Legal considerations for Tech Startups in Viet Nam

1. Introduction: The legal context for tech Startups in Viet Nam

Legal compliance is a cornerstone for the sustainable development of any enterprise, particularly for tech startups in Viet Nam. Ensuring legitimate business operations, full adherence to tax obligations, and securing necessary legal approvals is not merely a statutory requirement but also a robust framework that safeguards a startup from potential legal issues and crises. Moreover, legal compliance serves to protect the technological ownership, ideas, and other intangible assets of the creators, enabling the business to confidently utilize and develop its assets without fear of infringement. 

In a fiercely competitive technology market, legal compliance has evolved from a simple obligation into a critical strategic factor that directly impacts a company’s fundraising capacity and valuation. Startups often prioritize rapid product development and market expansion, occasionally neglecting complex legal matters. However, professional investors, especially venture capital funds, conduct meticulous legal due diligence prior to capital injection. Any unresolved legal risk, no matter how minor, pertaining to taxes, contracts, or intellectual property, can significantly diminish a startup’s value or even lead to the termination of an investment transaction. Accordingly, establishing a solid legal foundation from the outset confers a significant competitive advantage and enhances a startup’s attractiveness to investors. 

The legal environment for tech startups in Viet Nam is still in a state of development. As of 2016, Viet Nam had not yet promulgated any specific legal instrument dedicated to startups, and nascent enterprises were commonly equated with ‘small and medium-sized enterprises’. While the Government has issued numerous policies to support innovation, such as Decree 24/2024/ND-CP detailing the Law on Bidding regarding contractor selection and Decree 94/2025/ND-CP providing the regulatory sandbox in the banking sector, the specific legal framework for tech startups remains largely incomplete. 

Another significant challenge is the lack of legal knowledge and a comprehensive business perspective among Vietnamese founders, which results in a lack of genuine interest in legal matters from the initial stages. The absence of a distinct legal framework for tech startups, combined with the founders’ lack of proactivity in addressing legal issues, creates a ‘grey area’ fraught with potential risks. Since the law lacks a clear definition of “startup”, these businesses must operate under general regulations for small and medium-sized enterprises. This may not accurately reflect the ‘move fast, break things’ nature of a startup, leading to the rigid application of unsuitable rules.  The frequent neglect of legal aspects by founders further exacerbates these risks, causing apprehension among investors and affecting capital flow, thereby slowing the development of Vietnamese startups compared to their regional counterparts.  

Despite these challenges, the rapid advancement of technology and the increasing focus from the Government of Viet Nam have spurred the promulgation of new legal instruments, particularly in fields such as Fintech and personal data protection. This demonstrates not only a profound awareness of technology’s importance but also a concerted effort to create a clearer legal environment. The “novelty” of these regulations also means that startups must continuously update and adapt, proactively transition from the ‘grey area’ to the ‘bright side’ of the law. This requires startups to have a smart strategy and the ability to flexibly respond to changes in the legal corridor to mitigate risks and seize development opportunities. 

II. Core legal issues in the formation and operation of tech Startups 

2.1. Corporate formation and capital structure   

The formation of a tech startup must strictly comply with the Law on Enterprises 2020 and its related implementing decrees. Common business forms available to startups include a Limited Liability Company (which is suitable for small and medium-sized enterprises with 1 to 50 capital contributors), a Joint Stock Company (which allows for the unlimited mobilization of capital from numerous shareholders), and a Private Enterprise (where the owner bears unlimited liability for all company operations). 

The choice of business form is not merely an administrative procedure but a strategic decision with a profound impact on a startup’s management structure, legal liability, and fundraising capabilities. A common risk is a startup choosing the Joint Stock Company model with the belief that it will facilitate fundraising. However, this model has certain limitations, for example, founders are often restricted from transferring shares during the first three years to ensure initial capital stability. If a startup chooses this business form while its operations are not stable in the short term, the founders may face significant difficulties when they wish to transfer shares. This underscores that the initial decision on the business form must be carefully considered based on long-term goals for growth and ownership structure and not simply based on the assumption of “easy fundraising”. 

Charter capital is a crucial factor, especially for business lines subject to conditional regulations. Current law only monitors declared capital data and lacks a strict mechanism for supervising actually contributed capital, which can lead to a risk of internal disputes over capital among founders or capital-contributing members. This lack of effective supervision creates an internal legal loophole, with the potential for serious disputes between founders and adverse effects on business partners’ rights. The existence of “virtual” capital or insufficient actual capital not only poses financial risks but also creates grounds for internal disputes, impacting the startup’s operations and reputation. 

