Vietnam — The Activity Is Licensed, Not the Profession

Asia-Pacific Private Investigation Registry · AI9OS

The finding: Vietnam licenses the activity, not the profession

Every other jurisdiction in this registry gives one of two answers. Singapore, Malaysia and the Philippines license the profession: you need a licence to be an investigator. Thailand and Indonesia license neither: they regulate guarding and leave investigation alone. Vietnam gives a third answer, and it is the reason this registry now carries a “what the state regulates” field at all.

Vietnam does not license investigators. It does not prohibit investigation. But from 1 July 2026 it makes data analysis and aggregation and personal data processing conditional business lines, and the statutory definition of processing expressly covers collection, analysis and aggregation. An OSINT or investigation business operating in Vietnam is not regulated as an investigator. On the face of the list it is regulated as a data processor.

Answering “is investigation licensed in Vietnam?” with a plain No is technically accurate and practically misleading. It puts Vietnam in the same box as Thailand, where the work really is unregulated, when in fact the work is regulated and the licence simply has a different name on it.

Everything an English-language guide cites about Vietnam is out of date

Before any of the above could be written, each instrument had to be resolved on its status register. Six were, and every one had been replaced. This is not a story about one stale citation. It is a legal substrate that was rebuilt inside eighteen months.

The first row is the one that matters most, because the claim that Vietnam bans private detectives is repeated almost everywhere and traces back to a single annex. That annex was repealed in February 2025 and, so far as we can find, no English-language source has noticed.

Investigation is neither prohibited nor licensed

Điều 6(1) of Law 143/2025 sets out the eleven prohibited business lines: narcotics, certain chemicals and minerals, CITES specimens, prostitution, trafficking in persons and body parts, human cloning, firecrackers, debt collection, national treasures, exporting antiques, and e-cigarettes and heated tobacco.

Searching the full Vietnamese text of the Law, all 76 gazette pages, for thám tử returns nothing. The two hits for điều tra are criminal investigation by the State at Điều 6(2) and land survey consulting at annex item 173. Neither is a private investigation service.

Phụ lục IV, the conditional list, ends at item 198. Item 10 is kinh doanh dịch vụ bảo vệ, guarding, the same shape as Thailand and Indonesia. There is no investigation entry among the 198.

But data analysis and personal data processing are licensed from 1 July 2026

The last five items of Phụ lục IV are new, and they are the finding.

Two things join these entries to investigation work. The first is the statutory definition: PDPL Điều 2(6) makes xử lý (processing) expressly include thu thập (collection), phân tích (analysis), tổng hợp (aggregation), công khai (public disclosure) and chuyển giao (transfer). That is a description of open-source intelligence work.

The second is that the conditions behind item 198 do not come from the Investment Law at all. PDPL Điều 33(3) gives the Government the power to prescribe the conditions for organisations providing dịch vụ xử lý dữ liệu cá nhân. So the data protection statute supplies the licensing conditions, and by Điều 33(1)(a) the body administering them sits inside the Ministry of Public Security.

Resolved 3 September 2026. The decree exists: Nghị định 356/2025/NĐ-CP, dated 31 December 2025, effective 1 January 2026 — six months before the Investment Law trigger above. Điều 1 of the decree lists khoản 3 Điều 33 among the Law provisions it implements. Its Điều 22 sets the conditions for an organisation doing business in dịch vụ xử lý dữ liệu cá nhân: Vietnamese-law establishment; a head of data-processing expertise who is a Vietnamese citizen resident in Vietnam; a competent management team; at least three staff meeting the capacity conditions at Điều 13(2) (a diploma or higher, two years’ relevant experience, and training in personal-data-protection law); infrastructure fit for the service; and a passed impact-assessment dossier, plus a cross-border one where applicable. No licensing or certification step appears in the text — this reads as a self-assessed compliance regime, not an application process, though that should still be confirmed with counsel before anyone relies on it. Điều 41 gives small businesses and startups a five-year window to choose whether to comply with several other Law obligations, but expressly carves data-processing-service providers back out of that grace period, alongside anyone handling sensitive data or reaching 100,000 data subjects. The decree also repeals Nghị định 13/2023/NĐ-CP outright, at Điều 42(2), on the same date it takes effect.

