Vietnam-facing software delivery: the PDPL, e-invoices, VietQR and VNeID

OutsourcingVN is operated by Netbase JSC, and this guide is written by a supplier that would welcome your project. It is written for a company whose own buyers or users are already in Vietnam, not for a company deciding whether to outsource engineering work to a Vietnam-based team; the Vietnam outsourcing guide covers that separate decision. The guides index covers other markets, and the market index shows which question each one answers first.

Contents

• What makes a Vietnam-facing build different?
• What can Netbase evidence for a Vietnam brief?
• Which requirement sits with which decision owner?
• Which steps come before a Vietnam-facing launch?
• Worked scenario: a Vietnamese shopper pays by VietQR transfer
• What has Netbase built that is relevant to a Vietnam brief?
• Which questions should you ask a supplier?
• What usually goes wrong?
• How this guide is sourced and where it stops
• Common questions
• Plan the first release

What makes a Vietnam-facing build different?

Six design choices come up in almost every Vietnam-facing brief, and each has a different owner.

• Personal data protection. The Law on Personal Data Protection (Law No. 91/2025/QH15), in force on 1 January 2026, and its implementing decree set out the conditions for collecting, processing and transferring personal data, including sending it outside Vietnam, and replace the government's previous decree on the subject.
• Cybersecurity data storage. Under the Law on Cybersecurity (Law No. 116/2025/QH15), in force on 1 July 2026 and replacing the 2018 Cybersecurity Law, domestic and foreign businesses providing telecommunications, internet or value-added online services in Vietnam that collect or process personal information, relationship data or data created by users in Vietnam must store that data in Vietnam for the period the Government sets; a foreign business among them must also open a branch or representative office in Vietnam.
• Electronic invoices. Decree No. 70/2025/NĐ-CP, in force on 1 June 2025, amends the government's rules on invoices and documents, including when an invoice must be issued for specific activities and, for taxi businesses using fare software, sending invoice data to the tax authority at the moment the e-invoice is issued.
• Payments. A Vietnamese checkout commonly offers a VietQR transfer, which settles over the NAPAS network by scanning a QR code instead of entering an account number, alongside cards and e-wallets.
• Identity and the website notice. A product may accept VNeID, the national electronic identification app the Ministry of Public Security operates, for identity verification; separately, under Decree No. 248/2026/NĐ-CP, in force on 1 July 2026, the owner of an e-commerce platform that sells directly with an online ordering function must have its notification confirmed before the platform operates.
• Vietnamese-language interfaces and contracts. Screens, notices and the contract itself are commonly expected in Vietnamese for Vietnamese users, which is a design decision to scope at discovery, not a late translation pass.

Settle each with your legal, finance and product owners before discovery, then let engineering translate the answers into a consent process, a storage location, an invoicing integration, a payment flow, an identity option and a language boundary.

What can Netbase evidence for a Vietnam brief?

Procurement, security and data protection reviewers tend to ask for the same statements. These are the ones Netbase can give.

• Head office and hours. Netbase JSC's head office is in Hanoi, Vietnam, and it is the company's only office. The Hanoi office works Monday to Saturday, 9:00-18:15 Vietnam time (UTC+7), and support coverage follows those days.
• Security practices. Security practices include secure code review and version control, role-based access control, MFA for admin dashboards, contributors under NDA, and NDAs and DPAs on request. A data processing agreement written for the Vietnam-facing system sits on top of this baseline.
• Reach. Netbase has worked with clients in 80 countries.

Which requirement sits with which decision owner?

A Vietnam brief spans several owners inside the buying organisation, and a proposal that conflates them is the fastest way to miss one once the contract is signed.

Ask for this table filled in, not just a general compliance statement, before shortlisting a supplier.

Worked scenario: a Vietnamese shopper pays by VietQR transfer

A retailer launches a Vietnamese storefront where shoppers pay by scanning a VietQR code alongside cards and e-wallets.

A proposal that cannot describe step 4, specifically what the checkout does when a VietQR transfer does not confirm in time, has not yet scoped Vietnamese payments for this product.

What has Netbase built that is relevant to a Vietnam brief?