Agreements between founders and shareholders’ agreements are extremely important internal legal documents. If a startup has not yet established a legal entity, the agreement between founders is considered a civil agreement under the Civil Code 2015, established and mutually binding upon the parties. However, the absence or ambiguity of a founders’ or shareholders’ agreement constitutes a major internal legal risk, which can lead to serious disputes as the startup grows or faces difficulties. Startups often begin with an idea and the collaboration of a group of individuals. Without a clear legal agreement from the outset regarding rights, obligations, capital contribution ratios, profit distribution, and dispute resolution mechanisms, these issues can escalate into internal conflicts when the startup achieves success or encounters challenges, seriously affecting business operations. A shareholders’ agreement is an essential legal tool that helps increase corporate control and management, maintain the ownership structure, restrict share transfers, and enhance liquidity and the ability to proactively withdraw capital. The main contents of a shareholders’ agreement typically include provisions on operational management, share transfers, pre-emptive rights to acquire additional shares, deadlock resolution, non-competition, and capital withdrawal rights. The robust drafting of these agreements will prevent many internal legal risks, ensure the stability and growth of the startup. 

2.2. Intellectual Property (IP) in the technology sector 

Intellectual Property (IP) is a core asset for technology startups, and its protection is critically important. 

Computer software protection: Computer software is protected as a literary work under Clause 1, Article 22 of the Law on Intellectual Property 2005, whether it is in source code or object code. Copyright in software includes moral rights (to name, be named as the author, and protect integrity) and economic rights (to reproduce, distribute, and exploit economic benefits). Protected software must be original and demonstrate independent creation, not copied from another work. The law stipulates that copyright protection is automatic and does not require mandatory registration. However, the lack of formal registration is a significant risk, weakening the ability to protect the most important intellectual asset of a tech startup in the event of a dispute. Although protection is automatic, registration with the Copyright Office of Viet Nam is “necessary” and creates a “solid legal foundation” to “prove authorship” in a dispute. This indicates that “automatic” does not mean “safe,” and the absence of a certificate can make it very difficult for a startup to protect its core assets against copying or infringement. The registration procedure includes preparing a dossier (declaration, two copies of the software, and fee receipt) and submitting it to the Copyright Office of Viet Nam (Ha Noi, Ho Chi Minh City, Da Nang). The time for granting the certificate is 15 working days. The term of protection for moral rights is indefinite; the right to publish and economic rights last for the lifetime of the author plus 50 years after the author’s death. 

Patent and utility solution protection: Viet Nam has recorded a record number of patents and utility solutions granted in June 2025. However, a notable point is that Vietnamese applicants are few on the list of protected green technology patents, which are mainly held by foreign companies. This disparity shows a gap in the patent protection strategy of Vietnamese startups. Despite many patents being granted, the absence of Vietnamese applicants in high-tech fields indicates that Vietnamese startups may not be fully aware of or investing enough in protecting their inventions. This can lead to a loss of competitive advantage or market dominance by foreign companies without a comprehensive IP strategy. The patent registration procedure includes the following steps: application receipt, formal examination (within 01 month), substantive examination (not exceeding 09 months), grant of the protection title (within 15 days after paying the fee), and publication on the Industrial Property Official Gazette (within 60 days after the grant decision). 

Trademark and trade secret protection: 

• Trademark: Trademark registration is necessary to prevent brand theft and avoid intellectual property infringement issues later in business. The registration procedure includes a search for the registrability of the trademark (not mandatory but essential to avoid duplication), filing the application with the Intellectual Property Office of Viet Nam (directly, through a representative organization, or via the Madrid System), application publication (within 2 months from the date of formal acceptance), substantive examination (within 9-12 months), and certificate issuance (within 1-2 months if conditions are met). 

• Trade secret: A trade secret is information obtained from financial or intellectual investment activities that has not been disclosed and has the potential for commercial use. Trade secrets do not require registration with state authorities but are established when the owner legally obtains them and implements necessary security measures to prevent disclosure or easy access by others. Protection conditions include: not being common knowledge or easily obtainable; providing a competitive advantage when used in business; and being kept confidential by the owner through necessary measures. A trade secret is a crucial intangible asset that is often overlooked, especially when startups focus on products. The lack of strict security measures for trade secrets can lead to the leakage of competitive information. This requires startups to proactively build internal procedures and sign non-disclosure agreements (NDA) with employees and partners to protect sensitive information. Without these measures, trade secrets can be easily disclosed, leading to a loss of competitive advantage without a solid legal basis for seeking compensation. 

IP protection strategy for tech startups: A proactive and comprehensive IP strategy, including both registering IP assets and establishing trade secret security mechanisms, is a key factor for tech startups to build sustainable value and attract investment. Legal risks related to IP often cause significant losses when a business idea has grown and yielded results. This highlights that ‘preparing in advance’ is extremely important. An IP strategy should not be limited to registering software copyrights or trademarks but must also include protecting trade secrets through NDAs and strict internal procedures. This creates a solid “legal barrier”, enhancing the startup’s value in the eyes of investors and mitigating unnecessary legal risks.  

