemptions, reductions, or avoid being taxed twice on the same income. That approach isn't wrong, but it's becoming more and more narrow. In the context of capital flows, data and profits moving across borders on an unprecedented scale, today's international tax disputes no longer stem mainly from businesses deliberately evading tax obligations, but more from differences in how countries determine their taxation rights. interpret the same provisions of the Agreement or assess the nature of the same transaction.
In the competition to attract and retain personnel, businesses are increasingly shifting their focus from salaries to welfare policies. Tuition support for employees’ children is one of the policies that are quite commonly applied, especially in foreign-invested enterprises or employing a lot of high-quality workers. From a management perspective, this is considered an investment to improve talent retention. However, from a tax perspective, the story is not so simple.
One of the notable paradoxes in tax administration today is that a transaction can be completely real but still becomes the subject of review when the supplier is found to be illegally buying and selling invoices. On the contrary, the fact that a business is investigated for invoices does not mean that all of its customers are violating the law.
For many businesses, it is quite a normal financial decision for shareholders or members to temporarily lend money to the company to solve liquidity needs. When it is necessary to pay a debt due, discharge assets at the bank or handle a short-term cash flow shortfall, capital from the shareholders themselves is often faster, more flexible and less expensive than borrowing from a credit institution. In many cases, the parties also agreed on an interest rate of 0%.
A provision to maintain order in the trial may be necessary. But when the chosen measure no longer stopped at controlling audio and video recording, but changed to prohibiting the bringing of phones, computers and electronic devices into the courtroom, the story was no longer just a court rule. It raises a larger question: how far does the body that issues documents under the law go when "manage" at the same time narrows the rights guaranteed by the Constitution and the law?
Just over three years after the Law on on Anti-money Laundering (AML) 2022 came into effect, the Government issued Resolution No. 66.23/2026/NQ-CP to remove difficulties arising in the process of implementing AML regulations to meet the urgent requirements of implementing international commitments related to information exchange according to tax requirements. The application period of the Resolution is not long , but the policy implications of this document may go far beyond the transition period it governs.
An inspection conducted at two or three a.m. at a factory in an industrial park can surprise many businesses. What the authorities are interested in sometimes is not the production line operating or has stopped operating, but the detection of the contractor's workers or engineers sleeping in the factory area. This practice is quite common in manufacturing enterprises, especially in the electronics, mechanical, chemical or energy industries, where maintaining personnel ready to handle problems is considered a solution to ensure the continuity of production activities.
-
-