Working with a local Odoo implementation partner, Netbase has consulted on and customised Odoo in Vietnam for retail store chains, a food and beverage franchise chain, manufacturers, trading and distribution companies, a warranty service network, an industrial-park purchasing centre, an energy-sector project time and cost system, a university institute and a postal-service helpdesk; these clients are not named. The Odoo implementations record covers Odoo work of this kind, the Odoo platform page sets out where Odoo itself fits for a Vietnam-facing back office, and the Odoo for retail chains guide plans a rollout for one of the sectors above.

Which questions should you ask a supplier?

• Who owns the PDPL lawful-basis decision? It should be your organisation, with the supplier advising rather than deciding for you.
• Where is the data this product collects on Vietnamese users actually stored, and which categories does that cover? A supplier that cannot name the storage location should not be building the data layer yet.
• Which e-invoice route have you actually integrated, and who reconciles it? Ask for a real submission reference, not a slide.
• Does checkout support VietQR transfers and e-wallets alongside cards, and what happens when a transfer is not confirmed? A vague answer usually means the path has not been tested.
• Has the platform's notification been confirmed, and who maintains that record after launch? It should be your organisation's record, not the supplier's.
• Who owns Vietnamese copy, and how does a change reach production? Translation drift is easiest to catch before launch, not after.

What usually goes wrong?

• A lawful basis assumed rather than decided. Signal: nobody can name which basis each use of personal data relies on. Owner: the data protection lead.
• Data storage decided after the hosting provider is already chosen. Signal: user data for Vietnamese customers sits outside the country with no documented reason. Owner: the data protection lead, scoping this at discovery.
• The e-invoice route treated as a one-off form. Signal: the integration cannot issue a correction once a document has been reported to the tax authority. Owner: the finance systems owner.
• A checkout built around cards first, with VietQR bolted on at the end. Signal: the payment flow needs a disruptive rework rather than an addition. Owner: the product owner, who should put both rails in the same discovery estimate.
• The website notice forgotten until launch week. Signal: nobody can show the confirmation of the platform's notification. Owner: the product owner.

How this guide is sourced and where it stops

This guide uses the National Assembly's Law on Personal Data Protection and the government's decree detailing it, the National Assembly's Law on Cybersecurity, the decree amending the rules on invoices and documents, the Law on E-Commerce and its decree on platform notification, NAPAS's own description of VietQR transfers, and the Ministry of Public Security's own description of VNeID, all checked on 2026-10-24, together with company statements and delivery evidence approved in the OutsourcingVN claim register. It is written for product, finance and operations leads scoping a Vietnam-facing brief; it does not decide which lawful basis, storage location or notice route fits your organisation.

Plan the first release

Bring your PDPL lawful-basis and data-storage decisions, your e-invoice route, your VietQR and e-wallet scope, your VNeID and website-notice decisions, and your Vietnamese-language boundary. The data security and compliance guide lists the contract questions behind the data protection row, and the e-invoicing glossary entry defines the term this guide uses throughout. For other Southeast Asian markets, the Thailand guide covers the PDPA committee and PromptPay, the Malaysia guide covers the amended PDPA and MyInvois, and the Singapore guide covers phased redevelopment and identity data.

Custom Product Engineering is the service for a bounded build, and global delivery explains how remote delivery is organised. OutsourcingVN is Netbase's own outsourcing-services platform: submit a project with your Vietnam-facing scope, and a person will reply with whether discovery or a bounded implementation is the right next step.

Related services and solutions

Sources

• National Assembly of Vietnam, Law on Personal Data Protection, Law No. 91/2025/QH15
• Government of Vietnam, Decree No. 356/2025/NĐ-CP detailing the Law on Personal Data Protection
• National Assembly of Vietnam, Law on Cybersecurity, Law No. 116/2025/QH15
• Government Electronic Information Portal (policy news service), Decree No. 70/2025/NĐ-CP amending Decree No. 123/2020/NĐ-CP on invoices and documents
• NAPAS (National Payment Corporation of Vietnam), VietQR fast transfer service
• Ministry of Public Security, on VNeID level-2 electronic identification accounts
• Ministry of Industry and Trade, e-commerce activity management system
• National Assembly of Vietnam, Law on E-Commerce, Law No. 122/2025/QH15
• Government of Vietnam, Decree No. 248/2026/NĐ-CP detailing the Law on E-Commerce