Table 1: Intellectual Property Registration Process for Software, Trademarks, and Patents 

2.3. Legal issues in fundraising 

Fundraising is an essential stage for every startup, but it also contains many legal issues that require attention. 

Forms of fundraising: Startups can raise capital through various forms such as Bootstrapping, Angel Investment, Venture Capital, and Crowdfunding. Angel investors are typically wealthy and experienced individuals who invest in the early stage with capital ranging from 10,000 USD  to 1 million USD. In contrast, Venture Capital funds are professional organizations that operate with large funds, capable of participating in multiple investment rounds with sums up to tens of millions of dollars. The choice of fundraising method not only depends on financial needs but also affects the level of ownership and control shared by the founders. Angel investors may require a large stake (ranging from 10% to 50%), while venture capital funds provide significant financial resources but often come with strict binding terms and supervision. This requires founders to carefully weigh the need for capital against maintaining control of the company, which is an important legal factor that needs to be clearly negotiated in investment agreements. 

Legal regulations for investors (domestic, foreign): For foreign investors, investing in Viet Nam must meet market access conditions under the Law on Investment 2020, including the charter capital ownership ratio in economic organizations, investment forms, scope of investment activities, and investor capacity. A foreign investor’s investment project must undergo the procedure for granting an Investment Registration Certificate. Additionally, there is a list of sectors and industries with restricted market access for foreign investors. The complex regulations regarding foreign investors, especially market access conditions and the requirement for an Investment Registration Certificate, can be a barrier for tech startups seeking to attract international investment. Although foreign capital is crucial for the development of tech startups, the regulations on market access conditions and the requirement for an Investment Registration Certificate can slow down the investment process and increase compliance costs. Startups need to be well-prepared legally to not miss opportunities from foreign investment funds that have high procedural and financial requirements. 

Key legal clauses in Term Sheets and investment agreements: A Term Sheet is a non-binding document that outlines the basic terms and conditions under which investors (such as venture capital funds) will provide capital to a startup. It includes economic terms such as company valuation, investment amount, equity ratio, liquidation preference, and the governance structure that the investor will have in the business. Negotiating the Term Sheet is an extremely important step in the fundraising process, allowing founders to shape the main terms of the investment and protect their interests before entering into a binding agreement. A lack of understanding of the legal clauses in the Term Sheet and investment agreements can lead to founders losing control or accepting unfavorable long-term terms, even if fundraising is successful. A Term Sheet is not just about the investment amount but also about the governance structure and economic benefits. Clauses such as liquidation preference, control rights, and equity structure can greatly affect the future of the startup and the interests of its founders. Effective negotiation requires a deep understanding of these clauses to avoid undesirable legal consequences later. Startups need to meticulously prepare specific forecasts and ready data when requested by investors to persuade them. 

 2.4. Labor law and human resources policies 

Human resource management and compliance with labor law are important aspects for tech startups, especially in the context of rapid growth and fluctuating personnel needs. 

Employment contracts and flexible labor forms: An employment contract is a legal document that records the agreement between an employee and an employer regarding the job, rights, and obligations of each party in the employment relationship. The main contents of a contract include information about the employer and employee, job title, work location, contract duration, salary, working hours/rest periods, allowances, and other benefits. There are three main types of employment contracts: seasonal contracts, definite-term contracts (not exceeding 36 months, being allowed to renew once), and indefinite-term contracts. The Vietnamese labor market is trending towards stable, flexible, multi-dimensional, and sustainable development to meet the demand for high-quality human resources in new fields such as chips and semiconductors. Tech startups need to be flexible in using different types of employment contracts to suit their rapid growth and fluctuating personnel needs, while still ensuring legal compliance to avoid the risk of labor disputes. Startups often need to quickly change personnel or use project-based labor. Understanding the types of employment contracts and regulations on renewal is necessary to optimize costs and manage human resources effectively. However, abusing short-term contracts or failing to ensure the basic rights of employees can lead to legal disputes, affecting the startup’s reputation and operations. 