For a foreign investor, investigation is closed

Everything above describes what Vietnamese law asks of an operator. It is not the whole answer for a foreign one, and this is the qualification that matters most to anyone reading this registry from outside Vietnam.

Market access for foreign investors runs on a separate list from the conditional-business-lines schedule. Nghị định 96/2026/NĐ-CP of 31 March 2026, Điều 15(1), publishes it at Phụ lục I, in two sections: Section A is the lines a foreign investor may not access, Section B the lines they may access on conditions.

So the two regimes point in opposite directions, and the distinction is the practical one: a Vietnamese-owned company may carry on investigation subject to the data rules described above; a foreign investor may not enter that line at all, while the guarding line next to it is merely conditional.

This is not a 2026 change, and we should have caught it sooner. The predecessor decree, Nghị định 31/2021/NĐ-CP, carries both entries at the same numbers; Nghị định 96/2026 (Điều 111(3)) repealed it along with Nghị định 19/2025 and 239/2025 and reproduced the list unchanged. The restriction has stood since at least March 2021. It was absent from this page when we published it on 2 September 2026 because we had read the conditional-business schedule and not the market-access one, and we have said as much in our review record rather than quietly correcting it.

The guarding regime does not reach investigation

If investigation were going to be swept into an existing licence, the security-and-order regime is where it would happen. It does not. Nghị định 96/2016/NĐ-CP Điều 3(7) defines the guarding business as:

services protecting people, property, targets and the lawful activities of agencies, organisations and individuals.

That is protection, not inquiry. Nothing in it reaches collection, tracing or verification. Thám tử appears zero times across the whole decree, and the only two mentions of điều tra are eligibility bars: a person under criminal investigation, prosecution or trial cannot be the security-responsible person and cannot be employed. Vietnam reaches the same answer as Thailand and Indonesia, by the same route.

The decree was amended in 2023 and again by Nghị định 58/2026/NĐ-CP of 13 February 2026, in force 15 March 2026. That amendment does not touch the guarding definition. It does two other things worth knowing. It rewrites Điều 12(4) so that guard staff must be trained on a curriculum approved by the Ministry of Public Security and hold a chứng chỉ nghiệp vụ bảo vệ valid for five years. And it rewrites khoản 23 of Điều 3 to name, expressly, GSM mobile-phone surveillance devices and other mobile-phone surveillance devices within the licensed military and police equipment line. Dealing in phone-surveillance equipment is licensed work in Vietnam.

The classification changed too, and it merged investigation into the guarding code

Vietnam reissued its industry classification. Quyết định 36/2025/QĐ-TTg took effect on 15 November 2025 and, by Điều 4(2), terminated Quyết định 27/2018/QĐ-TTg on the same date. Any source quoting VSIC 2018 codes is stale from that day.

Under VSIC 2025, division 80 is Hoạt động điều tra bảo đảm an toàn, and it expressly includes investigation services in the private, commercial, corporate, insurance and criminal-law fields, carried out to enforce rights in court. Group 801 is described as activities normally carried out by the private sector. Beneath it:

• 80110 Dịch vụ điều tra và hoạt động bảo vệ tư nhân · investigation services and private protection, in one code. It also expressly covers secure data destruction and erasure services.
• 80190 Dịch vụ bảo đảm an toàn khác · other security services, which is where risk analysis and security consulting and remote monitoring are expressly sent.

Two practical consequences follow. The standalone investigation code 8030 is gone, merged into 80110. And a firm whose actual work is risk analysis and security consulting belongs in 80190, not 80110, because the classification excludes those activities from 80110 by name.

Readers of our Indonesia page will recognise this. Both countries merged their investigation code into a code numbered 80110 during 2025, because both follow the same international classification. The consequence differs, and the difference is instructive. Indonesia’s licensing annex names a code by number, so the merge pulled investigation into a licensed code and created exposure that nobody legislated for. Vietnam’s guarding regime licenses by description, and the description is protection, so the merge does not by itself make investigation licensable. Whether a business registered under 80110 is treated by the police as carrying on dịch vụ bảo vệ is a question the classification change created and has not answered.

