In the latest draft of the Electronic Identification and Authentication Law published by the Ministry of Justice on August 20, the drafting agency – the Ministry of Public Security – proposes a draft law consisting of 8 chapters and 47 articles to establish a common legal framework for electronic identification and authentication activities.
It also ensures national sovereignty, technological sovereignty, data sovereignty; protects personal data; and prevents identity forgery and fraud.
From a platform serving the simplification of administrative procedures, electronic identification and authentication have become indispensable pillars in Vietnam's digital infrastructure. The formulation of the Electronic Identification and Authentication Law, based on practical experiences from Decree 69/2024/ND-CP, is expected to complete the institutional framework, paving the way for safe, reliable, and cross-border digital transactions.
Electronic identification and authentication have become core components of the national digital infrastructure, serving as the foundation for safe, reliable, and cross-border electronic transactions.
In Vietnam, after an initial phase yielding positive results, the application of this technology is creating significant transformations in the reform and simplification of administrative procedures.
According to the Ministry of Public Security, the Government's Decree No. 69/2024/ND-CP is a crucial practical basis for drafting the Electronic Identification and Authentication Law. Upgrading the legal framework from a decree to a law aims to complete the legal corridor, ensuring stability, consistency, and long-term effectiveness for the national digital transformation process.
CREATING A LEGAL FRAMEWORK TO ADDRESS NEW ISSUES
As of the end of April 2026, the electronic identification and authentication system recorded a total of approximately 235 million eID authentications. Three organizations and banks have met the conditions to officially operate the service system; the total number of VNeID authentications (including five types of services) reached over 58 million. Additionally, about 92 million subscribers have been synchronized with the national population database.
However, according to the Ministry of Public Security, the current scope of electronic identification primarily focuses on individuals, agencies, and organizations to serve the development of digital citizens and a digital government.
In practice, many entities such as vehicles, ships, goods, supply chains, chemical origins, locations, activities, as well as entities in the electronic environment like IP addresses, applications, digital platforms, digital assets, are directly involved in transactions and management relationships in the digital space.
Therefore, it is necessary to expand towards unified identification for entities existing in both physical and electronic environments.
Another point to note is that the development of national digital infrastructure, the implementation of smart city models, and the expansion of digital service platforms in various fields such as transportation, finance, healthcare, and education are raising the requirement to establish a unified, reliable, and nationwide interoperable legal framework for electronic identification and authentication.
A typical goal for the 2029-2035 period is to standardize 100% of IoT (Internet of Things) traffic data, ready for connection and interoperability between the Ministry of Construction, the Ministry of Public Security, and localities. At least 50% of major traffic routes (highways, ring roads) will be equipped with IoT sensor infrastructure for road infrastructure management, monitoring, and maintenance.
The Ministry of Public Security assesses that current sub-law documents mainly address foundational issues in the initial implementation phase, lacking the scope and authority to comprehensively address emerging issues.
Additionally, the reality of international economic integration is urgently requiring the rapid implementation of electronic identification and authentication for goods and assets, especially digital assets.
International experience shows that electronic identification and authentication systems are expanding beyond the framework of pure personal identification to various types of entities and activities.
In South Korea, the law requires identification not only for participating entities but also mandates it for asset flows in transactions, particularly cryptocurrencies and digital assets, to ensure traceability and control financial risks.
In the European Union, alongside the "Digital Product Passport," new trust services (Electronic Ledger, Electronic Attribute Certification) have been added, and the EUDI Wallet model has been implemented to allow multi-purpose authentication.
EACH ENTITY HAS A UNIQUE ELECTRONIC IDENTITY
According to the draft, the Ministry of Public Security is the focal point to assist the Government in unifying state management of electronic identification and authentication. The principle is that each entity has a unique, accurate, complete electronic identity, updated promptly; data already in the national database or specialized databases will not be recollected.
The draft also stipulates prohibited acts such as forgery, appropriation, buying, selling, renting, or lending electronic identities; unauthorized collection, use, or sharing of electronic identification data; interference, sabotage of the national electronic identification and authentication system; using fake biometrics, fake images by technology to impersonate identities.
Accordingly, the scope of electronic identification is expanded to include agencies, organizations, individuals; products, goods, devices, assets; data, digital resources, domain names, applications, software, digital services, property rights, digital assets; activities, events, transactions, behaviors, interactions; locations and spaces.
RESEARCHING THE EXPANSION OF IDENTIFICATION SUBJECTS
In its feedback on the draft law, the Ministry of Justice noted that the draft identifies a wide range of identification subjects, while it has not clarified the criteria for determining which subjects need electronic identification, nor has it distinguished between mandatory and optional cases. It suggests further research on this content.
In response to this feedback, the drafting agency has reviewed, researched, and defined mandatory and voluntary subjects.
Accordingly, the draft clearly delineates the scope of subjects required to perform identification (serving state management, national defense, security, traceability, fraud prevention) and encouraged or voluntary subjects.
Thus, except where the law requires mandatory identification, the identification of subjects such as events, transaction behaviors, some low-risk material and immaterial groups is carried out on a voluntary basis.
The Ministry of Finance noted that the draft law applies to foreign organizations and individuals residing, operating in Vietnam, and foreign organizations and individuals related to electronic identification/authentication in Vietnam.
However, in investment procedures, many foreign investors do not reside in Vietnam, do not have domestic identification accounts, only have passports, business registration certificates, power of attorney, consular legalization documents, or accounts issued by the investment system.
Therefore, it suggests that the drafting agency research and supplement a temporary identification mechanism or investment identification code for foreign investors. It accepts recognized foreign electronic identities, electronic signatures, electronic certificates. It allows authentication through representative agencies, trusted service providers, or electronic document verification mechanisms. Foreign investors are not required to have a national identification account like Vietnamese citizens when carrying out investment procedures.
According to Article 7 of the draft, state agencies within their functions, tasks, and powers perform electronic identification activities under the state investment model, establishing systems and platforms to directly perform electronic identification activities for the following subjects:
- Subjects as prescribed in Clause 1 and Clause 5, Article 6 of this Law;
- Subjects whose identification information belongs to core data or important data classification as prescribed by the Data Law;
- Subjects certified by competent authorities for ownership or use rights; subjects are high-risk goods products as prescribed by the law on quality, goods products, and other subjects as prescribed by the Government; and
- Subjects belonging to state secrets as decided by the state secret management agency for identification implementation.
Google translate