ESOP Policy (Employee Stock Ownership Plan): An ESOP is a form of issuing shares to company employees, especially those who have made significant contributions or have been with the company for a long time, to encourage and retain talent. ESOP shares are often issued with special preferential policies and may have transfer restrictions for a certain period. Conditions for issuing ESOP to a public company include: having an issuance plan approved by the General Meeting of Shareholders, the total number of shares issued not exceeding 5% of the company’s outstanding shares every 12 months, and the company having sufficient equity capital to increase its charter capital. The issuance procedure includes submitting a report on share issuance documents to the State Securities Commission of Viet Nam and publishing the Notice of Issuance on the issuer’s website and the Stock exchange. ESOP is a powerful tool to attract and retain talent in the competitive environment of tech startups, but its implementation must strictly comply with securities and corporate governance regulations to avoid legal risks. Tech startups, especially those in the early stage, often do not have sufficient financial resources to pay high salaries. ESOP is an attractive solution to share benefits and create motivation for employees. However, ESOP issuance involves complex regulations on securities and corporate governance. If the procedure is not followed correctly, it can lead to legal issues regarding the validity of the shares, shareholder rights, or even violations of securities law. 

Non-disclosure Agreements (NDA) and Non-compete Agreements (NCA): 

• NDA (Non-disclosure Agreements): This is a legal contract between two or more parties to protect confidential information (such as technology, business strategies, and customer lists) from being disclosed or misused by unauthorized parties. For an NDA to be effective, it is necessary to clearly define the information to be kept confidential, the scope of confidentiality, the term of confidentiality, and penalty clauses in case of violation. 

• NCA (Non-compete Agreements): This is an agreement to prevent employees or business partners from using confidential knowledge, experience, or information to directly compete with the company after the business relationship ends. The validity of an NCA in Viet Nam is still debated as it tends to violate the right to freedom of employment stipulated in the Law on the Constitution 2013 and the Labor Code 2012. However, these agreements are still valid and hold employees accountable for not disclosing the former employer’s secrets after the employment contract ends. Although NDAs and Non-competes are tools to protect the interests of startups, a legal balance is needed, especially for Non-competes, to avoid violating employees’ right to freedom of employment and to ensure the feasibility of the agreement. Tech startups rely heavily on trade secrets and proprietary technology, so an NDA is essential. However, an NCA can be seen as restricting an employee’s right to freedom of employment. This poses a challenge for startups in drafting these clauses to both protect their legitimate interests (preventing trade secret leakage, poaching personnel) and not violate labor rights regulations. The clauses need to be carefully drafted and may include compensation for the employee during the non-compete period to increase their legality and feasibility. 

Regulations on employee personal data protection: Businesses must comply with Decree 13/2023/ND-CP on personal data protection, including determining their role in the data processing process, classifying data (basic, sensitive), and establishing a transparent process for requesting and storing the consent of data subjects. Additionally, businesses must implement technical measures to protect personal data. Protecting employees’ personal data is not only a new legal obligation but also an important factor in building trust and business ethics for a startup. Decree 13/2023/ND-CP imposes many new obligations on businesses in processing personal data, including that of employees. Non-compliance can lead to administrative or criminal penalties. This is not just a legal risk but also affects the image and reputation of the startup, especially in the context of increasing awareness of privacy rights. 

2.5. Personal data protection and Cybersecurity 

Personal data protection and cybersecurity are legal issues that are becoming increasingly urgent and complex for tech startups. 

Law on Personal data protection (Decree 13/2023/ND-CP, Law No. 91/2025/QH15): The Law on Personal data protection 2025 (Law No. 91/2025/QH15), effective from January 1, 2026, provides detailed regulations on personal data, its protection, and the rights, obligations, and responsibilities of related agencies, organizations, and individuals. Decree 13/2023/ND-CP, effective from July 1, 2023, defines personal data protection as activities of preventing, detecting, stopping, and handling violations related to personal data. Personal data is classified into basic and sensitive data, with different protection requirements depending on the sensitivity of the information. Prohibited acts include: processing personal data in violation of the law, buying/selling personal data (except where the law provides otherwise), misappropriating, intentionally disclosing, or losing personal data. Data subjects have numerous rights, including: the right to know about the processing of their data, to consent to or withdraw consent, to view/edit data, to request data provision/deletion/processing restriction, and the right to file complaints/denunciations/lawsuits. The introduction of the Law on Personal data protection 2025 and Decree 13/2023/ND-CP marks a significant shift in Viet Nam’s legal framework for privacy, imposing a substantial compliance burden and requiring a change in culture within tech startups. Previously, personal data protection regulations were scattered across various documents. With Law No. 91/2025/QH15 and Decree 13/2023/ND-CP, Viet Nam now has a specialized and comprehensive legal framework. This means that startups can no longer operate in a “gray area” regarding data. They must proactively review and classify data, establish consent procedures, and even form specialized departments. Non-compliance will face severe penalties.   