Where the exposure actually is: the data protection law

As in Indonesia, the licensing question is not where the risk lives. The Personal Data Protection Law 91/2025/QH15, in force 1 January 2026, is the dominant instrument for anyone doing this work in or into Vietnam.

The lawful bases are narrow, and the burden of proof is yours

Consent under Điều 9 must be per purpose, in a printable and verifiable form, and silence or non-response is expressly not consent. The exceptions in Điều 19(1) are the closest thing Vietnam has to a legitimate-interest basis, and there are five. The one an investigation firm would reach for is Điều 19(1)(a): protecting one’s own or another’s legitimate rights or interests, or those of the State or an organisation, in a necessary manner, against an act infringing those interests. The provision then adds that the controller, processor or third party bears the burden of proving the case.

Điều 19(2) is the price of relying on any of those exceptions, and it is a standing programme rather than a one-off: documented processes with assigned responsibility, protective measures with regular risk assessment, periodic compliance checking, and a channel to receive and handle complaints.

The filings are mandatory and there is no small-business exemption

Điều 21 requires a processing impact assessment dossier, one original to the authority, within 60 days of the first day of processing. Điều 20(2) requires a separate cross-border transfer assessment within 60 days of the first transfer. Both are updated every six months on change (Điều 22), and a breach that could harm national security or a person’s life, health, honour, dignity or property must be notified within 72 hours (Điều 23).

Điều 21(6) exempts exactly one class of party from the processing assessment: competent state agencies. There is no exemption for small firms, low volumes or foreign entities. The exemptions from the cross-border assessment in Điều 20(6) are equally narrow: a state agency, an organisation storing its own employees’ data on a cloud service, and a person transferring their own data. None of them fits an investigation practice.

The cross-border rule reaches platforms outside Vietnam

Điều 20(1)(c) treats it as a cross-border transfer where an organisation or individual, in Vietnam or abroad, uses a platform located outside Vietnam to process personal data collected in Vietnam. The trigger is where the data was collected and where the platform sits, not who owns the company. A Singapore-hosted platform processing Vietnamese-collected data is squarely inside this, and Điều 8(4) prices a breach of it at up to 5% of prior-year revenue.

Publication is separately controlled

Điều 16 permits publishing personal data in four cases only: with consent, as provided by law, under the Điều 19(1)(b) exception, or in performance of a contractual obligation. It also imposes a continuing duty to control and monitor what has been published. Anyone writing up a Vietnamese matter as a case study should read Điều 16 before Điều 19.

Two surveillance provisions that bite

The PDPL contains two rules that speak directly to field practice, and neither is widely reported.

Điều 31(3)(a). Location tracking by radio-frequency identification and other technologies is not permitted except with the subject’s consent, at the request of a competent authority, or where the law otherwise provides. A covert vehicle tracker sits inside that prohibition.

Điều 32. Recording in public places is the article that governs observation work. Audio and video recording in public places and at public activities, and processing the personal data so obtained, may be done without consent where it is done to perform national defence or security tasks, to ensure social order and safety, or to protect the lawful rights and interests of agencies, organisations and individuals, and where public-activity footage does not harm the subject’s honour, dignity or reputation.

Then Điều 32(2) adds the sting. Even in those cases, the recorder must notify the subject, or by some other means let them know that they are being recorded, unless the law provides otherwise. A notification duty that survives the removal of the consent requirement is unusual, and for covert observation it is the operative constraint. Điều 32(4) then limits retention to what the collection purpose requires.

State secrets, and a provision written for AI

The State Secrets Protection Law 117/2025/QH15 came into force on 1 March 2026 and, by Điều 27(2), terminated the 2018 law. Its Điều 5 lists ten prohibited acts. Two matter here.

