Da Nang is rapidly emerging as a leading information technology and digital economy hub in Central Vietnam. Thousands of local enterprises, technology start-ups, retail chains, and tourist accommodation providers operate e-commerce websites, online trading platforms, and mobile applications. However, the rapid growth of digital channels has also brought unprecedented legal challenges.
Many business owners focus solely on advertising and sales optimization, overlooking two mandatory legal obligations: compliance with e-commerce regulations administered by the Ministry of Industry and Trade (MOIT), and compliance with personal data protection requirements under Decree No. 356/2025/NĐ-CP. A failure in either area may result in administrative penalties of tens of millions of dong, domain name blocking, or revocation of operating licenses. Engaging a reputable personal data protection advisory firm in Da Nang is therefore a strategic step that enables enterprises to grow sustainably with confidence.
1. Obligations to Register and Notify E-Commerce Websites with the Ministry of Industry and Trade (MOIT)
Business activities in the digital environment are strictly regulated by Decree No. 248/2026/NĐ-CP. One of the questions business owners in Da Nang ask most often is which websites must be notified to MOIT.
Under current regulations, entities required to carry out the procedure on the online.gov.vn portal fall into two main groups:
- Sales-oriented e-commerce websites (NOTIFICATION procedure): websites established by individuals or traders to serve their own trade promotion activities, sale of goods, or provision of services (for example, a clothing retail website, a hotel’s room-booking website, or a website that introduces and sells courses).
- E-commerce service websites (REGISTRATION procedure): platforms that allow third parties to sell goods or conduct business, including e-commerce marketplaces, online auction websites, online promotion websites, and their corresponding mobile applications.
Operating online sales channels without the required notification or registration may be subject to an administrative fine of VND 10,000,000 to VND 40,000,000 under Decree No. 15/2020/NĐ-CP (as amended by Decree No. 14/2022/NĐ-CP), as well as a risk of suspension of e-commerce activities. To ensure compliant operations, using an e-commerce advisory service in Da Nang helps traders complete the procedure promptly and avoid repeated rejection of their dossiers.
2. Compliance Obligations under Decree No. 356/2025/NĐ-CP on Personal Data Protection
If the procedure with MOIT is a necessary condition for operating a website, compliance with Decree No. 356/2025/NĐ-CP on Personal Data Protection (PDP) is the sufficient condition for protecting the enterprise before the inspection authority of the Ministry of Public Security (MPS), namely Department A05.
Any website or application that collects customers’ full names, telephone numbers, email addresses, delivery addresses, citizen identification numbers, or payment card information is classified as a Personal Data Controller or a Personal Data Processor. The enterprise must therefore satisfy the following legal requirements:
- Establish a consent mechanism (Consent Form): customers must actively tick a box to give consent before the enterprise collects and processes their data.
- Publish a Privacy Policy: publicly post on the website the types of data collected, the purposes of processing, the retention period, and the customers’ rights.
- Prepare and submit a Personal Data Processing Impact Assessment (DPIA) dossier: this is the most important obligation, yet it is frequently overlooked by enterprises.
Many business managers remain unsure which documents a personal data processing impact assessment dossier must contain when submitted to the Department of Cybersecurity and High-Tech Crime Prevention (A05) of the MPS. Under Article 19 of Decree No. 356/2025/NĐ-CP, the standard dossier consists of:
- A personal data processing impact assessment report in Form No. 10 in the Appendix to the Decree;
- A copy of the contract or agreement on personal data processing, setting out the binding obligations and responsibilities among the organizations and individuals involved in personal data processing;
- Policies, procedures, regulations, forms, and other relevant documents on personal data protection of the Personal Data Controller, the Personal Data Controller-Processor, or the Personal Data Processor.
In addition, if the enterprise uses international tracking tools (such as Facebook Pixel or Google Analytics) or stores data in the cloud on overseas servers (such as AWS or Google Cloud), it must also prepare a Cross-Border Personal Data Transfer Impact Assessment dossier.
3. HLR Legal Vietnam: A Comprehensive Digital Legal Solution for Enterprises in Da Nang
Given the complex legal context and the overlapping obligations toward MOIT and the MPS, online businesses in Da Nang need an advisory partner with in-depth expertise in information technology law, electronic transactions law, and cybersecurity law.
HLR Legal Vietnam provides a comprehensive digital legal solution package that helps enterprises standardize their online operating procedures in a safe and optimal manner.
HLR Legal Vietnam’s specialized services include:
- Compliance review and gap assessment: examining the enterprise’s entire website, mobile app, data collection flows, and the status of its existing e-commerce records.
- Advising on and carrying out MOIT registration/notification: acting on the enterprise’s behalf to complete all filings on MOIT’s online.gov.vn portal until the official verified logo is issued.
- Drafting standardized on-site legal documentation: preparing Terms and Conditions (T&C), a Privacy Policy, and a Cookie Notice, and integrating a Consent Banner mechanism that meets the standards of Decree 356.
- Preparing and filing Decree 356 dossiers: directly preparing the personal data processing impact assessment dossier and the cross-border personal data transfer dossier in the prescribed form, for retention at the enterprise and submission to Department A05 of the MPS.
- Advising on data security incident response: developing a response procedure for personal data breaches and representing the enterprise before inspection authorities when a sector-specific inspection is requested.