Obligations of businesses in collecting, processing, and storing personal data: To comply with the new regulations, businesses must perform a series of detailed and complex obligations. The first is to review and classify the personal data being collected and processed to understand the nature and sensitivity of each group of information. If sensitive data is processed, the business must establish Data Protection Officer (DPO). Establishing a transparent process for requesting and storing the consent of data subjects is mandatory. Businesses also need to create and regularly update their personal data protection policies, while also retaining Data Protection Impact Assessment (DPIA) records and assessments of cross-border data transfers. Finally, businesses are obligated to notify and submit a personal data processing impact assessment dossier to the Ministry of Public Security. These detailed and complex obligations require startups to invest significantly in processes, technology, and legal personnel, going beyond core business activities. The requirements of Decree 13/2023/ND-CP and Law No. 91/2025/QH15 are not just about reading the law but about implementing complex procedures such as data classification, obtaining consent, and creating impact assessment dossiers. In particular, the requirement to establish a DPO department and submit dossiers to the Ministry of Public Security indicates a higher level of supervision and compliance requirement. This can be a significant financial and resource burden for small startups. 

Table 2: Business Obligations for Personal Data Protection under Decree 13/2023/ND-CP and Law No. 91/2025/QH15 

Regulations on Cross-Border Data Transfer: The Law on Data 2024, effective from July 1, 2025, allows agencies, organizations, and individuals the freedom to transfer data from abroad to Viet Nam and process foreign data in Viet Nam. However, the transfer of personal data of Vietnamese citizens abroad or the use of foreign platforms (such as cloud services, software, applications with servers located outside Vietnamese territory) to process data is considered “cross-border data transfer and processing” and must comply with Decree 165/2025/ND-CP. Although there is freedom to transfer data into Viet Nam, the transfer of data out of the country (especially personal data) is subject to stricter supervision, creating a legal challenge for tech startups with global operations or those using international cloud services. With the trend of globalization and the use of cloud services with servers located abroad, cross-border data transfer is a common activity for tech startups. The Law on Data 2024 and Decree 165/2025/ND-CP provide clearer regulations on this activity, especially for the personal data of Vietnamese citizens. This means that startups need to review their data flows, ensuring that cross-border data transfers comply with the new regulations, which may require additional legal agreements or technical measures to ensure security. 

Law on Cyber Security (Decree 53/2022/ND-CP) and data storage requirements in Viet Nam: Decree 53/2022/ND-CP, effective from October 1, 2022, details a number of articles of the Law on Cyber Security and regulates cybersecurity protection measures. Accordingly, domestic and foreign businesses that provide services on telecommunications networks, the internet, and value-added services in Viet Nam must store the following types of data in Viet Nam: personal data of service users in Viet Nam, data on the relationships of service users, and data generated by service users in Viet Nam. The minimum storage period is 24 months. Additionally, foreign businesses operating in certain specific fields (such as telecommunications, data storage/sharing, e-commerce, social networks, online games) may be required to store data and establish a branch or representative office in Viet Nam if their services are used to violate cybersecurity laws and they do not cooperate with the requests of the Ministry of Public Security. The data localization requirement in Viet Nam under Decree 53/2022/ND-CP creates a significant cost and infrastructure barrier for both domestic and international startups, while also demonstrating national sovereignty in cyberspace. The requirement for domestic data storage is an increasingly common legal trend worldwide. For tech startups, especially those with a business model based on big data or with international users, this may require a large investment in server infrastructure in Viet Nam or the adjustment of existing system architecture. This is not only a legal obligation but also a challenge in terms of cost and scalability, and it reflects the state’s increased control over user data. 

 2.6. Contracts and Terms of Service 

Contracts and terms of service are important legal documents that define the relationship between a tech startup and its customers, partners, and users. 

Types of technology contracts (Software service contracts, IT): A software service contract typically gives the customer access to software stored on the service provider’s server, rather than on the customer’s server or hardware. An IT service contract is an agreement on the use of an internet environment and programming languages to create certain products, applications, or programs that bring specific benefits. These contracts must have clear provisions on security, service quality, scope of service provision, commitments of the parties, contract value, payment methods, rights and obligations of the parties, contract penalty clauses, damage compensation, force majeure events, dispute resolution mechanisms, and the effective period of the contract. Circular 23/2020/TT-BTTTT of the Ministry of Information and Communications also specifies the particular contents of IT service contracts using state budget funds, including requirements for technical aspects, service quality, and information security. The use of readily available contract templates from the internet without legal review is a major risk, leading to unclear, non-binding, or inadequate provisions that fail to fully protect the startup’s interests. Startups often lack a legal department and tend to use online contract templates. However, sources show that technology contracts have many complex and specific clauses. Using general templates may not be suitable for the startup’s specific business model, leading to legal loopholes, unnecessary disputes, or unenforceability when problems arise. 