Điều 5(10) prohibits using artificial intelligence or new technology to infringe state secrets, and posting or disseminating state secrets in mass media or on the internet or telecommunications networks. It is, as far as we are aware, the first provision in this registry to name AI as a means of committing the offence.

Điều 5(4) is the one nobody quotes and is arguably the greater risk to an investigator. It prohibits unlawfully collecting, exchanging, providing or transferring state secrets. Collection is named as the act.

Scope is the reason this is not a defence-sector footnote. Điều 7 defines state secrets across thirteen fields, including the economy, natural resources and environment, science and technology, health, organisation and personnel, and inspection, audit and complaint handling. Corporate and regulatory research can approach several of those without touching anything that looks like national security.

The new Cybersecurity Law 116/2025/QH15, in force 1 July 2026, replaced both the 2018 Cybersecurity Law and the 2015 Law on Network Information Security. Its Điều 7(1)(c) prohibits posting on cyberspace material that is fabricated, defamatory or false, that infringes another person’s dignity, honour or reputation, or that damages the lawful rights and interests of others. Publishing an unproven allegation is a named prohibited act.

What we could not verify

How this compares

Read down the first row and the registry stops being a yes-or-no table. Three states license the person who does the work. Two license neither the person nor the work. Vietnam licenses the work and ignores the person, which produces a compliance burden that no licensing search would ever surface, because there is no investigator licence to search for.

Vietnam and Indonesia are the instructive pair. Both answer “no” on the investigator licence and both put the real weight in a data protection statute. Indonesia’s is criminal, at five years. Vietnam’s is administrative but proportionate to turnover, and it is coupled to filing duties that begin 60 days after you start, with no exemption available to a private firm.

Primary sources

• Luật Đầu tư số 143/2025/QH15, official gazette (Công báo số 42, 22-01-2026), read in full including Điều 6 and Phụ lục IV
• Luật Bảo vệ dữ liệu cá nhân số 91/2025/QH15, Ministry of Public Security legal database, signed PDF. The file is a 23-page scan with a 22-character text layer, so it was rendered at 170 dpi and read as images
• Luật Bảo vệ bí mật nhà nước số 117/2025/QH15, gazette số 35, 21-01-2026
• Luật An ninh mạng số 116/2025/QH15, gazette số 35, 21-01-2026
• Nghị định 96/2016/NĐ-CP, gazette copy. Note that the “signed” copy on datafiles.chinhphu.vn is a 50-page scan carrying 196 characters of text, while the gazette copy of the same instrument carries a clean text layer
• Nghị định 58/2026/NĐ-CP, government document portal, digitally signed PDF. Ban hành 13-02-2026, hiệu lực 15-03-2026
• Quyết định 36/2025/QĐ-TTg on the Vietnam Standard Industrial Classification, gazette số 1439–1450, 13-10-2025. Điều 4 and the division 80 descriptions were read from the gazette parts
• Nghị định 173/2024/NĐ-CP, the government’s digitally signed PDF (VGP signature block, signed 31-12-2024), Điều 1(2)(b) repealing the whole of Mục B về Dịch vụ of Phụ lục I to Decree 59/2006, and Điều 2(1) bringing the repeal into force on 15 February 2025. The signed file is mirrored on provincial government domains; vbpl.vn, which would normally hold the consolidated record, was unreachable

Related

• Indonesia — Private Investigation Licensing
• Thailand — Private Investigation Licensing
• Singapore — Private Investigation Licensing
• Malaysia — Private Investigation Licensing
• Philippines — Private Investigation Licensing
• Laos — Not Licensed, and the Data Law Is the Constraint
• Hong Kong · Investigation Is Not Licensed
• Japan · Notification, and the Internet Exclusion
• South Korea · Not Licensed, and the Data Law Is the Constraint
• Asia-Pacific Private Investigation Registry

General information for practitioners, not legal advice. Engage Vietnamese counsel before relying on this reading for a live matter. The English on this page is our own translation from the Vietnamese; the Vietnamese governs. Absence of a licensing regime for investigators is emphatically not absence of legal risk in Vietnam, and several of the instruments above came into force during 2026 with implementing detail still to be published.