3 Key regulatory developments businesses should review

MONTHLY LEGAL & TAX UPDATE | AUGUST 2026

August 2026 brought further significant changes in tax policy, personal data protection, and corporate governance. Notably, newly introduced tax relief measures are being implemented alongside stricter requirements and enforcement relating to data compliance and the standardization of corporate legal information.

Russell Bedford KTC summarizes three key regulatory developments that businesses should review during this period:

1. 30% Reduction in Corporate and Personal Income Taxes for Tax Years 2026–2027 for Annual Revenue Below VND 10 Billion

On 24 August 2026, the National Assembly issued Resolution No. 43/2026/QH16, effective immediately upon issuance, introducing a tax relief package applicable to the 2026 and 2027 tax years:

• 30% reduction in Corporate Income Tax (CIT) payable: Applicable to enterprises and organizations established under Vietnamese law with annual revenue (2026, 2027) not exceeding VND 10 billion.
• 30% reduction in Personal Income Tax (PIT) payable: Applicable to resident individuals deriving income from business activities with annual revenue (2026, 2027) not exceeding VND 10 billion.
• Interaction with existing tax incentives: Where an enterprise is already entitled to other CIT incentives, the 30% reduction is calculated based on the remaining CIT payable after the applicable incentives have been deducted.

Key compliance considerations:

• Anti-avoidance provision: The tax relief does not apply to enterprises established through a division or separation after the Resolution takes effect where aggregate annual revenue (2026, 2027) exceeds VND 10 billion.
• Recommended action: Eligible enterprises and business households should closely monitor the Government’s forthcoming implementing Decree to ensure the correct treatment of quarterly provisional tax payments and annual tax finalization, minimizing the risk of tax adjustments or late-payment penalties.

2. Personal Data Protection: Substantive Compliance and New Enforcement Measures

On 19 August, 2026, the Government concurrently issued Decrees No. 330, 331, 332, and 333/2026/ND-CP, completing the legal framework on personal data protection and information security in Vietnam:

•  Regulated Entities: All enterprises, organizations, and business households engaged in collecting or processing personal data (ranging from internal personnel records to customer and partner information).
• Key Sanctions (Decree No. 330/2026/ND-CP):
  • Heavy financial penalties for collecting or processing personal data without prior notice and explicit consent from data subjects, failing to prepare/maintain Data Protection Impact Assessment (DPIA) dossiers, or non-compliant cross-border data transfers.
  •  Deportation measures applicable to non-compliant foreign nationals; particularly severe violations (such as unauthorized large-scale data trading, dissemination, or illicit profiteering) may be subject to criminal prosecution.
•  Decrees No. 331, 332, and 333/2026/ND-CP: Supplement regulations on information system security, conditions for cybersecurity-related business services, and coordinated enforcement mechanisms in the digital environment.

Takeaway for businesses: Data compliance is no longer a formalistic, paper-based exercise. Businesses should promptly review and standardize consent forms, enforce system access controls, and establish practical operating procedures – especially mechanisms for secure storage alongside scheduled review, deletion, and destruction of data once processing purposes conclude.

 3. 32 Administrative Procedures and Templates Updated for Enterprise Establishment/Amendment Applications

On 24 August 2026, the Ministry of Finance issued Decision No. 2370/QD-BTC, announcing the amended list and detailed contents of 32 administrative procedures in the field of enterprise establishment and operations, replacing Decision No. 1996/QD-BTC dated 24 July 2026. In parallel, Circular No. 121/2026/TT-BTC updates the relevant administrative forms.

The updated procedures cover the full enterprise lifecycle, from incorporation and changes to registered information – including address, business lines, charter capital, members, legal representatives, and ownership – to corporate restructuring, temporary suspension, and termination of operations.

Governance trend: Enterprise procedures are increasingly supported by interconnected digital data and cross-verification between government systems, including business registration, tax, and investment databases. Businesses therefore need to ensure not only that the correct forms are submitted, but also that legal information remains consistent across licensing records, tax records, and internal governance systems.

Recommended review: Businesses should review their current registration information, ownership structure, legal representative information, beneficial ownership information, and internal forms to ensure timely alignment with the updated requirements.

For enterprise registration dossiers submitted online, enterprises must ensure electronic identity authentication in accordance with prevailing regulations. In particular, enterprises with foreign legal representatives should proactively complete Level 2 electronic identity account (VNeID) registration and verify data consistency between their electronic identity profile and the enterprise registration records. Where the foreign legal representative has not yet obtained an eligible electronic identity account, the enterprise may authorize an individual possessing an active Level 2 electronic identity account to carry out the filing procedures, thereby avoiding potential procedural impediments and delays.