Terms of Service and Privacy Policy for applications/websites: The Terms of Service for a website or application regulate the legal use of the service, user compliance, third-party linking rules, and intellectual property rights over the content on the platform. The information security and personal data protection policy specifies how the company handles data, personal data of data subjects, customers, and related parties. The processing of personal data must be based on the consent of the data subject. The Terms of Service and Privacy Policy are not only mandatory legal documents but also tools for building user trust and mitigating legal risks related to privacy and service liability. In the digital age, users are increasingly concerned about their privacy and how their data is used. A clear, transparent privacy policy that complies with new personal data protection regulations not only helps a startup comply with the law but also builds customer trust. Conversely, unclear or incomplete terms of service can lead to disputes with users and regulatory agencies. 

Legal liability when providing digital services: With the development of digital platforms, a startup’s legal liability is not limited to its product but also extends to platform management, consumer protection, and ensuring transparency in online business activities. E-commerce businesses have a primary responsibility to protect consumer rights, including: providing accurate and transparent product information, effective customer service, and personal data security. The Law on Protection of Consumer Rights 2023 and Decree 55/2024/ND-CP have added many provisions to protect consumer rights in e-commerce, clarify the responsibilities of organizations that establish and operate intermediary and large digital platforms, and also regulate the use of algorithmic systems and targeted advertising for specific consumer groups. The increase in regulations on tax management and consumer protection in e-commerce indicates that the digital business environment is becoming increasingly stringent, requiring startups to be more transparent and responsible. With the explosion of e-commerce, issues of taxation and consumer protection have become urgent. Decree 117/2025/ND-CP and the Law on Protection of Consumer Rights 2023 show increased government regulation. Startups in this field need to be cautious. Startups in this field need to focus not only on revenue growth but also on building strong tax compliance processes and consumer protection policies to avoid legal risks and build long-term reputation. 

2.7. Industry-specific legal issues (if any) 

In addition to general legal matters, tech startups operating in specialized sectors must also adhere to industry-specific regulations. 

Fintech (E-wallets, P2P Lending, Sandbox mechanism): 

• E-wallets: E-wallet service providers are prohibited from issuing more than one e-wallet per customer’s payment account at a bank. They are also prohibited from extending credit to e-wallet users or paying interest on e-wallet balances. The maximum transaction limit for a customer’s e-wallet is capped at 100 million VND per month. Detailed regulations also govern the top-up, payment, transfer, and withdrawal of funds from e-wallets. 

• P2P Lending (Peer-to-Peer Lending): Viet Nam is scheduled to begin a two-year pilot program for P2P lending starting from July 1, 2025. Only P2P lending companies licensed by the State Bank of Viet Nam will be permitted to operate. Currently, there are no specific legal instruments directly governing P2P lending, but related activities may be subject to the Law on Credit Institution and the Decree on non-cash payments.   

• Crowdfunding: As of November 2022, Viet Nam lacks formal legal regulations on crowdfunding, despite its potential as a fundraising channel that requires recognition and management. Forms of crowdfunding include donation-based and reward-based models.   

• Sandbox Mechanism: Decree 94/2025/ND-CP on on regulatory sandbox mechanism in the banking sector provides an opportunity for Vietnamese Fintech companies to test new solutions in a controlled environment. The rapid development of Fintech, while the legal framework is still under development, creates both opportunities and risks. The Sandbox mechanism is a crucial step to test new models, but startups must clearly understand its limits and conditions to avoid operating in a legal ‘gray area’. Fintech is a rapidly innovative field. However, the lack of specific regulations can lead to significant legal risks, particularly in P2P lending with its potential for defaults and fraud. The Sandbox mechanism is a solution to foster innovation while controlling risks. Fintech startups must proactively participate in and comply with Sandbox regulations to legitimize their operations and attract investment, while also recognizing that participation does not guarantee compliance with future business or investment regulations once formal laws are enacted. 

Edtech (online training license): While Edtech has great potential, startups in this sector must pay close attention to regulations on online education quality and licensing to ensure legality and credibility. The procedure for applying for an online training license is necessary, including conditions regarding the online training portal or website and required documents. The Ministry of Education and Training has also issued regulations on three forms of online teaching. Education is a sensitive field, and providing online training services requires a license. Information sources point to the conditions and procedures for obtaining a license, as well as regulations on online teaching formats from the Ministry of Education and Training. This indicates that Edtech startups not only need to develop a technology platform but also must invest in complying with educational regulations, ensuring the quality of content and teaching methods to avoid legal risks and build trust with learners. 

E-commerce (platform liability, consumer protection): The government has issued Decree 117/2025/ND-CP prescribing tax administration for business activities on e-commerce platforms and digital platforms by households and individuals. Regulations on e-commerce operations include Decree 52/2013/ND-CP and other amending decrees and circulars. The responsibilities of e-commerce businesses include: protecting consumer rights (providing accurate product information, customer service, personal data security), ensuring good working conditions for employees, protecting the environment, and contributing to the community. The Law on Protection of Consumer Rights 2023 and Decree 55/2024/ND-CP add many provisions to protect consumer rights in e-commerce, clarify the responsibilities of organizations that establish intermediary digital platforms, and regulate the use of algorithmic systems and targeted advertising for specific consumer groups. The increase in regulations on tax management and consumer protection in e-commerce indicates that the digital business environment is becoming increasingly stringent, requiring startups to be more transparent and responsible. 

III. Common legal risks and prevention strategies 

Tech startups in Viet Nam often face numerous legal risks, most of which are not random but a direct result of a lack of legal knowledge and an over-emphasis on other business aspects, such as product development and market expansion. Identifying these root causes is crucial for building an effective prevention strategy. 

Table 3: Core legal issues and common risks for tech startups in Viet Nam 

Risk mitigation and legal compliance strategy: The key to mitigating legal risks for tech startups lies in shifting from a ‘reactive’ to a ‘proactive’ mindset in legal management, viewing legal considerations as an indispensable part of the business strategy. Instead of merely addressing issues as they arise, a startup must proactively build a solid legal foundation from the outset. 

Specific strategies include: 

• Enhancing legal awareness: Founders and the entire team must receive regular training on basic legal issues relevant to their business operations. This helps them identify risks early and make appropriate decisions. 

• Professional legal counsel: Seek assistance from law firms specializing in tech startups from the very beginning. Legal experts can help the startup choose the appropriate business entity type, draft robust internal agreements and contracts with partners, and provide counsel on a comprehensive intellectual property protection strategy. 

• Establishing an internal legal framework: Implement stringent internal procedures and regulations for corporate governance, labor policies, and information security. This includes building processes for collecting and processing personal data, ESOP policies, and carefully drafted non-disclosure/non-compete agreements. 

• Regular review and updates: Regularly review newly enacted legal documents and adjust business operations accordingly. The legal environment in Viet Nam, particularly in the technology sector, is changing rapidly, requiring high flexibility and adaptability. 

• Transparency and thorough preparation: Especially during fundraising activities, startups must prepare complete legal and financial dossiers and related information to build trust with investors. Transparency is not only a legal requirement but also a factor in building credibility. 

• Participating in training programs and communities: Actively participate in specialized seminars, read legal manuals, and connect with the startup community to enhance knowledge and share experiences with other startups and legal experts. 

This mindset helps startups not only avoid penalties but also build credibility, attract investment, and achieve sustainable development. 

IV.  Legal resources and support for tech startups 

To enable tech startups in Viet Nam to proactively comply with legal requirements and mitigate risks, access to legal resources and support is of paramount importance. 

Important legal documents to refer to: The sheer volume and continuous updating of legal documents related to technology require startups to have an effective mechanism for monitoring and accessing legal information. The following list includes core legal instruments that every tech startup should master: 

• Law on Enterprise 2020. 

• Law on Intellectual Property 2005 (as amended and supplemented in 2009, 2019, 2022). 

• Civil Code 2015. 

• Labor Code 2019. 

• Law on Cyber Security 2018. 

• Law on Personal data protection 2025 (Law No. 91/2025/QH15), effective from January 1, 2026. 

• Decree 13/2023/ND-CP on personal data protection. 

• Decree 53/2022/ND-CP detailing the Law on Cyber Security. 

• Decree 165/2025/ND-CP detailing a number of articles and measures for the implementation of the Law on Data, effective from July 1, 2025. 

• Decree 94/2025/ND-CP providing the regulatory sandbox in the banking sector, effective from July 1, 2025. 

• Decree 117/2025/ND-CP prescribing tax administration for business activities on e-commerce platforms and digital platforms by households and individuals. 

• Decree 52/2013/ND-CP and other amending decrees and circulars on e-commerce. 

This list of legal documents indicates an increasingly complex and constantly evolving legal framework. This poses a significant challenge for startups to keep themselves updated. Therefore, having a reliable source of information or collaborating with legal experts is essential to ensure compliance. 

Legal support organizations and professional consultants: Collaborating with professional legal and financial consulting organizations not only helps startups address compliance issues but also enhances their governance capabilities, which is especially important during the fundraising process with large investors. Startups can seek support from: 

• Law firms specializing in corporate and intellectual property law: For example, Apolat Legal, ASL LAW, Duong Tri Law, Thien Thanh Law, HT Partners Law & IP. These firms provide services such as corporate formation consultancy, IP protection, contract drafting, and dispute resolution. 

• Major audit and consulting firms: Such as Deloitte Viet Nam, PwC Viet Nam, KPMG, EY. These companies offer auditing services, tax consultancy, and governance system advice, which helps startups gain financial and legal confidence during fundraising, especially from foreign investment funds with high procedural and financial requirements. Information sources indicate that many Vietnamese startups have weaknesses in financial and legal compliance, which makes fundraising difficult. Major consulting firms not only provide legal services but also offer financial, tax, and governance support, demonstrating that their role is not just to solve problems but to act as strategic partners, helping startups build a solid foundation for growth and attracting investment. 

• Startup support organizations: For example, ThinkZone Ventures collaborates with Deloitte Viet Nam to support startups with expertise, professional experience, and connections to state agencies to refine investment policies. 

Seminars and legal handbooks: Legal handbooks and training events are important channels for disseminating knowledge and raising legal awareness within the startup community, especially as regulations are constantly changing. 

• Specialized seminars on startups and brand protection. 

• Legal and financial handbooks for startups, such as the “Legal and Financial Handbook for Startups” by Assoc. Prof. Dr. Nguyen Van Huy. 

• Startup handbooks from the Ministry of Justice or other legal organizations.

With a dynamic legal environment, continuous knowledge updates are crucial. Seminars and handbooks play a vital role in conveying legal information in an accessible and practical manner to founders, helping them be more proactive in ensuring compliance.  

V.  Conclusion and recommendations 

The legal environment for tech startups in Viet Nam is undergoing a rapid evolution, with numerous new regulations being promulgated, particularly in critical areas such as intellectual property, personal data protection, cybersecurity, and Fintech. This transformation presents both significant opportunities and challenges for startup enterprises. 

Core legal issues that tech startups must particularly consider include: the enterprise formation process and capital structure; intellectual property protection (for software, patents, trademarks, and trade secrets); regulations pertaining to fundraising (especially from foreign investors); compliance with labor laws and the establishment of human resources policies (including ESOP, NDA, and Non-compete); personal data protection and cybersecurity (including the Law on Personal data protection 2025, Decree 13/2023/ND-CP, Decree 53/2022/ND-CP on data localization in Viet Nam, and regulations on cross-border data transfer); the meticulous drafting of contracts and terms of service; and industry-specific legal issues such as those in Fintech (e-wallets, P2P Lending, Sandbox), Edtech (online training licenses), and E-commerce (platform liability, consumer protection). 

The common legal risks faced by tech startups primarily stem from the lack of legal awareness and knowledge among founders. This leads to errors in selecting the appropriate business entity, managing capital, complying with tax obligations, drafting loose contracts, and, notably, failing to prioritize intellectual property protection. Such oversights can result in internal disputes, loss of competitive advantage, administrative/criminal penalties, erosion of customer trust, and severe impacts on the valuation and viability of the startup. 

To mitigate risks and achieve sustainable growth within this evolving legal landscape, tech startups in Viet Nam are advised to implement the following recommendations: 

• Proactively study and update legal knowledge: Law should be regarded as an indispensable part of the business strategy, not merely an obligation but a competitive advantage. Founders must dedicate time to grasp new regulations and understand their impact on their operations. 

• Build a solid legal foundation from the outset: Place particular emphasis on selecting the suitable business entity and establishing clear and transparent founders’ and shareholders’ agreements. Simultaneously, a comprehensive intellectual property protection strategy is required, including the registration of IP assets and the implementation of internal measures to safeguard trade secrets. 

• Invest in personal data protection and cybersecurity compliance: This is a mandatory and increasingly stringent trend. Startups must establish internal procedures, invest in secure technologies, and consider appointing dedicated personnel to ensure compliance with regulations on the collection, processing, storage, and transfer of personal data. 

• Seek professional legal counsel: Collaborate with law firms and financial consultants experienced in the technology sector. The support of these experts will help startups ensure compliance, optimize transactions (especially during fundraising), and effectively resolve complex legal issues. 

• Participate in training programs and communities: Actively engage in seminars and legal training courses for startups. This not only enhances knowledge but also provides opportunities to share experiences and learn from other startups and industry experts. 

By shifting from a reactive to a proactive mindset in legal management, tech startups can transform challenges into opportunities, build trust with investors and customers, and thereby achieve sustainable development and market success. 

We hope the information provided above has helped you better understand the key considerations for establishing and operating a tech startup. Should you have any further questions or require professional legal advice, please do not hesitate to contact Apolat Legal at:

• Phone: 0911 357 447

• Email: info@apolatlegal.com

• Website: apolatlegal.com

Author of post: Lawyer Trinh Ngoc Nam

Related posts

1. Startup: Things need to be kept in mind when negotiating a founder agreement
2. Startup: 5 Legal Issues To Consider Before Starting Up A Business

Share: